config.conf

events {}

http {

    server_tokens off;

    map $http_authorization $auth_header {
        default "";
        "~^(.*)" $1;
    }

    proxy_set_header Authorization $auth_header;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Port $server_port;

    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        location / {
            proxy_pass http://webapp:3000;
        }
    }

    server {
        http2 on;
        listen 443 ssl default_server;
        listen [::]:443 ssl default_server;

        ssl_certificate /etc/letsencrypt/live/kiwiq.run.place/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/kiwiq.run.place/privkey.pem;
        ssl_dhparam /etc/nginx/dhparams.pem;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
        ssl_session_timeout 10m;
        ssl_session_cache shared:SSL:10m;

        location / {
            proxy_pass http://webapp:3000;
        }
    }
}