nginx_ssl.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}
http {
    access_log /dev/stdout;
    error_log /dev/stdout;
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    index   index.html index.htm;
    server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        server_name  localhost;
        client_max_body_size 900M;
        gzip on;
        gzip_proxied any;
        gzip_vary on;
        gzip_min_length 10240;
        gzip_types
            text/css
            text/javascript
            text/xml
            text/plain
            application/javascript
            application/x-javascript
            application/json;
        gzip_disable "MSIE [1-6]\.";
        root         /var/www/html;
        location / {
            include uwsgi_params;
            uwsgi_pass unix:/tmp/uwsgi.socket;
        }

        location ~* ^.+\.(?:ico|css|js|gif|jpe?g|png)$ {
            expires 1y;
            add_header Pragma public;
            add_header Cache-Control "public";
            include uwsgi_params;
            uwsgi_pass unix:/tmp/uwsgi.socket;
        }
    }

    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name mesa.mosla.de;
        client_max_body_size 900M;
        server_tokens off;

        ssl_certificate /root/.acme.sh/mesa.mosla.de/mesa.mosla.de.cer;
        ssl_certificate_key /root/.acme.sh/mesa.mosla.de/mesa.mosla.de.key;

        ssl_buffer_size 8k;

        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
        ssl_prefer_server_ciphers on;

        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

        ssl_ecdh_curve secp384r1;
        ssl_session_tickets off;

        # OCSP stapling
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8;
        gzip on;
        gzip_proxied any;
        gzip_vary on;
        gzip_min_length 10240;
        gzip_types
            text/css
            text/javascript
            text/xml
            text/plain
            application/javascript
            application/x-javascript
            application/json;
        gzip_disable "MSIE [1-6]\.";
        root         /var/www/html;
        location / {
            include uwsgi_params;
            uwsgi_pass unix:/tmp/uwsgi.socket;
        }

        location ~* ^.+\.(?:ico|css|js|gif|jpe?g|png)$ {
            expires 1y;
            add_header Pragma public;
            add_header Cache-Control "public";
            include uwsgi_params;
            uwsgi_pass unix:/tmp/uwsgi.socket;
        }
    }
}