gistfile1.txt

server {

server_name im.domain.tld;
set $forwardx_port 45261;
set $forwardx_scheme http;
set $forwardx_server domain.internal;

       listen 443 ssl;
       error_page 500 502 503 504 /50x-toast.html;
       location = /50x-toast.html {
                root /html;
                internal;
       }
       
       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
       add_header 'X-Content-Type-Options'  'nosniff';
       add_header 'X-Frame-Options' 'sameorigin';
       add_header 'X-XSS-Protection' '1; mode=block';
       add_header 'Cache-control' 'no-cache';
       add_header 'Referrer-Policy' 'same-origin';
       add_header 'Content-Security-Policy' "upgrade-insecure-requests";
       add_header 'Permissions-Policy' "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()";

       client_max_body_size 0;
       proxy_http_version 1.1;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "Upgrade";
       proxy_set_header Host $host;
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_redirect off;
       proxy_read_timeout  3600s;
       proxy_send_timeout  3600s;
       send_timeout  3600s;
       
location / {
        proxy_pass $forwardx_scheme://$forwardx_server:$forwardx_port; }

location ~* ^.*\.(css|js|jpe?g|gif|png|webp|woff|eot|ttf|svg|ico|css\.map|js\.map)$ {
        if_modified_since off;

        # use the public cache
        proxy_cache public-cache;
        proxy_cache_key $host$request_uri;

        # ignore these headers for media
        proxy_ignore_headers Set-Cookie Cache-Control Expires X-Accel-Expires;

        # cache 200s and also 404s (not ideal but there are a few 404 images for some reason)
        proxy_cache_valid any 30m;
        proxy_cache_valid 404 1m;

        # strip this header to avoid If-Modified-Since requests
        proxy_hide_header Last-Modified;
        proxy_hide_header Cache-Control;
        proxy_hide_header Vary;

        proxy_cache_bypass 0;
        proxy_no_cache 0;

        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504 http_404;
        proxy_connect_timeout 5s;
        proxy_read_timeout 45s;

        expires @30m;
        access_log  off;

        add_header       X-Served-By $host;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto  $scheme;
        proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP          $remote_addr;
        proxy_pass       $forwardx_scheme://$forwardx_server:$forwardx_port;
}

##### below file is sourced
### include includes/block-exploits;
### https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/docker/rootfs/etc/nginx/conf.d/include/block-exploits.conf

}