nginx_site.conf

map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      close;
}

server {
  listen 443 ssl;
  listen [::]:443 ssl;
  http2 on;
  server_name example.org;

  # Use one of those (or any tool you prefer) to get TLS certificate:
  # - Certbot: https://certbot.eff.org/
  # - Acme.sh: https://acme.sh/
  ssl_certificate /etc/nginx/ssl/example.org.crt;
  ssl_certificate_key /etc/nginx/ssl/example.org.key;

  ssl_protocols TLSv1.3 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ecdh_curve secp521r1:secp384r1;
  ssl_ciphers EECDH+AESGCM:EECDH+AES256;
  # RFC-7919 recommended: https://wiki.mozilla.org/Security/Server_Side_TLS#ffdhe4096
  ssl_dhparam /etc/ssl/ffdhe4096.pem;
  ssl_stapling on;
  ssl_stapling_verify on;
  resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]; # Cloudflare
  ssl_session_cache shared:TLS:2m;
  ssl_buffer_size 4k;

  location / {
    proxy_pass http://localhost:8001;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}

server {
  listen 80;
  listen [::]:80;

  server_name _;

  # For Certbot
  location /.well-known/ {
    try_files $uri $uri/ =404;
    root /var/www/html;
  }

  return 301 https://$host$request_uri;
}