nginx vhost ssl_protocols

user nginx;

worker_processes auto;
worker_rlimit_nofile 65535;

error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

#Include mudules NGINX
include /etc/nginx/modules-enabled/*.conf;

#error_log  /var/log/nginx/alllog.log debug;
error_log  /var/log/nginx/error.log crit;

events {
    use epoll;
    worker_connections  8000;
    multi_accept on;
    accept_mutex off; #тестировать
        }

http {

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    '$status $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';

log_format upstream "ua=[$upstream_addr] ut=[$upstream_response_time] us=[$upstream_status] cs=[$upstream_cache_status]";
log_format upstream_debug '[$time_local] $remote_addr - $remote_user - $server_name  to: $upstream_addr: $request upstream_response_time $upstream_response_time msec $msec request_time $request_time $upstream_status';


access_log  /var/log/nginx/access.log  main;
access_log  /var/log/nginx/upstream.log  upstream;
access_log  /var/log/nginx/ups_debug.log  upstream_debug;
error_log  /var/log/nginx/error.log crit;

#access_log off;


sendfile on;
tcp_nopush on;
tcp_nodelay on;

keepalive_timeout  30;
keepalive_requests 100;

reset_timedout_connection on;
client_body_timeout 10;
send_timeout 2;


#cache static files
open_file_cache max=200000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;

server_tokens off;

#SSL settings for all vhost
ssl_protocols TLSv1  TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES256-SHA384;
ssl_stapling on;

#SSL cache session
ssl_session_cache   shared:SSL:100m;
ssl_session_timeout 2h;

gzip on;
gzip_disable "msie6";
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;

#include /etc/nginx/conf.d/*.conf;
include /etc/nginx/vhosts/*.conf;
#include /etc/nginx/fastcgi.conf;
#include /etc/nginx/naxsi_core.rules;
include /etc/nginx/req_zones.conf;
include /etc/nginx/geoip.conf;

}

server {
    server_name new.example.com;
    listen 80;
    return 301 https://$host$request_uri;
    }

server {
    listen *.*.*.*:443 ssl http2;

    server_name new.example.com;

    server_tokens off;

    ssl_protocols  TLSv1.1 TLSv1.2;

    ssl on;
    ssl_certificate /etc/letsencrypt/live/new.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/new.example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/new.example.com/chain.pem;
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_session_timeout 1d;
    ssl_stapling_verify on;
    ssl_ecdh_curve secp384r1;
    add_header Strict-Transport-Security max-age=31536000;
    resolver 213.133.98.98 213.133.99.99 213.133.100.100  valid=86400s;
    resolver_timeout 5s;


location / {
    proxy_pass http://backend;
    include /etc/nginx/proxy_params;
    }

}

server {
    listen 443 default_server;
    ssl_protocols TLSv1.1 TLSv1.2;
}