example-nginx.conf

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	server_name domain.com;

	# SSL
	ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
	ssl_trusted_certificate /etc/letsencrypt/live/domain.com/chain.pem;

	# security headers
    	add_header X-Frame-Options "SAMEORIGIN" always;
    	add_header X-XSS-Protection "1; mode=block" always;
    	add_header X-Content-Type-Options "nosniff" always;
    	add_header Referrer-Policy "no-referrer-when-downgrade" always;
    	add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
    	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    	# . files
	location ~ /\.(?!well-known) {
        	deny all;
    	}

	# reverse proxy
	location / {
		proxy_pass 				http://127.0.0.1:8080;
		proxy_http_version			1.1;
        	proxy_cache_bypass			$http_upgrade;

	        proxy_set_header Upgrade		$http_upgrade;
        	proxy_set_header Connection 		"upgrade";
	        proxy_set_header Host			$host;
        	proxy_set_header X-Real-IP		$remote_addr;
	        proxy_set_header X-Forwarded-For	$proxy_add_x_forwarded_for;
        	proxy_set_header X-Forwarded-Proto	$scheme;
	        proxy_set_header X-Forwarded-Host	$host;
        	proxy_set_header X-Forwarded-Port	$server_port;
	}
    
    	location /v1/websocket {
		proxy_pass 				http://127.0.0.1:8080/v1/websocket;
		proxy_http_version			1.1;
		proxy_cache_bypass			$http_upgrade;

		proxy_set_header Upgrade		$http_upgrade;
		proxy_set_header Connection 		"upgrade";
		proxy_set_header Host			$host;
		proxy_set_header X-Real-IP		$remote_addr;
		proxy_set_header X-Forwarded-For	$proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto	$scheme;
		proxy_set_header X-Forwarded-Host	$host;
		proxy_set_header X-Forwarded-Port	$server_port;
	}

}

# HTTP redirect to HTTPS
server {
	listen 80;
	listen [::]:80;

	server_name domain.com;

	location / {
		return 301 https://domain.com$request_uri;
	}
}