ecodms-reverse-proxy.conf

server {
        listen 80;
        # if you do not want to listen on IPv6, comment out the following line
	      listen [::]:80;
        # replace your.domain.tld with your actual domain
        server_name your.domain.tld;
		return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    # if you do not want to listen on IPv6, comment out the following line
    listen [::]:443 ssl;
    # replace your.domain.tld with your actual domain
    server_name your.domain.tld;

    ssl on;
    # point the next line to your actual webserver certificate
    ssl_certificate /etc/letsencrypt/../certificate.pem;
    # point the next line to your actual private key for the certificate
    ssl_certificate_key /etc/letsencrypt/../privkey.pem;
    # some settings to set SSL timeout, cache and configure SSLsession tickets
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # Diffie-Hellman parameter for DHE ciphersuites, recommended secure value of 4096 bits
    # you can create your DHE file via openssl with the following command:
    #
    # openssl dhparam -out /etc/ssl/nginx-dhparam.pem 4096
    ssl_dhparam /etc/ssl/nginx-dhparam.pem;

    # if your nginx version (<1.13.0) doesn't yes support TLSv1.3 just remove it from ssl_protocols
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
    # setting server side cipher settings to be preferred
    ssl_prefer_server_ciphers on;
    # setting elliptic curve to be used
	  ssl_ecdh_curve secp384r1;

    # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
    # uncomment the following add_header statement, if you want to have strict SSL connectivity, 
    # but be aware that this forces SSL for 6 months in this case so if there is no SSL 
    # connection to your site, it will not be reachable
    #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

    # OCSP Stapling ---
    # fetch OCSP records from URL in ssl_certificate and cache them
    ssl_stapling on;
    ssl_stapling_verify on;
    # adjust to the actual certificate
    ssl_trusted_certificate /etc/letsencrypt/../chain.pem;
    # if you like to use other DNS resolvers for OCSP stapling then just adjust here
    resolver 9.9.9.9 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s; 
    
    # some security enhancing settings
    add_header Referrer-Policy same-origin;
		
    #activates X-Frame-Options
    add_header X-Frame-Options "SAMEORIGIN";

    #activates X-Content-Type-Options
    add_header X-Content-Type-Options "nosniff" always;
	
    #activates X-XSS-Protection
    add_header x-xss-protection "1; mode=block" always;
	
    # this directive seeks to minimize search machine robots indexing your site
    # you can comment it out, if you want search engins to index your site
    add_header X-Robots-Tag "noindex, nofollow, noimageindex" always;
    
    # this is the actual reverse proxy configuration for ecodms
	  location / {
		  proxy_set_header Host $host;
		  proxy_set_header X-Real-IP $remote_addr;
		  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		  proxy_set_header X-Forwarded-Proto $scheme;
      # if you have changed the port in the docker-compose file, then you have to adjust it here
		  proxy_pass http://127.0.0.1:17004/;
      # defines the maximal size of files that can be uploaded, you can adjust this to your liking, if the default 20m is not enough
      # to set the size to unlimited, you could use client_max_body_size 0;
		  client_max_body_size 20m;
	  }
}