sample-nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/stakepool_error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" "$realip_remote_addr"';

    access_log  /var/log/nginx/stakepool_access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Ensure ngx_http_realip_module is available
    set_real_ip_from 127.0.0.1/32;
    # If you are behind a NAT router, specify LAN
    #set_real_ip_from 10.24.0/16;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;

    server {
        listen          80 default_server;
        server_name     _;

        return 308      https://$host$request_uri;
    }

    limit_req_zone $binary_remote_addr zone=stakepool:10m rate=8r/s;

    server {
        listen       443 http2 ssl default_server;
        server_name  _;

        gzip on;
        gzip_proxied any;
        gzip_comp_level 3;
        gzip_min_length 512;
                gzip_types text/css text/* text/javascript application/x-javascript application/json
                application/xml application/atom+xml application/xaml+xml application/javascript
                application/x-font-ttf application/font-woff font/collection font/opentype
                font/otf font/ttf image/bmp image/svg+xml image/x-icon application/octet-stream;

        #ssl                     on; # only needed for older nginx where not in listen
        ssl_certificate         /etc/ssl/www/stakepool.domain.tld.crt;
        ssl_certificate_key     /etc/ssl/www/stakepool.domain.tld.key;
 
        ssl_session_cache               shared:SSL:20m;
        ssl_protocols                   TLSv1.1 TLSv1.2; # add TLSv1.3 if supported
        ssl_ciphers                     EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
        ssl_prefer_server_ciphers       on;
        #ssl_dhparam                     /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
        add_header                      Strict-Transport-Security max-age=15552001;

        # Serve static resources directly.
        location /assets/ {
                # The delay parameter requires nginx 1.15.7 or higher.
                limit_req zone=stakepool burst=48 delay=36;
                # See the zipassets.sh script, which can be used to prepare the
                # pre-zipped files used by gzip_static.
                gzip_static on; # use .gz files for pre-compressed data
                alias /opt/dcrstakepool/public/; # change this to the actual folder on disk
                # Set the Cache-Control and Expires headers for the static assets.
                expires modified 2d;
        }

        # Everything else is proxied to dcrstakepool.
        location / {
            # apply rate limiting
            limit_req zone=stakepool burst=16;

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $realip_remote_addr;
            proxy_pass http://127.0.0.1:8000;
            proxy_http_version 1.0;
        }
    }
}