nginx.conf

events {}

http {
    include mime.types;

    limit_req_zone $binary_remote_addr zone=ip:1m rate=1000r/s;
    limit_conn_zone $binary_remote_addr zone=addr:1m;

    server {
        listen 443 ssl;
        http2 on;

        http2_max_concurrent_streams 128;
        keepalive_requests 1000;

        ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
        add_header Strict-Transport-Security "max-age=15768000" always;

        ssl_certificate /etc/letsencrypt/live/you-note.ru/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/you-note.ru/privkey.pem;

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        gzip on;
        gzip_types      text/plain ;
        gzip_proxied    no-cache no-store private expired auth;
        gzip_min_length 1000;


        location /api/ {
            limit_req zone=ip burst=12 delay=8;
            limit_conn addr 5;

            proxy_set_header X-Real-IP $remote_addr;

            client_max_body_size 40M;
            proxy_pass http://you-note.ru:8080/api/;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $http_host;
            proxy_http_version 1.1;

            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
        }

        location /images/ {
            alias /opt/images/;
            etag on;
            try_files $uri = 404;
        }

        location / {
            alias /opt/public/;
            try_files $uri $uri/ /index.html;
            index index.html;
        }
    }

    server {
        access_log /var/log/nginx/access_http.log;
        error_log /var/log/nginx/error_http.log;

        if ($host = you-note.ru) {
            return 301 https://$host$request_uri;
        }

        listen 80;
        server_name you-note.ru;
        return 404;
    }
}