ss-site.conf.template

server {
    listen       443 ssl http2 reuseport backlog=131072 fastopen=256;
    listen       [::]:443 ssl http2 reuseport backlog=131072 fastopen=256;        
	server_name  ${DOMAIN};
	add_header Allow "GET" always; 
	if ( $request_method !~ ^(GET)$ ) {
		   return 444;
	}
    
	ssl_certificate /etc/ssl/mysite.cert;
	ssl_certificate_key /etc/ssl/mysite.key;
	ssl_session_cache shared:le_nginx_SSL:1m;
	ssl_session_cache shared:SSL:50m;
	ssl_session_timeout 1d;
	ssl_session_tickets off;
	ssl_protocols TLSv1.3 TLSv1.2;	
	ssl_ecdh_curve secp384r1;
	ssl_early_data on;		
	add_header Content-Security-Policy "default-src https: data: 'unsafe-inline' 'unsafe-eval'" always;
	add_header Strict-Transport-Security 'max-age=63072000; includeSubdomains; preload' always;
	add_header X-Robots-Tag "noindex, nofollow" always;	
	add_header X-Content-Type-Options "nosniff" always;	
	add_header X-Xss-Protection "1; mode=block" always;
	ssl_buffer_size 8k;
	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_prefer_server_ciphers on;
    ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

	location / {
        proxy_pass http://echoip:8080;
        proxy_redirect off;
		limit_rate 1000k;
        }
    		
    location ${SS_PATH} {
        proxy_pass http://ss-v2ray:1234;
        proxy_redirect off;			
		proxy_buffering off;
		proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Early-Data $ssl_early_data;                
		proxy_set_header Connection "upgrade"; 
        }
}