docker_nginx.example

upstream puma {
  server 127.0.0.1:3000;
}

server {
	error_log /var/log/nginx/error.log debug;

	# SSL configuration
	listen 443 ssl default_server;
	listen [::]:443 ssl default_server;

  ssl_certificate /etc/letsencrypt/live/REPLACE_BY_HOSTNAME/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/REPLACE_BY_HOSTNAME/privkey.pem; # managed by Certbot

	ssl_session_cache shared:le_nginx_SSL:10m;
	ssl_session_timeout 1440m;
	ssl_session_tickets off;

	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_prefer_server_ciphers off;

	ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";

	ssl_dhparam /etc/letsencrypt/ssl-dhparam.pem;

	location ~ /.git {
		deny all;
	}

	location  ~* ^/assets {
		proxy_pass http://puma;

		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Proto https;
		proxy_set_header Host $http_host;
		proxy_redirect off;

		expires 1w;
		add_header Cache-Control public;
		add_header Last-Modified "";
		add_header ETag "";
		break;
	}

	location /.well-known/ {
		root /var/www/html/;
		allow all;
	}

	location / {
		proxy_pass http://puma;

		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Proto https;
		proxy_set_header Host $http_host;
		proxy_redirect off;
	}

	proxy_headers_hash_max_size 512;
 	proxy_headers_hash_bucket_size 128;

	root /var/www/html;

	error_page 500 502 503 504 /500.html;

	server_name REPLACE_BY_HOSTNAME;
}