example nginx dynmap configuration

# File /etc/nginx/conf.d/dynmap.conf

# HTTP configuration
server {
    # IP-Adressen
    listen 0.0.0.0:80;
    listen [::]:80;
    # server_name <your-subdomain>.<domain name>.<tld>
    # For example:
    server_name dynmap.example.com;
    # redirect all HTTP requests to HTTPS
    # return 301 https://<your-subdomain>.<domain name>.<tld>$request_uri;
    # For example:
    return 301 https://dynmap.example.com$request_uri;
}

# HTTPS configuration
server {
    # IP-Adressen
    listen 0.0.0.0:443 ssl;
    listen [::]:443 ssl;
    http2 on;

    # server_name <your-subdomain>.<domain name>.<tld>;
    # For example:
    server_name dynmap.example.com;
    index index.php;

    # Logs (adjust the paths for your case)
    access_log /var/log/nginx/dynmap.access.log;
    error_log /var/log/nginx/dynmap.error.log;

    # Paths to certificates (adjust accordingly, I created the folder /etc/nginx/ssl for this, you could also point to the letsencrypt files directly (/etc/letsencrypt) - Make sure nginx can read them!
    ssl_certificate /etc/nginx/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/example.com/privkey.pem;

    # Supported protocols and ciphers
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
    ssl_ecdh_curve secp384r1;
    # Adjust path to your dhparams file (generate with: openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096 - sizes could be 1024 / 2048 / 4096 - Higher = takes a while!)
    ssl_dhparam /etc/nginx/ssl/dhparams.pem;

    # OCSP (Optional) - Please specify correct path for ssl_trusted_certificate
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/example.com/fullchain.pem;
    ssl_stapling_verify on;
    resolver 1.1.1.1;

    # Headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    # Proxy settings
    location  / {
        proxy_set_header    Host             $host;
        proxy_set_header    X-Real-IP        $remote_addr;
        proxy_set_header    X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_set_header    X-Client-Verify  SUCCESS;
        proxy_set_header    X-Client-DN      $ssl_client_s_dn;
        proxy_set_header    X-SSL-Subject    $ssl_client_s_dn;
        proxy_set_header    X-SSL-Issuer     $ssl_client_i_dn;
        proxy_set_header    X-Forwarded-Proto https;
        # Adjust to your internal dynmap url - 127.0.0.1 = localhost
        # proxy_pass http://<internal dynmap url>:<Port of Dynmap - Default: 8192>;
        proxy_pass http://127.0.0.1:8192;
        proxy_read_timeout 1800;
        proxy_connect_timeout 1800;
    }
}