nginx.ssl.conf

#NOTE: Do not include upstream option, post-deploy adds it automatically

server {
  listen      [::]:80;
  listen      80;
  server_name $SERVER_NAME;
  return 301 https://\$host\$request_uri;
}

server {
  listen      [::]:443;
  listen      443;
  server_name $SERVER_NAME;

  ssl on;
  ssl_certificate     $SSL_DIR/server.crt;
  ssl_certificate_key $SSL_DIR/server.key;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;
  ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
  ssl_prefer_server_ciphers on;

  location    / {
    proxy_pass  http://$APP;
    proxy_http_version 1.1;
    proxy_set_header Upgrade \$http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host \$http_host;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header X-Forwarded-For \$remote_addr;
    proxy_set_header X-Forwarded-Port \$server_port;
    proxy_set_header X-Request-Start \$msec;
  }
}