fqi.conf

server {
  listen 80;
  server_name localhost frenchquarterinns.com www.frenchquarterinns.com;
  # $scheme will get the http protocol
  # and 301 is best practice for tablet, phone, desktop and seo
  return 301 https://frenchquarterinns.com$request_uri;
}

server {
    listen 443 ssl spdy;

    # Inform browser of SPDY availability
    add_header Alternate-Protocol  443:npn-spdy/3;

    # Force the latest IE version
    add_header "X-UA-Compatible" "IE=Edge";

    # Adjust connection keepalive for SPDY clients:
    spdy_keepalive_timeout 300; # up from 180 secs default

    # enable SPDY header compression
    spdy_headers_comp 6;

    # Protect against the BEAST and POODLE attacks by not using SSLv3 at all. If you need to support older browsers (IE6) you may need to add
    # SSLv3 to the list of protocols below.
    ssl_protocols              TLSv1 TLSv1.1 TLSv1.2;

    # Ciphers set to best allow protection from Beast, while providing forwarding secrecy, as defined by Mozilla (Intermediate Set) - https://wiki.mozilla.org/Security/Server_Side_TLS#Nginx
    ssl_ciphers                ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
    ssl_prefer_server_ciphers  on;

    # Optimize SSL by caching session parameters for 10 minutes. This cuts down on the number of expensive SSL handshakes.
    # The handshake is the most CPU-intensive operation, and by default it is re-negotiated on every new/parallel connection.
    # By enabling a cache (of type "shared between all Nginx workers"), we tell the client to re-use the already negotiated state.
    # Further optimization can be achieved by raising keepalive_timeout, but that shouldn't be done unless you serve primarily HTTPS.
    ssl_session_cache    shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions
    ssl_session_timeout  24h;

    # SSL buffer size was added in 1.5.9
    #ssl_buffer_size      1400; # 1400 bytes to fit in one MTU

    # Session tickets appeared in version 1.5.9
    #
    # nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and
    # when a restart is performed the previous key is lost, which resets all previous
    # sessions. The fix for this is to setup a manual rotation mechanism:
    # http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
    #
    # Note that you'll have to define and rotate the keys securely by yourself. In absence
    # of such infrastructure, consider turning off session tickets:
    #ssl_session_tickets off;

    # Use a higher keepalive timeout to reduce the need for repeated handshakes
    keepalive_timeout 300; # up from 75 secs default

    # HSTS (HTTP Strict Transport Security)
    # This header tells browsers to cache the certificate for a year and to connect exclusively via HTTPS.
    #add_header Strict-Transport-Security "max-age=31536000;";
    # This version tells browsers to treat all subdomains the same as this site and to load exclusively over HTTPS
    #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    # This default SSL certificate will be served whenever the client lacks support for SNI (Server Name Indication).
    # Make it a symlink to the most important certificate you have, so that users of IE 8 and below on WinXP can see your main site without SSL errors.
    ssl_certificate      /certs/bundle.crt;
    ssl_certificate_key  /certs/frenchquarterinns_np.key;

    ssl_stapling on;
    ssl_stapling_verify on;

    #trusted cert must be made up of your intermediate certificate followed by root certificate
    ssl_trusted_certificate /certs/COMODORSAAddTrustCA.crt;

    resolver 8.8.8.8 8.8.4.4 216.146.35.35 216.146.36.36 valid=60s;
    resolver_timeout 2s;

    # This tells Nginx to cache open file handles, "not found" errors, metadata about files and their permissions, etc.
    #
    # The upside of this is that Nginx can immediately begin sending data when a popular file is requested,
    # and will also know to immediately send a 404 if a file is missing on disk, and so on.
    #
    # However, it also means that the server won't react immediately to changes on disk, which may be undesirable.
    #
    # In the below configuration, inactive files are released from the cache after 20 seconds, whereas
    # active (recently requested) files are re-validated every 30 seconds.
    #
    # Descriptors will not be cached unless they are used at least 2 times within 20 seconds (the inactive time).
    #
    # A maximum of the 1000 most recently used file descriptors can be cached at any time.
    #
    # Production servers with stable file collections will definitely want to enable the cache.
    open_file_cache          max=1000 inactive=20s;
    open_file_cache_valid    30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors   on;

    # The X-Frame-Options header indicates whether a browser should be allowed
    # to render a page within a frame or iframe.
    add_header X-Frame-Options SAMEORIGIN;

    # MIME type sniffing security protection
    # There are very few edge cases where you wouldn't want this enabled.
    add_header X-Content-Type-Options nosniff;

    # The X-XSS-Protection header is used by Internet Explorer version 8+
    # The header instructs IE to enable its inbuilt anti-cross-site scripting filter.
    add_header X-XSS-Protection "1; mode=block";

    # Prevent mobile networks from modifying the site.
    add_header "Cache-Control" "no-transform";

    server_name localhost frenchquarterinns.com www.frenchquarterinns.com;

    error_page 502  /errors/502.html;

    root /var/frenchquarterinns/dist;

    # cache.appcache, your document html and data
    location ~* \.(?:manifest|appcache|html?|xml|json)$ {
      expires -1;
      access_log /var/log/nginx/static.log;
    }

    # Media: images, icons, video, audio, HTC
    location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
      expires 1M;
      access_log off;
      add_header Cache-Control "public";
    }

    # CSS and Javascript
    location ~* \.(?:css|js)$ {
      expires 1y;
      access_log off;
      add_header Cache-Control "public";
    }
}