slachiewicz · November 13, 2015 09:00 · Oct 12, 2015 · Oct 12, 2015 · Oct 12, 2015 · Oct 12, 2015
diff --git a/nginx.conf b/nginx.conf
@@ -24,6 +24,7 @@ server {
 
 server {
   listen 443;
+  # listen 443 http2; if you're using latest nginx version 1.9.5+
   server_name _;
 
   limit_conn conn_limit_per_ip 10;

diff --git a/nginx.conf b/nginx.conf
@@ -0,0 +1,106 @@
+# command to generate dhparams.pen
+# openssl dhparam -out /etc/nginx/conf.d/dhparams.pem 2048
+
+limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
+limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=5r/s;
+limit_req_status 444;
+limit_conn_status 503;
+
+proxy_cache_path /var/lib/nginx/proxy levels=1:2 keys_zone=backcache:8m max_size=50m;
+proxy_cache_key "$scheme$request_method$host$request_uri$is_args$args";
+proxy_cache_valid 404 1m;
+
+upstream app_server {
+  server unix:/tmp/unicorn.myserver.sock fail_timeout=0;
+}
+
+server {
+  listen 80;
+  server_name *.example.com;
+  limit_conn conn_limit_per_ip 10;
+  limit_req zone=req_limit_per_ip burst=10 nodelay;
+  return 301 https://$host$request_uri$is_args$args;
+}
+
+server {
+  listen 443;
+  server_name _;
+
+  limit_conn conn_limit_per_ip 10;
+  limit_req zone=req_limit_per_ip burst=10 nodelay;
+
+  ssl on;
+
+  ssl_stapling on;
+  ssl_stapling_verify on;
+  ssl_trusted_certificate /etc/nginx/conf.d/ca.pem;
+
+  ssl_certificate /etc/nginx/conf.d/ssl-unified.crt;
+  ssl_certificate_key /etc/nginx/conf.d/private.key;
+  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
+  ssl_dhparam /etc/nginx/conf.d/dhparams.pem;
+  ssl_prefer_server_ciphers on;
+  ssl_session_cache shared:SSL:10m;
+  ssl_session_timeout 10m;
+
+  root /home/deployer/apps/example.com/current/public;
+
+  gzip_static on;
+  gzip_http_version   1.1;
+  gzip_proxied        expired no-cache no-store private auth;
+  gzip_disable        "MSIE [1-6]\.";
+  gzip_vary           on;
+
+  client_body_buffer_size 8K;
+  client_max_body_size 20m;
+  client_body_timeout 10s;
+  client_header_buffer_size 1k;
+  large_client_header_buffers 2 16k;
+  client_header_timeout 5s;
+
+  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains"; 
+
+  keepalive_timeout 40;
+
+  location ~ \.(aspx|php|jsp|cgi)$ {
+    return 404;
+  }
+
+  location ~* ^/assets/ {
+    root /home/deployer/apps/example.com/current/public;
+    # Per RFC2616 - 1 year maximum expiry
+    # http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html
+    expires 1y;
+    add_header Cache-Control public;
+    access_log  off;
+    log_not_found off;
+
+    # Some browsers still send conditional-GET requests if there's a
+    # Last-Modified header or an ETag header even if they haven't
+    # reached the expiry date sent in the Expires header.
+    add_header Last-Modified "";
+    add_header ETag "";
+    break;
+  }
+
+  try_files $uri $uri/index.html $uri.html @app;
+
+  location @app {
+    proxy_set_header X-Url-Scheme $scheme;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+    # enable this if you forward HTTPS traffic to unicorn,
+    # this helps Rack set the proper URL scheme for doing redirects:
+    proxy_set_header X-Forwarded-For-Forwarded-Proto $https;
+
+    proxy_set_header Host $host;
+    proxy_redirect off;
+    proxy_pass http://app_server;
+  }
+
+  error_page 500 502 503 504 /500.html;
+  location = /500.html {
+    root /home/deployer/apps/example.com/current/public;
+  }
+}