NGINX config

This is my NGINX config, the cert config has been generated by Certbot.

NOTE: You need the change the domain name and the port to match your app.

proxy_cache_path /home/pouria/.nginxcache levels=1:2 keys_zone=my_cache:10m max_size=10g 
                 inactive=60m use_temp_path=off;

# Advanced config for NGINX
	server_tokens off;
	add_header X-XSS-Protection "1; mode=block";
	add_header X-Content-Type-Options nosniff;

# Redirect all HTTP traffic to HTTPS
server {
	if ($host = kutt.it) {
			return 301 https://$host$request_uri;
	} # managed by Certbot

	listen 80;
	server_name www.kutt.it kutt.it;
	return 301 https://$host$request_uri;
}

# SSL configuration
server {
	listen 443 ssl default deferred;
	server_name www.kutt.it kutt.it;
	ssl_certificate /etc/letsencrypt/live/kutt.it/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/kutt.it/privkey.pem; # managed by Certbot
  
	# Improve HTTPS performance with session resumption
	ssl_session_cache shared:SSL:10m;
	ssl_session_timeout 5m;

	# Enable server-side protection against BEAST attacks
	ssl_prefer_server_ciphers on;
	ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
  		
	# Disable SSLv3
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

	# Enable HSTS (https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security)
	add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";  

	# Enable OCSP stapling (http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox)
	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_trusted_certificate /etc/letsencrypt/live/kutt.it/fullchain.pem;
	resolver 8.8.8.8 8.8.4.4 valid=300s;
	resolver_timeout 5s;
	proxy_set_header  X-Real-IP  $remote_addr;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection 'upgrade';
	proxy_set_header Host $host;
	proxy_cache_bypass $http_upgrade;

	location / {
		proxy_cache my_cache;
		proxy_cache_revalidate on;
		proxy_cache_min_uses 3;
		proxy_cache_background_update on;
		proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
		proxy_cache_lock on;
		proxy_pass http://localhost:8888;
		proxy_http_version 1.1;
	}

	location /api/url/sharex {
		proxy_pass        http://localhost:8888/api/url/submit;
		proxy_redirect    off;
		proxy_set_header  Upgrade $http_upgrade;
		proxy_set_header  Connection "upgrade";
		proxy_set_header  Host $host;
		proxy_set_header  X-Real-IP $remote_addr;
		proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header  X-Forwarded-Proto $scheme;
		proxy_set_header Content-Type application/json;
		proxy_set_body $http_target;
	}
}