default

# This is /etc/nginx/sites-available/default sample file for benchmarks with nginx
# Upstream server (echo server)
server {
        listen 9061;
        location / {
                add_header 'content-type' 'text/plain';
                echo "hello, world!";
        }
}
# Reverse proxy made by nginx
server {
        listen 9065;
    location / {
        proxy_pass http://127.0.0.1:9061;
    }

}

server {
    listen 9062 ssl http2;
    add_header 'content-type' 'text/plain';

    

    # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
    ssl_certificate /etc/nginx/ssl-local/server.pem;
    ssl_certificate_key /etc/nginx/ssl-local/server-key.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;


    # modern configuration. tweak to your needs.
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
    ssl_prefer_server_ciphers on;

    # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
    add_header Strict-Transport-Security max-age=15768000;

    # OCSP Stapling ---
    # fetch OCSP records from URL in ssl_certificate and cache them
    ssl_stapling off;
    ssl_stapling_verify on;

    ## verify chain of trust of OCSP response using Root CA and Intermediate certs
    ssl_trusted_certificate /etc/nginx/ssl-local/ca.pem;

    return 200 'ok';
}


server {
    listen 9091;
    location / {
        proxy_pass https://127.0.0.1:9062;
        proxy_ssl_verify off;
    }
}