backend.conf

server_tokens off;

#gzip
gzip_static on;
gzip_proxied any;
gzip_comp_level 5;
gzip_disable "msie6";
gzip_min_length 1000;
gzip_vary on;
gzip_types
	text/plain
	text/html
	image/x-icon
	text/javascript
	application/javascript
	application/json
;


server {
	listen 80;
	listen [::]:80;
	
	server_name __YOU_Server_IP__ __YOU_Server_Domain_Name_1__ __YOU_Server_Domain_Name_2__;
	
	location / {
		rewrite ^ https://$host$request_uri? permanent;
	}

	location ^~ /.well-known/acme-challenge/ {
		allow all;
		default_type "text/plain";
		root /home/ddadmin/ddtalk;
	}
}


#Setup upstream for backend Node.js server
upstream ddtalk-backend {
	server 127.0.0.1:8081 max_fails=3 fail_timeout=30s;
	# server www.SERVER2.net backup;
	# keepalive 64;
}

#The Nginx server instance
server {
	server_name __YOU_Server_IP__ __YOU_Server_Domain_Name_1__ __YOU_Server_Domain_Name_2__;
	
	charset utf8;
	access_log /var/log/nginx/ddtalk-access.log;
	error_log /var/log/nginx/ddtalk-error.log;
	
	listen 443 ssl http2; # managed by Certbot
	listen [::]:443 ssl http2;
	ssl_certificate /etc/letsencrypt/live/__YOU_Server_Domain_Name_1__/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/__YOU_Server_Domain_Name_1__/privkey.pem;
	
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
	
	ssl_buffer_size 8k;
	ssl_session_cache shared:le_nginx_SSL:1m;
	ssl_session_timeout 1440m;
	ssl_protocols TLSv1.2;
	ssl_prefer_server_ciphers on;
	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
	ssl_ecdh_curve secp384r1;
	ssl_session_tickets off;
	
	ssl_stapling on;
	ssl_stapling_verify on;
	resolver 8.8.8.8;
	
	location / {
		proxy_pass http://ddtalk-backend;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection 'upgrade';
		proxy_set_header Host $host;
		proxy_cache_bypass $http_upgrade;
		
		etag on;
		expires max;
		
		access_log off;
		log_not_found off;
	
		http2_push /css.min.css;
		http2_push /favicon.ico;
		http2_push /dist/DDTalk.min.js;
		http2_push /dist/RTCMultiConnection.min.js;
		http2_push /dist/adapter.js;
		http2_push /dist/FileBufferReader.min.js;
		http2_push /socket.io/socket.io.js;

		add_header Cache-Control "must-revalidate";
		add_header X-Frame-Options "SAMEORIGIN";
		add_header X-Content-Type-Options "nosniff";
		add_header X-XSS-Protection "1; mode=block";
		add_header Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; frame-src 'self' blob: https://docs.google.com; img-src 'self' data: blob:; font-src 'self' data: https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; worker-src 'self' blob:; connect-src 'self' data: wss:; media-src 'self' blob:; manifest-src 'self'; object-src 'self'; base-uri 'none'; report-to '/report-to-endpoint-bw45wmmahje2i6mk1namhf';";
		add_header Referrer-Policy "strict-origin"; add_header Strict-Transport-Security "max-age=63072000; preload" always;
		add_header Feature-Policy "sync-xhr 'self'; camera 'self'; microphone 'self';";
		add_header Vary Accept-Encoding;

	}
	
	location ~* \.io {
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header Host $http_host;
		proxy_set_header X-NginX-Proxy true;
		proxy_pass http://ddtalk-backend;
		proxy_redirect off;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
		
		add_header Content-Security-Policy "connect-src 'self'";
	}
}