Default nginx configuration

In this configuration, both the administration side and the REST interface use HTTPS (SSL/TLS) with password authentication.

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 65535;
}
http {
	##
	# Basic Settings
	##
	# information disclosure
	server_tokens off;

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;

	keepalive_timeout 120;

	gzip on;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# limit number of requests
	#
	limit_req_zone $binary_remote_addr zone=ip:10m rate=1r/s;
	map $status $retry_after {
		default '';
		429 '120';
	}

	##
	# SSL Settings
	##

	# https://ssl-config.mozilla.org/#server=nginx
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
	ssl_prefer_server_ciphers on; # we want fastest performance on the server

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;
	log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

	##
	# Services
	##

	upstream hsm_server {
		server 127.0.0.1:2002;
	}

	upstream rkapi {
		server 127.0.0.1:2003;
	}

	upstream webinterface {
		server 127.0.0.1:9000;
	}

	# auto redirect 443
	server {
		listen 0.0.0.0:80;
		client_max_body_size 20M;
		server_name temp;

		location ~* ^/api/v1/status {
			auth_basic off;
			proxy_pass http://webinterface;
		}

		location / {
			return 301 https://$host$request_uri;
		}
	}


	server {
		listen 0.0.0.0:443 ssl;
		server_name temp;

		# ssl
		ssl_certificate /etc/nginx/ssl/ssl.crt;
		ssl_certificate_key /etc/nginx/ssl/ssl.key;

		ssl_session_timeout 5m;

		## https://ssl-config.mozilla.org/#server=nginx
		ssl_protocols TLSv1.2 TLSv1.3;
		ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
		ssl_prefer_server_ciphers off;

		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;

		proxy_read_timeout 120;


		location ~* ^/asignrkhsm/ {
			auth_basic "RKHSM API";
			auth_basic_user_file /etc/nginx/.htpasswdapi;

			rewrite "(?i)/asignrkhsm/(.*)" /$1 break;
			proxy_pass http://rkapi;
			#limit_req zone=ip burst=12 nodelay;
			add_header Retry-After $retry_after always;
		}

		location / {
			auth_basic "Administrationsseite";
			auth_basic_user_file /etc/nginx/.htpasswd;
			proxy_pass http://webinterface;
		}

		location ~* ^/api/v1/status {
			auth_basic off;
			proxy_pass http://webinterface;
		}
	}
}