#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log         logs/access.log  main;
    charset             UTF-8;

    sendfile            on;
    tcp_nopush          on;

    #keepalive_timeout  0;
    keepalive_timeout   30;

    gzip            on;
    gzip_vary           on;

    gzip_comp_level     6;
    gzip_buffers        16 8k;

    gzip_min_length     1000;
    gzip_proxied        any;
    gzip_disable        "msie6";

    gzip_http_version   1.0;

    gzip_types          text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;

    server {
    listen 80 ;
    server_name  www.example.com example.com;
    # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
        return 301 https://$host$request_uri;
     }


    server {
#   listen 80 ;
    listen 443 ssl ;
#   listen 443 443 ssl http2 fastopen=3 reuseport;

        server_name  www.example.com example.com;

    ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/www.example.com/privkey.pem;
        ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

        ssl_session_timeout 5m;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_session_tickets off;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_stapling on;
        ssl_stapling_verify on;
#        if ($host != 'www.example.com' ) {
#            rewrite          ^/(.*)$  https://www.example.com/$1 permanent;
#       }

        location / {

#    proxy_set_header Host www.example.com;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_pass     http://example.com:8088;
        }
    }
}