nginx.conf

# [1] SSL Configuration according to Mozilla guidelines
#     https://wiki.mozilla.org/Security/Server_Side_TLS
#     https://mozilla.github.io/server-side-tls/ssl-config-generator/
# [2] Security Procedures according to OWASP
#     https://www.owasp.org/index.php/SCG_WS_nginx#SSL_Module
# [3] https://unix.stackexchange.com/questions/94104/real-world-use-of-tcp-defer-accept
# [4] OCSP fetch OCSP records from URL in ssl_certificate and cache them
#     https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx
# [5] https://www.digitalocean.com/community/tutorials/understanding-nginx-http-proxying-load-balancing-buffering-and-caching
# [6] http://reinout.vanrees.org/weblog/2015/11/19/nginx-proxy-gzip.html
# [7] https://ma.ttias.be/enable-keepalive-connections-in-nginx-upstream-proxy-configurations/

# This file is used by ServerManager to pass requests to SupermarKit container
# over the shared bridge networks

upstream supermarkit {
  # [7] The keepalive parameter sets the maximum number of idle keepalive connections
  # to upstream servers that are preserved in the cache of each worker process. When
  # this number is exceeded, the least recently used connections are closed.
  keepalive 100;

  # Alias used over the bridge network with ServerManager to pass to supermarkit
  # container
  server SUPERMARKIT:80;
}

# [1] HTTP Configuration
server {
  server_name supermarkit.ca;

  # [3] Use deferred for performance optimization
  listen 80;

  # Enable IPv6
  listen [::]:80;

  # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
  return 301 https://$host$request_uri;
}

# [1] HTTPS Configuration
server {
  server_name                           supermarkit.ca;
  listen                                443 ssl http2;
  listen                                [::]:443 ssl http2;
  ssl_certificate                       /etc/nginx/letsencrypt/live/supermarkit.ca/fullchain.pem;
  ssl_certificate_key                   /etc/nginx/letsencrypt/live/supermarkit.ca/privkey.pem;
  ssl_session_cache                     shared:SSL:50m;
  ssl_session_timeout                   5m;
  ssl_session_tickets                   off;
  ssl_dhparam                           /etc/nginx/certs/dhparam.pem;
  ssl_prefer_server_ciphers             on;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
  ssl_protocols                         TLSv1 TLSv1.1 TLSv1.2;

  # [4] OCPS Stapling
  ssl_stapling                          on;
  ssl_stapling_verify                   on;
  ## verify chain of trust of OCSP response using Root CA and Intermediate certs
  ssl_trusted_certificate /etc/nginx/letsencrypt/live/supermarkit.ca/chain.pem;

  # [2] HTTP Secure Headers
  add_header Strict-Transport-Security  "max-age=63072000; includeSubdomains; preload";
  add_header X-Frame-Options            SAMEORIGIN;
  add_header X-Content-Type-Options     nosniff;

  # [2]
  server_tokens off;

  # Used to renew certificates using the webroot method.
  # To renew certs using letsencrypt run the letsencrypt service with certonly
  # and specify the /usr/share/nginx/html webroot
  location ~ /\.well-known/acme-challenge {
  	root /usr/share/nginx/html;
  }

  location / {
    # [5] Pass a host to upstream server equal to the request line if present or
    # client request host header
    proxy_set_header Host $host;

    # [5] Must tell upstream server that the request was http or https
    # if not present, then if rails force_ssl is on it will keep sending
    # location header and instruct the browser to redirect to https
    proxy_set_header X-Forwarded-Proto $scheme;

    # [6] The gzip and proxy modules use different http module versions. In
    # order for gzip compresion to work you need to set the proxy module
    # http version to 1.1 same as the gzip module
    proxy_http_version 1.1;

    # [7] Remove the Connection header if the client sends it,
    # it could be "close" to close a keepalive connection
    proxy_set_header Connection "";

    proxy_pass http://supermarkit;
  }
}