example-nginx.conf

server {
  listen 443 ssl;

  server_name example.com;

  ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
  ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

  add_header Strict-Transport-Security max-age=15768000;

  location / {
    # Pass the request on to Varnish.
    proxy_pass  http://example.localhost:6081;

    client_max_body_size 20M;

    # Pass a bunch of headers to the downstream server, so they'll know what's going on.
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    # Most web apps can be configured to read this header and understand that the current session is actually HTTPS.
    proxy_set_header X-Forwarded-Proto https;

    # We expect the downsteam servers to redirect to the right hostname, so don't do any rewrites here.
    proxy_redirect     off;

    # We get a lot of traffic, so we'll need a lot buffers.
    proxy_buffers 256 4k;
  }
}

# Redirect all standard site URLs to the secure version.
server {
  listen 80;
  server_name example.com;
  return 301 https://example.com$request_uri;
}