Add nginx config for internal ssl setup

Author: widatama

bin/config/nginx.server.internal_ssl.conf

@@ -0,0 +1,120 @@
+server {
+	listen   80;
+	listen   [::]:80 ipv6only=on;
+	server_name  localhost;
+
+	access_log  off;
+
+	rewrite ^ https://$host$request_uri? permanent;
+}
+
+# HTTPS configuration
+
+server {
+	listen   443;
+    listen   [::]:443 ipv6only=on;
+	server_name  localhost;
+
+	access_log  off;
+
+    ssl on;
+
+    # support only known-secure cryptographic protocols
+    # SSLv3 is broken by POODLE as of October 2014
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    # make the server choose the best cipher instead of the browser
+    # Perfect Forward Secrecy(PFS) is frequently compromised without this
+    ssl_prefer_server_ciphers on;
+
+    # support only believed secure ciphersuites using the following priority:
+    # 1.) prefer PFS enabled ciphers
+    # 2.) prefer AES128 over AES256 for speed (AES128 has completely adequate security for now)
+    # 3.) Support DES3 for IE8 support
+    #
+    # disable the following ciphersuites completely
+    # 1.) null ciphers
+    # 2.) ciphers with low security
+    # 3.) fixed ECDH cipher (does not allow for PFS)
+    # 4.) known vulnerable cypers (MD5, RC4, etc)
+    # 5.) little-used ciphers (Camellia, Seed)
+    ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 +SHA !DES-CBC3-SHA !aNULL !eNULL !LOW !kECDH !DSS !3DES !MD5 !EXP !PSK !SRP !CAMELLIA !SEED';
+
+    # Cache SSL Sessions for up to 10 minutes
+    # This improves performance by avoiding the costly session negotiation process where possible
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+    # allow Nginx to send OCSP results during the connection process
+    ssl_stapling on;
+
+    # Use 2048 bit Diffie-Hellman RSA key parameters
+    # (otherwise Nginx defaults to 1024 bit, lowering the strength of encryption # when using PFS)
+    # Generated by OpenSSL with the following command:
+    # openssl dhparam -outform pem -out /etc/nginx/ssl/dhparam2048.pem 2048
+    ssl_dhparam /path/to/dhparams.pem;
+
+    # Provide path to certificates and keys
+    ssl_certificate /path/to/certificate-bundle.crt;
+    ssl_certificate_key /path/to/certificate-key.key;
+	ssl_trusted_certificate /path/to/chain.pem;
+
+	location = /i {
+        if ($http_content_type = "text/ping") {
+             return 404;
+        }
+    # countly server is running with ssl, so use https here
+		proxy_pass https://localhost:3001;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Real-IP $remote_addr;
+    # if countly server is using self-signed certificate, this will disable certificate verification
+    proxy_ssl_verify off;
+	}
+
+	location ^~ /i/ {
+        if ($http_content_type = "text/ping") {
+             return 404;
+        }
+    # countly server is running with ssl, so use https here
+		proxy_pass https://localhost:3001;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Real-IP $remote_addr;
+    # if countly server is using self-signed certificate, this will disable certificate verification
+    proxy_ssl_verify off;
+	}
+
+	location = /o {
+        if ($http_content_type = "text/ping") {
+             return 404;
+        }
+    # countly server is running with ssl, so use https here
+		proxy_pass https://localhost:3001;
+    # if countly server is using self-signed certificate, this will disable certificate verification
+    proxy_ssl_verify off;
+	}
+
+	location ^~ /o/ {
+        if ($http_content_type = "text/ping") {
+             return 404;
+        }
+    # countly server is running with ssl, so use https here
+		proxy_pass https://localhost:3001;
+    # if countly server is using self-signed certificate, this will disable certificate verification
+    proxy_ssl_verify off;
+	}
+
+	location / {
+        if ($http_content_type = "text/ping") {
+             return 404;
+        }
+    # countly server is running with ssl, so use https here
+		proxy_pass https://localhost:6001;
+		proxy_set_header Host $http_host;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Real-IP $remote_addr;
+    # if countly server is using self-signed certificate, this will disable certificate verification
+    proxy_ssl_verify off;
+	}
+}
+