0002_https.config

Resources:
  sslSecurityGroupIngress: 
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

files:
  /etc/nginx/conf.d/https.conf:
    content: |

      # HTTP server
      server {
        listen         80;
        server_name    yourwebsite.com;

        # permanently redirect http requests to https
        location / {
          return       301 https://$host$request_uri;
        }
      }

      # HTTPS server
      server {
        listen       443;
        server_name  localhost;
        
        ssl                  on;
        ssl_certificate      /etc/pki/tls/certs/server.crt;
        ssl_certificate_key  /etc/pki/tls/certs/server.key;
        
        ssl_session_timeout  5m;
        
        ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_prefer_server_ciphers   on;
        
        location / {
          proxy_pass  http://my_app;
          proxy_set_header        Host            $host;
          proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        location /assets {
          alias /var/app/current/public/assets;
          gzip_static on;
          gzip on;
          expires max;
          add_header Cache-Control public;
        }

        location /public {
          alias /var/app/current/public;
          gzip_static on;
          gzip on;
          expires max;
          add_header Cache-Control public;
        }
      }

container_commands:
  01restart_nginx:
    command: "service nginx restart"