webapp.conf

# Default server configuration.
#
server {
    listen 80;
    listen [::]:80 ipv6only=on;

    server_name _;

    # ACME webroot.
    location /.well-known/acme-challenge/ {
      alias /var/run/acme/acme-challenge/;
    }

    # Redirect to https.
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    # SSL configuration.
    #
    listen 443 ssl;
    listen [::]:443 ssl ipv6only=on;

    # SSL Certificate.
    ssl_certificate /var/lib/acme/live/${domain}/fullchain;
    ssl_certificate_key /var/lib/acme/live/${domain}/privkey;

    # Add HSTS header.
    add_header Strict-Transport-Security "max-age=15768000; includeSubdomains";

    # Hardening.
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/ssl/certs/lets-encrypt-x1-cross-signed.pem;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:!aNULL;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_ecdh_curve secp384r1;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1.2;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 5m;

    # App configuration.
    #
    root /home/app/webapp/public;

    server_name _;

    passenger_enabled on;
    passenger_app_root /home/app/webapp;

    # Use server.js as the startup file instead of the default app.js.
    # With this option, we must also set passenger_app_type, otherwise Passenger
    # doesn't know what kind of application it is.
    passenger_startup_file server.js;
    passenger_app_type node;
}