nginx.conf

worker_processes 1;
user www-data www-data;
pid /var/run/nginx.pid;

events {
	worker_connections 64;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 60;
	types_hash_max_size 2048;
	# server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# Logging Settings
	##

	access_log /usr/src/app/log/nginx_access.log;
	error_log /usr/src/app/log/nginx_error.log;

	##
	# Gzip Settings
	##

	gzip on;
	gzip_disable "msie6";

	upstream unicorn_wayfinding {
		server unix:/tmp/unicorn.sock fail_timeout=0;
	}

	server {
		listen 80;

		server_name wayfinding.dss.ucdavis.edu;
		return 301 https://$host$request_uri;
	}

	server {
		listen 443 ssl;

		ssl_certificate /certs/wayfinding_dss_ucdavis_edu.cer;
		ssl_certificate_key /certs/wayfinding_dss_ucdavis_edu.key;
		# Enables SSLv3/TLSv1, but not SSLv2 which is weak and should no longer be used.
		ssl_protocols SSLv3 TLSv1;
		# Disables all weak ciphers
		ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;

		server_name wayfinding.dss.ucdavis.edu;
		root /usr/src/app/public;

		try_files $uri/index.html $uri @unicorn_wayfinding;
		location @unicorn_wayfinding {
		  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		  proxy_set_header Host $http_host;
		  proxy_set_header X-Forwarded-Proto $scheme;
		  proxy_redirect off;
		  proxy_pass http://unicorn_wayfinding;
		}

		location ^~ /assets/ {
			gzip_static on;
			expires max;
			add_header Cache-Control public;
		}

		error_page 500 502 503 504 /500.html;
		client_max_body_size 256M;
		keepalive_timeout 5;
	}
}