example-nginx.conf

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	server_name _;

	# SSL
	ssl_certificate /etc/nginx/cert.crt;
	ssl_certificate_key /etc/nginx/cert.key;

	# security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # . files
    location ~ /\.(?!well-known) {
        deny all;
    }

	# reverse proxy
	location / {
		proxy_pass http://127.0.0.1:8080;
		proxy_http_version	1.1;
        proxy_cache_bypass	$http_upgrade;

        proxy_set_header Upgrade			$http_upgrade;
        proxy_set_header Connection 		"upgrade";
        proxy_set_header Host				$host;
        proxy_set_header X-Real-IP			$remote_addr;
        proxy_set_header X-Forwarded-For	$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto	$scheme;
        proxy_set_header X-Forwarded-Host	$host;
        proxy_set_header X-Forwarded-Port	$server_port;
	}
    
    location /v1/websocket {
		proxy_pass http://127.0.0.1:8080/v1/websocket;
		proxy_http_version	1.1;
        proxy_cache_bypass	$http_upgrade;

        proxy_set_header Upgrade			$http_upgrade;
        proxy_set_header Connection 		"upgrade";
        proxy_set_header Host				$host;
        proxy_set_header X-Real-IP			$remote_addr;
        proxy_set_header X-Forwarded-For	$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto	$scheme;
        proxy_set_header X-Forwarded-Host	$host;
        proxy_set_header X-Forwarded-Port	$server_port;
	}

}