default.conf.aftercert

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    location ~ /.well-known/acme-challenge {
        allow all;
        root /var/www/html;
    }

    location / {
        rewrite ^ https://$host$request_uri? permanent;
    }
}

server {
   listen 443 ssl http2;
   listen [::]:443 ssl http2;
   server_name example.com www.example.com;

   server_tokens off;

   ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

   ssl_buffer_size 8k;

   ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

   ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
   ssl_prefer_server_ciphers on;

   ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

   ssl_ecdh_curve secp384r1;
   ssl_session_tickets off;

   ssl_stapling on;
   ssl_stapling_verify on;
   resolver 8.8.8.8;

   client_max_body_size 250M;

   location / {
      proxy_pass http://frontend:3000;
   }

   location /api/ {
      proxy_read_timeout 1d;
      proxy_pass http://backend/;
   }

   root /var/www/html;
   index index.html index.htm index.nginx-debian.html;
}