server {
    listen       yourip:yourport ssl http2;
    server_name  yourdomain;

    access_log   /var/log/nginx/tvheadend-access.log main;
    error_log    /var/log/nginx/tvheadend-error.log warn;

    ssl_certificate      "/path/to/certificate/file";
    ssl_certificate_key  "/path/to/private/key";
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers PROFILE=SYSTEM;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1.2;
    add_header Strict-Transport-Security max-age=15768000;

    location / {
    proxy_set_header        Host              $host:$server_port;
    proxy_set_header        X-Real-IP         $remote_addr;
	proxy_set_header        X-Forwarded-For   $proxy_add_x_forwarded_for;
	proxy_set_header        X-Forwarded-SSL   on;
    proxy_set_header        X-Forwarded-Proto $scheme;
	proxy_http_version      1.1;
	proxy_set_header        Upgrade           $http_upgrade;
    proxy_set_header        Connection        "upgrade";
	proxy_pass              http://127.0.0.1:9981/;
    }
}