server {
    listen 80;
    server_name EXTERNAL_THINGSBOARD_DOMAIN.com;

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    } # managed by Certbot
}

server {
        listen 443 ssl;
        server_name  EXTERNAL_THINGSBOARD_DOMAIN.com;
        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
                ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
                ssl_session_cache shared:SSL:1m;
        ssl_session_timeout 1d;
        ssl_protocols TLSv1.2;
        ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
        ssl_prefer_server_ciphers on;
        ssl_stapling on;
        ssl_stapling_verify on;


        location / {
                proxy_pass http://LOCAL_THINGSGBOARD_IP_OR_DOMAN:8080;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
                proxy_set_header Host $host;
        }
}