nginx-ssl.conf

upstream puma_rails_app {
	server app:3000;
}
server {
    listen 443 ssl http2;
    server_name www.yoursite.com;
    ssl_certificate /etc/nginx/certs/tls.crt;
    ssl_certificate_key /etc/nginx/certs/tls.key;
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache shared:ssl_session_cache:10m;
	location / {
		try_files $uri $uri/ @rails_app;
	}
	location @rails_app {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Forwarded-Ssl on; # Optional
                proxy_set_header X-Forwarded-Port $server_port;
                proxy_set_header X-Forwarded-Host $host;
                proxy_set_header Host $host;
                proxy_redirect off;
		proxy_pass http://puma_rails_app;
		proxy_connect_timeout 600s;
		proxy_send_timeout 600s;
		proxy_read_timeout 600s;
		send_timeout 600s;
		access_log /var/log/nginx/access.log;
		error_log /var/log/nginx/error.log;
	}
}