nginx.conf

user root;
pid /run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    multi_accept on;
    worker_connections 65535;
}

http {
    charset utf-8;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    log_not_found off;
    types_hash_max_size 2048;
    client_max_body_size 16M;

    # MIME
    include mime.types;
    default_type application/octet-stream;

    # limits
    limit_req_log_level warn;
    limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;

    # SSL
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # modern configuration
    ssl_protocols TLSv1.2;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;
    ssl_prefer_server_ciphers on;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout 2s;

    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name api.sosconf.org;

        location / {
                proxy_set_header Host $host;
                proxy_pass http://sosconf_backend:9000;
        }
        # SSL
        ssl_certificate /etc/letsencrypt/live/api.sosconf.org/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/api.sosconf.org/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/api.sosconf.org/chain.pem;
        server_tokens off;

    }

    # HTTP redirect
    server {
        listen 80;
        listen 443;
        listen [::]:80;

        server_name http://api.sosconf.org;

        location / {
            return 301 https://api.sosconf.org$request_uri;
        }
        server_tokens off;

    }

}