#user  nobody;
worker_processes  1;

# This default error log path is compiled-in to make sure configuration parsing
# errors are logged somewhere, especially during unattended boot when stderr
# isn't normally logged anywhere. This path will be touched on every nginx
# start regardless of error log location configured here. See
# https://trac.nginx.org/nginx/ticket/147 for more info. 
#
error_log  /var/log/nginx/error.log;
#

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    # Expires map
    map $sent_http_content_type $expires {
        default                    off;
        text/html                  epoch;
        text/css                   max;
        application/javascript     max;
        ~image/                    max;
    }

    server {
        listen       10.x.y.z:80       proxy_protocol;
        listen       [2001:bc8:2909:101::4]:80;

        server_name  blog.plessis.info;
	
	set_real_ip_from                10.x.y.w;
	real_ip_header                  proxy_protocol;
	real_ip_recursive               on;

        # enforce https
        location / {
            return 301 https://$server_name$request_uri;
        }
    }

    server {
        listen       10.x.y.z:443      ssl http2 proxy_protocol;
        listen       [2001:bc8:2909:101::4]:443 ssl http2;

        server_name  blog.plessis.info;
        root   /usr/local/www/nginx/data;

	# Set the client remote address to the one sent in the X_FORWARDED_FOR header from trusted addresses.
	set_real_ip_from                10.x.y.w;
	real_ip_header                  proxy_protocol;
	real_ip_recursive               on;

        ssl_certificate      /usr/local/etc/dehydrated/certs/blog.plessis.info/fullchain.pem;
        ssl_certificate_key  /usr/local/etc/dehydrated/certs/blog.plessis.info/privkey.pem;

    	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        #ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        #ssl_dhparam /usr/local/etc/nginx/conf.d/dhparams.pem;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

        #access_log  logs/host.access.log  main;

        location / {
            index  index.html index.htm;
        }

	expires $expires;

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/local/www/nginx-dist;
        }

	#
	# Gzip Settings
	##
	 
	gzip on;
	gzip_disable "msie6";
	 
	gzip_vary on;
	gzip_proxied any;
	gzip_comp_level 8;
	gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;

	gzip_static on;


	#
	# Security headers:

	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
	
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;

    }

}