worker_processes 1; pid /var/run/nginx.pid; error_log stderr; events { worker_connections 1024; } http { access_log stdout; include mime.types; default_type application/octet-stream; sendfile on; keepalive_timeout 65; upstream esphomeyaml { ip_hash; server unix:/var/run/esphomeyaml.sock; } map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { server_name hassio.local; listen %%port%% default_server ssl; root /dev/null; ssl_certificate /ssl/%%certfile%%; ssl_certificate_key /ssl/%%keyfile%%; ssl_protocols TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA; ssl_ecdh_curve secp384r1; ssl_session_timeout 10m; ssl_session_cache shared:SSL:10m; ssl_session_tickets off; ssl_stapling on; ssl_stapling_verify on; # Redirect http requests to https on the same port. # https://rageagainstshell.com/2016/11/redirect-http-to-https-on-the-same-port-in-nginx/ error_page 497 https://$http_host$request_uri; location / { proxy_redirect off; proxy_pass http://esphomeyaml; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Authorization ""; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $http_host; proxy_set_header X-NginX-Proxy true; } } }