nginx.conf

worker_processes auto;

daemon off;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;

    server {
        listen 6006;

        location / {
            proxy_pass http://localhost:6006;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Client-Verify SUCCESS;
            proxy_set_header X-Client-DN $ssl_client_s_dn;
            proxy_set_header X-SSL-Subject $ssl_client_s_dn;
            proxy_set_header X-SSL-Issuer $ssl_client_i_dn;
            proxy_read_timeout 1800;
            proxy_connect_timeout 1800;
        }
    }

    server {
        listen 80;
        listen [::]:80;

        # uncomment when SSL certs provided in 44-45 and 53-55 lines
        # listen 443 ssl;
        # listen [::]:443 ssl;

        root /var/www/web/public;

        add_header Strict-Transport-Security "max-age=31536000";
        add_header X-Xss-Protection "1; mode=block" always;
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;

        # ssl_certificate insert path here
        # ssl_certificate_key insert path here

        ssl_session_cache shared:SSL:20m;
        ssl_session_timeout 10m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

        # if ($scheme = http) {
        #     rewrite ^ https://$server_name$request_uri? permanent;
        # }

        location ~* \.(eot|ttf|woff|woff2|json)$ {
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Credentials true;
            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
            add_header Access-Control-Allow-Headers "Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With";
        }

        location ~* ^.+\.(json|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
            access_log off;
            log_not_found off;
            expires 1d;
        }

        location / {
            proxy_pass http://web:3000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Client-Verify SUCCESS;
            proxy_set_header X-Client-DN $ssl_client_s_dn;
            proxy_set_header X-SSL-Subject $ssl_client_s_dn;
            proxy_set_header X-SSL-Issuer $ssl_client_i_dn;
            proxy_read_timeout 1800;
            proxy_connect_timeout 1800;
        }
    }
}