 server {  
  listen 80;
  server_name registry.ratchfordconsulting.com;
  return 301 https://$host$request_uri;
}
 
server {
  listen 443 ssl;
  server_name registry.ratchfordconsutling.com;
  root /usr/share/nginx/html;       

  index index.html index.htm index.nginx-debian.html;  

  client_max_body_size 50m;
  ssl_certificate /etc/nginx/conf.d/fullchain.pem;
  ssl_certificate_key /etc/nginx/conf.d/privkey.pem;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on; 
  ssl_dhparam /etc/nginx/conf.d/dhparam.pem;
  ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
  ssl_ecdh_curve secp384r1;
  ssl_session_timeout  10m;
  ssl_session_cache shared:SSL:10m;
  resolver 8.8.8.8 valid=300s;
  resolver_timeout 5s; 
  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header X-Forwarded-Protocol https;
  add_header X-Forwarded-Ssl on;
  add_header X-Url-Scheme https;

  location / {
    proxy_pass http://10.0.10.50;
    proxy_buffering off;
    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Connection $http_connection;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Ssl off;
    proxy_set_header X-Forwarded-Port 80;
   }
}

server {  
  listen 80;
  server_name gitlab.ratchfordconsulting.com;
  return 301 https://$host$request_uri/;
}
 
server {
  listen 443 ssl;
  server_name gitlab.ratchfordconsulting.com mattermost.ratchfordconsulting.com pages.ratchfordconsulting.com;
  root /usr/share/nginx/html;       

  index index.html index.htm index.nginx-debian.html;  

  client_max_body_size 200m;
  ssl_certificate /etc/nginx/conf.d/fullchain.pem;
  ssl_certificate_key /etc/nginx/conf.d/privkey.pem;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on; 
  ssl_dhparam /etc/nginx/conf.d/dhparam.pem;
  ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
  ssl_ecdh_curve secp384r1;
  ssl_session_timeout  10m;
  ssl_session_cache shared:SSL:10m;
  resolver 8.8.8.8 valid=300s;
  resolver_timeout 5s; 
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header X-Forwarded-Protocol https;
  add_header X-Forwarded-Ssl on;
  add_header 'Access-Control-Allow-Origin' '*';
  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
  add_header X-Url-Scheme https;

  location / {
    proxy_pass http://10.0.10.50;
    proxy_buffering off;
    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Connection $http_connection;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto http;
    proxy_set_header X-Forwarded-Ssl off;
    proxy_set_header X-Forwarded-Port 80;
   }
}
