example.local.conf

server {
    if ($host = example.local) {
        return 301 https://$host$request_uri;
    }

    listen      80;
    # listen    [::]:80;
    server_name example.local;
    root /usr/share/nginx/html;
    access_log  off;
    location /.well-known/acme-challenge/ { allow all; }
    location / { return 301 https://$host$request_uri; }
}

server {
    listen      443 ssl;
    # listen    [::]:443 ssl;
    server_name example.local;
    access_log  off;

    # VTS module
    # vhost_traffic_status_filter_by_set_key $geoip_country_code country::$server_name;

    # This will be replaced with certbot if you use that.
    ssl_certificate /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    include /etc/nginx/snippets/ssl-params.conf;

    root /usr/share/nginx/html;

    # Example add header at server block
    add_header X-Permitted-Cross-Domain-Policies none;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Download-Options noopen;
    # Beware using HSTS header, your website must continue to have a valid
    # HTTPS configuration to avoid making the website inaccessible to users.
    add_header Strict-Transport-Security "max-age=31536000";

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        proxy_pass http://127.0.0.1:8080;
    }
}

# vim: ft=nginx ts=4 sw=4 et