Nginx with https and SSL

confg

## Make sure we are up to date and install nginx 

sudo apt-get update
sudo apt-get install nginx

## Once completed lets check the version
sudo nginx -v

## OK let’s configure nginx 
sudo nano /etc/nginx/sites-available/default

## Next we need to enter the server name find
server_name _;

## And change it to your domain
server_name ipfs2.bkawk.com;

## Under the server name, paste in
location ~ /.well-known {
                allow all;
        }

## Lastly, let’s change the root to
root /var/www/ipfs.bkawk.com;

##Save the file and exit then check the file you just edited is ok with
sudo nginx -t

## Then restart nginx
sudo service nginx restart

## now we need an SSL certificate so let’s install lets encrypts client
cd /usr/local/sbin
sudo wget https://dl.eff.org/certbot-auto

## Let’s make it executable and request a cert
sudo chmod a+x /usr/local/sbin/certbot-auto
certbot-auto certonly -a webroot --webroot-path=/var/www/ipfs.bkawk.com -d ipfs2.bkawk.com

## Enter an email and agree where you should. Make a note of the cert paths.
Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem

## Let’s check we got the 4 .pem files we need:
sudo ls -l /etc/letsencrypt/live/ipfs2.bkawk.com

## We need just one more so let’s run
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

## After it does its stuff, the last cert will pop out at 
/etc/ssl/certs/dhparam.pem.


## Ok, back to the nginx config
sudo nano /etc/nginx/sites-available/default

## We are looking for the 2 listen lines that look like this
listen 80 default_server;
listen [::]:80 default_server;

## We are going to change them to listen on port 443
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
ssl_certificate /etc/letsencrypt/live/ipfs2.bkawk.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ipfs2.bkawk.com/privkey.pem;
ssl_dhparam  /etc/ssl/certs/dhparam.pem;

## Let’s redirect all requests to https, at the bottom of the file 
server {
       listen         80;
       listen    [::]:80;
       server_name    ipfs2.bkawk.com;
       return         301 https://$server_name$request_uri;
}

## Now set the ciphers by editing 
sudo nano /etc/nginx/nginx.conf

## Add the below line after ssl_prefer_server_ciphers on;.
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;

## Let’s test and restart again
sudo nginx -t
sudo systemctl restart nginx

## Finally, browse ipfs2.bkawk.com and make sure you get redirected to https://ipfs2.bkawk.com/ and the site loads.
## Almost there, let’s set the cache, back in the config
sudo nano /etc/nginx/nginx.conf

## At the end of the http block add
ssl_session_cache shared:SSL:5m;
ssl_session_timeout 1h;
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;

## and restart again
sudo systemctl restart nginx