server {
        listen 80;
        listen [::]:80;

        server_name unifi.myhostname.com;

        location / {
                return 301 https://$host$request_uri;
        }

        # If they come here using HTTP, bounce them to the correct scheme
        error_page 497 https://$server_name:$server_port$request_uri;
}

server {
        # SSL configuration
        #
        listen 443 ssl default_server;
        listen [::]:443 ssl default_server;

        server_name unifi.myhostname.com;


        ssl_certificate /etc/apache2/ssl/certificate.pem;
        ssl_certificate_key /etc/apache2/ssl/certificate.key;

        # Use only TLS
        ssl_protocols TLSv1.2;
        # Tell client which ciphers are available
        ssl_prefer_server_ciphers on;
        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
        # Use our own DH params
        ssl_dhparam /etc/nginx/certs/dhparam.pem;
        # Enable OCSP stapling
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/apache2/ssl/certificate.pem;
        # Enable HSTS
        add_header Strict-Transport-Security "max-age=31536000" always;
        # Optimize session cache
        ssl_session_cache   shared:SSL:40m;
        ssl_session_timeout 4h;
        # Enable session tickets
        ssl_session_tickets on;

    access_log /var/log/nginx/$server_name.log;

        #Allow certain IP's only else basic auth
        satisfy any;
        include /etc/nginx/IPwhitelist.conf;
        deny all;
        #Basic Auth
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/.htpasswd;


        # Needed to allow the websockets to forward well.
        # Information adopted from here: https://community.ubnt.com/t5/EdgeMAX/Access-Edgemax-gui-via-nginx-reverse-proxy-websocket-problem/td-p/1544354
        location /wss/ {
                proxy_pass https://elementsdns:8443;
                proxy_http_version 1.1;
                proxy_buffering off;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
                proxy_read_timeout 86400;
        }

        location / {
                proxy_set_header Authorization "";
                proxy_pass https://elementsdns:8443/; # The Unifi Controller Port
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
        }
}