# configuration file /etc/nginx/nginx.conf:

#user  nginx;
worker_processes  1;

error_log /dev/stdout info;
daemon off;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include mime.types;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /dev/stdout;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    # configuration file /etc/nginx/conf.d/basic.conf:
    # hide nginx version
    server_tokens off;

    # add nosniff header (https://www.owasp.org/index.php/List_of_useful_HTTP_headers)
    add_header X-Content-Type-Options nosniff;

    # configuration file /etc/nginx/conf.d/ssl.conf:
    # Getting a high secure SSL configured system

    # Tutorials used:
    # https://scotthelme.co.uk/a-plus-rating-qualys-ssl-test/
    # http://www.howtoforge.com/ssl-perfect-forward-secrecy-in-nginx-webserver

    # enable dh
    ssl_dhparam /etc/nginx/external/dh.pem;

    # protocols
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # disable poodle

    # ciphers
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;

    server {
        listen 80;
    	listen [::]:80;
	    server_name 147.32.84.197 localhost;
#	    server_name localhost;
	    return 301 https://$server_name$request_uri;
    }

    server {
        listen              443 ssl http2;
    	listen              [::]:443 ssl http2;
	    server_name 147.32.84.197 localhost;
#	    server_name localhost;
        ssl_certificate     /etc/nginx/external/cert.pem;
        ssl_certificate_key /etc/nginx/external/key.pem;

        root /usr/share/nginx/html;

        location / {
            index  index.html index.htm;
        }

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

    }
}
