sample-nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/stakepool_error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" "$realip_remote_addr"';

    access_log  /var/log/nginx/stakepool_access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Ensure ngx_http_realip_module is available
    set_real_ip_from 127.0.0.1/32;
    # If you are behind a NAT router, specify LAN
    #set_real_ip_from 10.24.0/16;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;

    server {
        listen          80 default_server;
        server_name     _;

        rewrite ^       https://stakepool.domain.tld/$request_uri permanent;
    }

    limit_req_zone $binary_remote_addr zone=stakepool:10m rate=1r/s;

    server {
        listen       443 default_server;
        server_name  _;

        ssl                     on;
        ssl_certificate         /etc/ssl/www/stakepool.domain.tld.crt;
        ssl_certificate_key     /etc/ssl/www/stakepool.domain.tld.key;
 
        ssl_session_cache               shared:SSL:20m;
        ssl_protocols                   TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers                     EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
        ssl_prefer_server_ciphers       on;
        add_header                      Strict-Transport-Security max-age=15552001;

        location / {
            # apply rate limiting
            limit_req zone=stakepool burst=5;

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $realip_remote_addr;
            proxy_pass http://127.0.0.1:8000;
            proxy_http_version 1.0;
        }
    }
}