odoo-11-https-nginx.conf

# Reference 
# https://www.linuxcloudvps.com/blog/how-to-install-odoo-10-on-ubuntu-16-04-with-nginx-as-a-reverse-proxy/
# https://linuxize.com/post/configure-odoo-with-nginx-as-a-reverse-proxy/
# https://gist.github.com/plentz/6737338

upstream odoo {
    server 127.0.0.1:8069;
}

upstream odoo-chat {
 server 127.0.0.1:8072;
}

server {
    listen      80;
    server_name mysite.com www.mysite.com;
    return 301 https://mysite.com$request_uri;
}

server {
    listen 443 ssl http2;
    server_name  mysite.com www.mysite.com;
    
    client_max_body_size 20M;
    
    access_log  /var/log/nginx/mysite.com.access.log;
    error_log   /var/log/nginx/mysite.com.error.log;

    ssl on;
    ssl_certificate     /etc/letsencrypt/live/www.mysite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.mysite.com/privkey.pem;
    keepalive_timeout   60;
    
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    
    # generate using command below
    # openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 4096
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    
    # Enable HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

    # Do not permit Content-Type sniffing.
    add_header X-Content-Type-Options nosniff;

    proxy_buffers 16 64k;
    proxy_buffer_size 128k;

    # gzip : https://checkgzipcompression.com/
    gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript;
    gzip on;

    location / {
        proxy_pass  http://odoo;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
        proxy_redirect off;

        proxy_set_header    Host            $host;
        proxy_set_header    X-Real-IP       $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto https;
    }

    location /longpolling {
       proxy_pass http://odoo-chat;
    }

    location ~* /web/static/ {
        proxy_cache_valid 200 60m;
        proxy_buffering on;
        expires 864000;
        proxy_pass http://odoo;
    }
    
    # letsencrypt renew
    location ~ /.well-known {
        root /home/odoo/odoo/addons/web/static;
        allow all;
    }
    
}