snandam · May 15, 2017 14:53
diff --git a/gistfile1.conf b/gistfile1.conf
 # For more information on configuration, see:
 #   * Official English Documentation: http://nginx.org/en/docs/
 #   * Official Russian Documentation: http://nginx.org/ru/docs/

 user nginx;
 worker_processes auto;
 error_log /var/log/nginx/error.log;
 pid /var/run/nginx.pid;

 # Load dynamic modules. See /usr/share/nginx/README.dynamic.
 include /usr/share/nginx/modules/*.conf;

 events {
    worker_connections 1024;
 }

 http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
    
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    index   index.html index.htm;

    server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        
       
        root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

         listen 443 ssl;
         listen [::]:443 ssl;
         ssl on;
   	 server_name  domain.com;
         ssl_certificate /etc/nginx/ssl/ssl-bundle.crt;
         ssl_certificate_key /etc/nginx/ssl/domain.key;
         ssl_prefer_server_ciphers on;

 	#client certificate generated from API Gateway
        ssl_client_certificate  /etc/nginx/ssl/client.crt;
        ssl_trusted_certificate /etc/nginx/ssl/client.crt;        
        ssl_verify_client on;

 	ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
 	ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";

       location /api { 
 	 proxy_pass https://k0xz2n53.execute-api.us-east-2.amazonaws.com/test;         
         proxy_set_header Host $host;
 	 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header gonzalo1 $ssl_client_verify;
 	}

        location /weather {
         proxy_pass http://samples.openweathermap.org/;
         proxy_set_header Host      $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_ssl_server_name on ;
         proxy_redirect off;
        }

        # redirect server error pages to the static page /40x.html
        #
        error_page 404 /404.html;
            location = /40x.html {
        }

        # redirect server error pages to the static page /50x.html
        #
        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }

 # Settings for a TLS enabled server.
 #
 #    server {
 #        listen       443 ssl http2 default_server;
 #        listen       [::]:443 ssl http2 default_server;
 #        server_name  _;
 #        root         /usr/share/nginx/html;
 #
 #        ssl_certificate "/etc/pki/nginx/server.crt";
 #        ssl_certificate_key "/etc/pki/nginx/private/server.key";
 #        # It is *strongly* recommended to generate unique DH parameters
 #        # Generate them with: openssl dhparam -out /etc/pki/nginx/dhparams.pem 2048
 #        #ssl_dhparam "/etc/pki/nginx/dhparams.pem";
 #        ssl_session_cache shared:SSL:1m;
 #        ssl_session_timeout  10m;
 #        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 #        ssl_ciphers HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP;
 #        ssl_prefer_server_ciphers on;
 #
 #        # Load configuration files for the default server block.
 #        include /etc/nginx/default.d/*.conf;
 #
 #        location / {
 #        }
 #
 #        error_page 404 /404.html;
 #            location = /40x.html {
 #        }
 #
 #        error_page 500 502 503 504 /50x.html;
 #            location = /50x.html {
 #        }
 #    }

 }
	# For more information on configuration, see:
	# * Official English Documentation: http://nginx.org/en/docs/
	# * Official Russian Documentation: http://nginx.org/ru/docs/

	user nginx;
	worker_processes auto;
	error_log /var/log/nginx/error.log;
	pid /var/run/nginx.pid;

	# Load dynamic modules. See /usr/share/nginx/README.dynamic.
	include /usr/share/nginx/modules/*.conf;

	events {
	worker_connections 1024;
	}

	http {
	log_format main '$remote_addr - $remote_user [$time_local] "$request" '
	'$status $body_bytes_sent "$http_referer" '
	'"$http_user_agent" "$http_x_forwarded_for"';

	access_log /var/log/nginx/access.log main;

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 65;
	types_hash_max_size 2048;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	# Load modular configuration files from the /etc/nginx/conf.d directory.
	# See http://nginx.org/en/docs/ngx_core_module.html#include
	# for more information.
	include /etc/nginx/conf.d/*.conf;

	index index.html index.htm;

	server {
	listen 80 default_server;
	listen [::]:80 default_server;


	root /usr/share/nginx/html;

	# Load configuration files for the default server block.
	include /etc/nginx/default.d/*.conf;

	listen 443 ssl;
	listen [::]:443 ssl;
	ssl on;
	server_name domain.com;
	ssl_certificate /etc/nginx/ssl/ssl-bundle.crt;
	ssl_certificate_key /etc/nginx/ssl/domain.key;
	ssl_prefer_server_ciphers on;

	#client certificate generated from API Gateway
	ssl_client_certificate /etc/nginx/ssl/client.crt;
	ssl_trusted_certificate /etc/nginx/ssl/client.crt;
	ssl_verify_client on;

	ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";

	location /api {
	proxy_pass https://k0xz2n53.execute-api.us-east-2.amazonaws.com/test;
	proxy_set_header Host $host;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header gonzalo1 $ssl_client_verify;
	}

	location /weather {
	proxy_pass http://samples.openweathermap.org/;
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_ssl_server_name on ;
	proxy_redirect off;
	}

	# redirect server error pages to the static page /40x.html
	#
	error_page 404 /404.html;
	location = /40x.html {
	}

	# redirect server error pages to the static page /50x.html
	#
	error_page 500 502 503 504 /50x.html;
	location = /50x.html {
	}

	# proxy the PHP scripts to Apache listening on 127.0.0.1:80
	#
	#location ~ \.php$ {
	# proxy_pass http://127.0.0.1;
	#}

	# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
	#
	#location ~ \.php$ {
	# root html;
	# fastcgi_pass 127.0.0.1:9000;
	# fastcgi_index index.php;
	# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
	# include fastcgi_params;
	#}

	# deny access to .htaccess files, if Apache's document root
	# concurs with nginx's one
	#
	#location ~ /\.ht {
	# deny all;
	#}
	}

	# Settings for a TLS enabled server.
	#
	# server {
	# listen 443 ssl http2 default_server;
	# listen [::]:443 ssl http2 default_server;
	# server_name _;
	# root /usr/share/nginx/html;
	#
	# ssl_certificate "/etc/pki/nginx/server.crt";
	# ssl_certificate_key "/etc/pki/nginx/private/server.key";
	# # It is strongly recommended to generate unique DH parameters
	# # Generate them with: openssl dhparam -out /etc/pki/nginx/dhparams.pem 2048
	# #ssl_dhparam "/etc/pki/nginx/dhparams.pem";
	# ssl_session_cache shared:SSL:1m;
	# ssl_session_timeout 10m;
	# ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	# ssl_ciphers HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP;
	# ssl_prefer_server_ciphers on;
	#
	# # Load configuration files for the default server block.
	# include /etc/nginx/default.d/*.conf;
	#
	# location / {
	# }
	#
	# error_page 404 /404.html;
	# location = /40x.html {
	# }
	#
	# error_page 500 502 503 504 /50x.html;
	# location = /50x.html {
	# }
	# }

	}