# to use ssl, add your cert and key to conf/ssl,
# replace cert/key names with real names below,
# and replace nginx.conf with this

worker_processes 1;

user nobody nogroup;
pid /tmp/nginx.pid;
error_log /etc/nginx/logs/error.log;

events {
    worker_connections 1024;
    accept_mutex off;
}

http {
    include "/etc/nginx/mime.types";
    default_type application/octet-stream;
    sendfile on;

    server {
        listen 80 default;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443;
        client_max_body_size 4G;
        server_name frontend;

        access_log /tmp/logs/nginx.access.log combined;

        ssl on;

        ssl_certificate /etc/nginx/ssl/ssl-bundle.crt;
        ssl_certificate_key /etc/nginx/ssl/cutting.scot.key;

        ssl_prefer_server_ciphers On;
        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;

        gzip on;
        gzip_disable "msie6";
        gzip_vary on;
        gzip_proxied any;
        gzip_comp_level 6;
        gzip_buffers 16 8k;
        gzip_http_version 1.1;
        gzip_types application/javascript text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

        keepalive_timeout 5;

        location /static/  {
            root /cutting/public;
            autoindex off;
        }

        location  / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Scheme $scheme;
            proxy_redirect off;
            proxy_pass   http://server:3000;
        }
    }
}