bubble/automation/roles/nginx/templates/site_sage.conf.j2

server {
    listen 80;
    server_name {{ server_name }};
    client_max_body_size 200M;

    root  /home/bubble/site/;
    index index.html;

    location / {
        rewrite ^/(\w+/)+(?<basename>.*)$ /$basename break;
        try_files $uri /index.html =404;
    }

    location /api {
        proxy_pass http://127.0.0.1:{{ admin_port }}/api;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Host {{ server_name }};
        proxy_set_header X-Forwarded-Proto https;
    }

    location /nodeman {
        return 302 /nodeman/;
    }
    location /nodeman/ {
        proxy_pass http://127.0.0.1:7800/;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Host {{ server_name }};
        proxy_set_header X-Forwarded-Proto https;
    }

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/html;
    }

    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/{{ server_name }}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/{{ server_name }}/privkey.pem;
    ssl_session_cache shared:le_nginx_SSL:1m;
    ssl_session_timeout 1440m;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA";

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    }
}