server {

  listen 443 ssl;

  ssl_certificate /etc/letsencrypt/live/codius1.seasonedlogic.com/fullchain.pem;

  ssl_certificate_key /etc/letsencrypt/live/codius1.seasonedlogic.com/privkey.pem;

  ssl_protocols TLSv1.2;

  ssl_prefer_server_ciphers on;

  ssl_dhparam /etc/nginx/dhparam.pem;

  ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;

  ssl_ecdh_curve secp384r1;

  ssl_session_timeout 10m;

  ssl_session_cache shared:SSL:10m;

  ssl_session_tickets off;

  ssl_stapling on;

  ssl_stapling_verify on;

  resolver 1.1.1.1 1.0.0.1 valid=300s;

  resolver_timeout 5s;

  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

  add_header X-Frame-Options DENY;

  add_header X-Content-Type-Options nosniff;

  add_header X-XSS-Protection "1; mode=block";

location / {

    proxy_pass http://127.0.0.1:3000;

    proxy_set_header Host $host;

    proxy_set_header X-Forwarded-For $remote_addr;

  }

}