nginx

# the upstream component nginx needs to connect to
upstream uniticket {
    server 127.0.0.1:3000;
}

# configuration of the server
server {
    # the port your site will be served on
    listen      80;
    # the domain name it will serve for

    server_name ticket.unical.it;
    # substitute your machine's IP address or FQDN

    access_log /var/log/nginx/uniticket.access.log;
    error_log  /var/log/nginx/uniticket.error.log error;

    return 301 https://$host$request_uri;
}

server {
    server_name ticket.unical.it;
    listen 443 ssl;

    ssl_certificate /etc/ssl/certs/unical.it/ticket.unical.it.crt;
    ssl_certificate_key /etc/ssl/certs/unical.it/server.key;

    access_log /var/log/nginx/uniticket.log;
    error_log  /var/log/nginx/uniticket.log error;

    # gestione timeout in tutte le salse
    # more time for 502 gateway timeout
    #keepalive_timeout 60;
    #types_hash_max_size 2048;
    #client_header_timeout 60;
    #client_body_timeout 60;
    #send_timeout 80;
    #fastcgi_buffers 8 16k;
    #fastcgi_buffer_size 32k;
    #fastcgi_connect_timeout 60;
    #fastcgi_send_timeout 60;
    #fastcgi_read_timeout 60;
    # end

    # SSL HARDENING
    # disable poodle attack
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;
    # openssl dhparam -out /etc/nginx/dhparam.pem 4096
    ssl_dhparam /etc/nginx/dhparam.pem;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
    ssl_session_timeout  10m;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off; # Requires nginx >= 1.5.9
    ssl_stapling on; # Requires nginx >= 1.3.7
    ssl_stapling_verify on; # Requires nginx => 1.3.7
    # add tyour trusted dns service here
    #resolver 160.97.7.13 160.97.7.14 valid=300s;
    #resolver_timeout 5s;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    # FINE SSL HARDENING

    # Django static
    location /static  {
        alias /opt/uniticket/data/static;  # your Django project's static files - amend as required
        autoindex off;
    }

    # Django logos
    location /media/logos  {
        alias /opt/uniticket/data/media/logos;  # your Django logos files - amend as required
        autoindex off;
    }

    # this is the endpoint of the channels routing
    location /ws/ {
        proxy_pass http://localhost:8089; # daphne (ASGI) listening on port 8089
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_connect_timeout 6h;
	proxy_read_timeout 6h;
	proxy_send_timeout 6h;
    }

    # Finally, send all non-media requests to the Django server.
    location / {
        uwsgi_pass  uniticket;
        uwsgi_param HTTP_X_FORWARDED_PROTOCOL https;

        # deny iFrame
        add_header X-Frame-Options "DENY";

        uwsgi_connect_timeout 75s;
        #uwsgi_read_timeout 300s;
        uwsgi_read_timeout 33;
        client_max_body_size 10m;
        include     /opt/uniticket/uwsgi_setup/uwsgi_params; # the uwsgi_params file you installed
    }

}