Docker 이미지를 이용한 https / let's encrypt / nginx-fpm 통합 구축

server {
  listen 443 ssl http2;
  server_name  <%= domain.name %>;

  ssl on;
  ssl_certificate <%= domain.chained_cert_path %>;
  ssl_certificate_key <%= domain.key_path %>;

  ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
  ssl_session_cache shared:SSL:50m;
  ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-
  AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-
  AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
  ssl_prefer_server_ciphers on;

  ssl_dhparam <%= dhparam_path %>;

  location / {
    return    301 https://$server_name/photo/;
  }

  location /photo/ {
    proxy_pass <%= domain.upstream %>;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}

server {
  listen 443 ssl http2;
  server_name  <%= domain.name %>;

  ssl on;
  ssl_certificate <%= domain.chained_cert_path %>;
  ssl_certificate_key <%= domain.key_path %>;

  ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
  ssl_session_cache shared:SSL:50m;
  ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-
  AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-
  AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
  ssl_prefer_server_ciphers on;

  ssl_dhparam <%= dhparam_path %>;

  <% if domain.upstream %>
  location / {
    proxy_pass <%= domain.upstream %>;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    <% if ENV['WEBSOCKET'] && ENV['WEBSOCKET'].downcase == 'true' %>
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_read_timeout 2h;
    <% end %>
  }
  <% else %>
  root   <%= domain.www_root %>;
  index  index.php index.html index.htm;

  location / {
    try_files $uri $uri/ /index.php?$query_string;
  }

  # pass the PHP scripts to FastCGI server listening on socket
  #
  location ~ \\.php$ {
    try_files $uri =404;
    fastcgi_split_path_info ^(.+\\.php)(/.+)$;
    fastcgi_pass php7fpm:9000;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param SCRIPT_NAME $fastcgi_script_name;
    fastcgi_index index.php;
    include fastcgi_params;
  }

  location ~* \\.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
    expires           5d;
  }

  # deny access to . files, for security
  #
  location ~ /\\. {
    log_not_found off;
    deny all;
  }

  location ^~ /.well-known {
    allow all;
    auth_basic off;
  }
  <% end %>
}