From fb7e1011127b8682fafbee921cddfc1a69ddd13e Mon Sep 17 00:00:00 2001
From: Linden Crandall <lindencrandall123@gmail.com>
Date: Tue, 11 Feb 2025 00:49:10 +0000
Subject: [PATCH] Update Production HTTPS Setup

---
 Production-HTTPS-Setup.md | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/Production-HTTPS-Setup.md b/Production-HTTPS-Setup.md
index d8168b1..7b66a61 100644
--- a/Production-HTTPS-Setup.md
+++ b/Production-HTTPS-Setup.md
@@ -109,12 +109,7 @@ cp https/nginx/secondary_automatisch_letsencrypt_nginx.conf https/nginx/automati
 
 - Replace <HOSTNAME> entries again with the DNS and save before continuing:
 ```
-# nginx conf file to use after LetsEncrypt SSL certs have been created
-# replace <HOSTNAME> with your DNS i.e.automatisch.lasthourhosting.org
-
- 
 server {
-
     # nginx http port
     listen 80;
     listen [::]:80;        
@@ -123,35 +118,40 @@ server {
     location ~ /.well-known/acme-challenge/ {
         root /var/www/certbot;
     }
-
     return 301 https://$host$request_uri;
 }
 
 server {
 
     # nginx https port
-    listen      443 ssl http2;
-    listen      [::]:443 ssl http2;
-
+    listen      443 ssl;
+    listen      [::]:443 ssl;
+    http2 	    on;
     # use ssl letsencrypt certs
     ssl_certificate      /etc/letsencrypt/live/<HOSTNAME>/fullchain.pem;
     ssl_certificate_key  /etc/letsencrypt/live/<HOSTNAME>/privkey.pem;
+    ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1h;
     server_name <HOSTNAME>;
 
-
     location / {
-
         # Forward to Automatisch site which is running on port 7757
         proxy_pass http://main:7757/;
+        proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto https;            
     }               
 
+
+
     location ~ /.well-known/acme-challenge/ {
         root /var/www/certbot;
     }        
+
 }    
 ```
 - Then rebuild the containers: `docker compose up -d`. After it is rebuilt we should be able to pull up Automatisch at the DNS with a valid SSL cert bound to it