webapp.conf

server {
    listen         80;
    server_name    $hostname;
    return         301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name $hostname;
    root /home/app/webapp/public;
    passenger_app_root /home/app/webapp;

    server_tokens off;
    more_clear_headers Server;
    more_clear_headers X-Powered-By;

    if (-f $document_root/single_cell/maintenance.html) {
        return 503;
    }

    error_page 503 @maintenance;

    location @maintenance {
        rewrite ^(.*)$ /single_cell/maintenance.html break;
    }

    location ^~ /single_cell/assets/ {
            gzip_static on;
            expires max;
    }

    add_header        X-Forwarded-Proto https always;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto $scheme;
    proxy_set_header  Host $host;
    proxy_set_header  X-Forwarded-Host $host;
    # This address repeated bugs we've found with Chrome using non-standard quote escaping in this parameter
    # see e.g. https://docs.google.com/document/d/1TTIGgu82qLJqGt130DlxWN5lsP7Wzo6FwuJSn5O_J_I
    passenger_set_header sec-ch-ua "";

    # The following deploys your Ruby/Python/Node.js/Meteor app on Passenger.

    # Not familiar with Passenger, and used (G)Unicorn/Thin/Puma/pure Node before?
    # Yes, this is all you need to deploy on Passenger! All the reverse proxying,
    # socket setup, process management, etc are all taken care automatically for
    # you! Learn more at https://www.phusionpassenger.com/.
    passenger_enabled on;
    passenger_user app;

    sendfile    on;
    client_max_body_size	1024M;

    proxy_read_timeout	300;

    # If this is a Ruby app, specify a Ruby version:
    passenger_ruby	/usr/bin/ruby3.2;
    # For Ruby 2.0
    # passenger_ruby /usr/bin/ruby2.0;
    # For Ruby 1.9.3 (you can ignore the "1.9.1" suffix)
    #passenger_ruby /usr/bin/ruby1.9.1;

    # address nginx 499 errors & CPU spikes
    passenger_ignore_client_abort on;

    ssl_certificate /etc/pki/tls/certs/localhost.crt;
    ssl_certificate_key /etc/pki/tls/private/localhost.key;

    ssl_trusted_certificate /usr/local/share/ca-certificates/GeoTrust_Universal_CA.pem;

    ssl_protocols TLSv1.2;
    ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !aNULL !eNULL !LOW !kECDH !DSS !MD5 !EXP !PSK !SRP !CAMELLIA !SEED';
    ssl_prefer_server_ciphers on;

    ssl_dhparam /usr/local/share/ca-certificates/dhparam.pem;
}