nginx.conf

# Drop privileges
user nobody nobody;

# One worker per core, many connections per worker
worker_processes auto;
events {
	worker_connections  19000;
}
# Each connection needs one filehandle, or two if we miss cache
worker_rlimit_nofile    20000;

http {
	include       conf/mime.types;
	include       headers.conf;
	include       tls-http.conf;
	include       tls-letsencrypt-http.conf;
	default_type  application/octet-stream;
	
	# Logging to standard outputs for docker
	log_format  main  '$time_iso8601 $remote_addr "$request" '
		'$upstream_cache_status $status $request_time $bytes_sent $body_bytes_sent '
		'"$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
	error_log  /dev/stderr info;
	access_log /dev/stdout main buffer=4096 flush=1s;
	
	# Compress all content when client supports it. Unfortunately nginx
	# is not smart enough to store cache content pre-compressed.
	gzip               on;
	gzip_comp_level    1;
	gzip_types         *;
	gzip_proxied       any;
	
	server {
		listen       443 ssl http2 default_server;
		listen   [::]:443 ssl http2;
		
		include      tls-server.conf;
		include      tls-letsencrypt-server.conf;
		
		# Reverse proxy
		location / {
			proxy_http_version      1.1;
			client_max_body_size    0;
			proxy_buffering         off;
			proxy_request_buffering off;
			proxy_set_header        Proxy       "";
			proxy_set_header        Host        $host;
			proxy_set_header        X-Real-IP   $remote_addr;
			proxy_set_header        Upgrade     $http_upgrade;
			proxy_pass ${ORIGIN_HOST};
		}
	}
	
	server {
		listen       80 ;
		listen   [::]:80; 
		
		include      tls-letsencrypt-acme.conf;
		
        server_name _;
        
		# Redirect all traffic to TLS
		location / {
			return 301 https://$host$request_uri;
		}
	}
}