nginx.conf

upstream summonerexpert {
  # Each service gets an entry in /etc/hosts with its name.
  # the app service is used to run the app and starts the server on port 3000
  server app:3000;
}

# [1] HTTP Configuration
server {
  server_name api.summonerexpert.com;

  # [3] Use deferred for performance optimization
  listen 80;

  # Enable IPv6
  listen [::]:80;

  # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
  return 301 https://$host$request_uri;
}

# [1] HTTP Configuration
server {
  server_name                           api.summonerexpert.com;
  listen                                443 ssl http2;
  listen                                [::]:443 ssl http2;
  ssl_certificate                       /etc/nginx/letsencrypt/live/api.summonerexpert.com/fullchain.pem;
  ssl_certificate_key                   /etc/nginx/letsencrypt/live/api.summonerexpert.com/privkey.pem;
  ssl_session_cache                     shared:SSL:50m;
  ssl_session_timeout                   5m;
  ssl_session_tickets                   off;
  ssl_dhparam                           /etc/nginx/letsencrypt/dhparam.pem;
  ssl_prefer_server_ciphers             on;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
  ssl_protocols                         TLSv1 TLSv1.1 TLSv1.2;

  # [4] OCPS Stapling
  ssl_stapling                          on;
  ssl_stapling_verify                   on;
  ## verify chain of trust of OCSP response using Root CA and Intermediate certs
  ssl_trusted_certificate               /etc/nginx/letsencrypt/live/api.summonerexpert.com/chain.pem;

  # Setup logging
  access_log /etc/nginx/log/access.log;
  error_log /etc/nginx/log/error.log info;

  # [2] HTTP Secure Headers
  add_header Strict-Transport-Security  "max-age=63072000; includeSubdomains; preload";
  add_header X-Frame-Options            SAMEORIGIN;
  add_header X-Content-Type-Options     nosniff;

  # [2]
  server_tokens off;

  # Used to renew certificates using the webroot method.
  # To renew certs using letsencrypt run the letsencrypt service with certonly
  # and specify the /usr/share/nginx/html webroot
  location ~ /\.well-known/acme-challenge {
  	root /usr/share/nginx/html;
  }

  # Enable CORS for requests to the public data API
  location ~ /data {
    add_header Access-Control-Allow-Origin *;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_pass http://summonerexpert;
  }

  location / {
    # [5] Pass a host to upstream server equal to the request line if present or
    # client request host header
    proxy_set_header Host $host;

    # [5] Must tell upstream server that the request was http or https
    # if not present, then if rails force_ssl is on it will keep sending
    # location header and instruct the browser to redirect to https
    proxy_set_header X-Forwarded-Proto $scheme;

    # [6] The gzip and proxy modules use different http module versions. In
    # order for gzip compresion to work you need to set the proxy module
    # http version to 1.1 same as the gzip module
    proxy_http_version 1.1;

    # [7] Remove the Connection header if the client sends it,
    # it could be "close" to close a keepalive connection
    proxy_set_header Connection "";

    proxy_pass http://summonerexpert;
  }
}