ran-boilerplate/helper_scripts/https.nginx.conf

React . Apollo (GraphQL) . Next.js Toolkit

#################################################################################
### Put this file in /etc/nginx/conf.d folder if you want to support HTTPS 
### and make sure you have a line 'include /etc/nginx/conf.d/*.conf;'
### in your main nginx configuration file
#################################################################################

#################################################################################
### Redirect to the same URL with https://
#################################################################################

server {
  listen 80 default_server;
  listen [::]:80 default_server ipv6only=on;

  ### Change "exampleaddress.com" to your host name
  server_name localhost exampleaddress.com;

  return 301 https://$server_name$request_uri;
}

#################################################################################
### HTTPS configurations
#################################################################################

server {
  listen 443 ssl;

  ### Change "exampleaddress.com" to your host name
  server_name localhost exampleaddress.com;

  ### Change "YOUR_DIRECTORY" to your directory
  root /var/www/YOUR_DIRECTORY;
  index index.html index.htm;

  #################################################################################
  ### SSL Config
  #################################################################################

  ### Configure the Certificate and Key you got from your CA (e.g. Lets Encrypt)
  ssl_certificate     /path/to/certificate.crt;
  ssl_certificate_key /path/to/server.key;

  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets off;

  ### Only use TLS v1.2 as Transport Security Protocol
  ssl_protocols TLSv1.2;

  ### Only use ciphersuites that are considered modern and secure by Mozilla
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

  ### Do not let attackers downgrade the ciphersuites in Client Hello
  ### Always use server-side offered ciphersuites
  ssl_prefer_server_ciphers on;

  ### HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
  add_header Strict-Transport-Security max-age=15768000;

  ### Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
  ### Uncomment if you want to use your own Diffie-Hellman parameter, which can be generated with: openssl ecparam -genkey -out dhparam.pem -name prime256v1
  ### See https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam
  ### ssl_dhparam /path/to/dhparam.pem;


  ### OCSP Configuration START
  #### If you want to provide OCSP Stapling, you can uncomment the following lines
  #### See https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx for more infos about OCSP and its use case
  #### fetch OCSP records from URL in ssl_certificate and cache them

  ### ssl_stapling on;
  ### ssl_stapling_verify on;

  ### verify chain of trust of OCSP response using Root CA and Intermediate certs (you will get this file from your CA)
  #ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

  #### OCSP Configuration END

  ### To let nginx use its own DNS Resolver
  ### resolver <IP DNS resolver>;

  #################################################################################
  ### SSL Config - End
  #################################################################################

  location / {
    ### default port, could be changed if you use next with custom server
    proxy_pass http://localhost:3000;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;

    ### if you have try_files like this, remove it from our block
    ### otherwise next app will not work properly
    ### try_files $uri $uri/ =404;
  }

  location /sw.js {
    add_header Cache-Control "no-cache";
    proxy_cache_bypass $http_pragma;
    proxy_cache_revalidate on;
    expires off;
    access_log off;
  }

  location /favicon.ico {
    log_not_found off;
    access_log off;
  }

  location /robots.txt {
    allow all;
    log_not_found off;
    access_log off;
  }

  location ~ /\. {
    deny all;
  }

  location ~* /(?:uploads|files)/.*\.js$ {
    deny all;
  }
}