nodeapi.conf

# Create a new conf file for each service you want to "map" behind nginx 
upstream app {
  # Here you'll connect to your app's container, the name is given by whatever 
  # you name it in the docker-compose.yml

  # The web application.
  server app:3000;
}

server {
  # Create a new conf file for each service you want to "map" behind nginx 
  # You can have one conf for the base domain www.example.com OR example.com
  server_name api.example.com;
  listen 80;

  # All http traffic will get redirected to SSL.
  return 307 https://$host$request_uri;
}

server {
  # "deferred" reduces the number of formalities between the server and client.
  # Create a new conf file for each service you want to "map" behind nginx 
  # You can have one conf for the base domain www.example.com OR example.com
  server_name api.example.com;
  listen 443 ssl;

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
  ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS';
  ssl_prefer_server_ciphers on;
  ssl_session_timeout 5m;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets off;
  ssl_certificate           /etc/nginx/certs/server.crt;
  ssl_certificate_key       /etc/nginx/certs/server.key;
  ssl_dhparam               /etc/nginx/certs/dhparam.pem;
  
  # ssl_client_certificate and ssl_verify_client are the lines that activate 
  # client side ssl auth. Remove these two and you'll have a normal server with ssl 
  # activated
  ssl_client_certificate    /etc/nginx/certs/ca.crt;
  ssl_verify_client         on;
  
  ssl_stapling on;
  ssl_stapling_verify on;

  #ssl_trusted_certificate /etc/nginx/certs/server.crt


  add_header Strict-Transport-Security "max-age=31536000" always;

  # Disallow access to hidden files and directories.
  location ~ /\. {
    return 404;
    access_log off;
    log_not_found off;
  }

  # Allow optionally writing an index.html file to take precedence over the upstream.
  try_files $uri $uri/index.html $uri.html @app; #@app is the name of the upstream you defined above

  # Attempt to load the favicon or fall back to status code 204.
  location = /favicon.ico {
    try_files /favicon.ico = 204;
    access_log off;
    log_not_found off;
  }
  
  # Load the web app back end with proper headers.
  location @app {
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_redirect off;
    # we'll do proxy_pass to the upstream block above, which should be pointed at the web-app container.
    proxy_pass http://app;
    proxy_http_version 1.1;
  }
}