This guide shows how to install and configure NGINX Docker with reverse proxy configurations and full grade A+ SSL Labs while also obtaining a LetsEncrypt cert via acme.sh client and CloudFlare DNS API
export DOMAIN= export ACME_EMAIL= export CF_Zone_ID="" export CF_Account_ID="" export CF_Token="" export CERTPATH="" export KEYPATH="" export PROXYADDRESS=""
| server { | |
| listen 80; | |
| listen [::]:80; | |
| server_name DOMAIN; | |
| location / { | |
| return 301 https://$host$request_uri; | |
| } | |
| } | |
| server { | |
| listen 443 ssl http2; | |
| listen [::]:443 ssl http2; | |
| server_name DOMAIN; | |
| ssl_certificate CERT_PATH; | |
| ssl_certificate_key KEY_PATH; | |
| ssl_session_timeout 1d; | |
| ssl_session_cache shared:MozSSL:10m; # about 40000 sessions | |
| ssl_session_tickets off; | |
| # intermediate configuration | |
| ssl_protocols TLSv1.2 TLSv1.3; | |
| ssl_prefer_server_ciphers on; | |
| ssl_ciphers "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"; | |
| ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256; | |
| ssl_conf_command Options ServerPreference,PrioritizeChaCha,NoRenegotiation,NoResumptionOnRenegotiation; | |
| ssl_ecdh_curve secp521r1:secp384r1; | |
| # HSTS (ngx_http_headers_module is required) (31536000 seconds) | |
| add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always; | |
| # OCSP stapling | |
| ssl_stapling on; | |
| ssl_stapling_verify on; | |
| location / { | |
| proxy_pass PROXY_ADDRESS; | |
| proxy_set_header Host $host; | |
| proxy_set_header X-Real-IP $remote_addr; | |
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
| proxy_set_header X-Forwarded-Proto $scheme; | |
| } | |
| # CloudFlare DNS | |
| resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]; | |
| } |