server {
    listen       yourip:yourport ssl http2;
    server_name  yourdomain;

    access_log   /var/log/nginx/tvheadend-access.log main;
    error_log    /var/log/nginx/tvheadend-error.log warn;

    ssl_certificate      "/path/to/ssl/certificate";
    ssl_certificate_key  "/path/to/private/key";
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers PROFILE=SYSTEM;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1.2;
    add_header Strict-Transport-Security max-age=15768000;

    location / {
	proxy_set_header        Host               $host:$server_port;
	proxy_set_header        X-Forwarded-Host   $host:$server_port;
	proxy_set_header        X-Forwarded-Server $host;
	proxy_set_header        X-Real-IP          $remote_addr;
	proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
	proxy_set_header        X-Forwarded-SSL    on;
	proxy_set_header        X-Forwarded-Proto  $scheme;
	proxy_http_version      1.1;
	proxy_set_header        Upgrade            $http_upgrade;
	proxy_set_header        Connection         "upgrade";
	proxy_pass              http://127.0.0.1:9981/;
    }
}