nginx.conf.erb

daemon off;

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
     <% 
       @upstream = ""
       ENV['UPSTREAM'].split(',').each do |value|
         @upstream += "server " + value + ";\n"
       end
     -%>    
     upstream terminator {
     <%= @upstream %>
     }

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    access_log  /var/log/nginx/access.log;

    sendfile        on;

    keepalive_timeout		<%= ENV['KEEPALIVE_TIMEOUT'] ? ENV['KEEPALIVE_TIMEOUT'] : 65 %>;
    client_max_body_size	<%= ENV['CLIENT_MAX_BODY_SIZE'] ? ENV['CLIENT_MAX_BODY_SIZE'] : '32m' %>;

    gzip  on;

    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    server {
      server_name	<%= ENV['SERVER_NAME'] ? ENV['SERVER_NAME'] : '_' %>;
      listen		80;
      rewrite		^/(.*)$ https://$host/$1 permanent;
    }
 
    server {
      server_name		<%= ENV['SERVER_NAME'] ? ENV['SERVER_NAME'] : '_' %>;
      listen			443 ssl;
      ssl_certificate		<%= ENV['SSL_CERTIFICATE'] ? ENV['SSL_CERTIFICATE'] : '/etc/nginx/custom_cert.pem' %>;
      ssl_certificate_key	<%= ENV['SSL_CERTIFICATE_KEY'] ? ENV['SSL_CERTIFICATE_KEY'] : '/etc/nginx/custom_cert.key' %>;
      ssl_protocols		TLSv1.1 TLSv1.2;

      add_header Strict-Transport-Security "max-age=31536000";

      location / {
        proxy_pass http://terminator;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
      }
      
   }

}