app.conf

server {
    listen 80;
    server_name kritikos.app;
    access_log off;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}
upstream web {
    server web:8080;
}
map $http_upgrade $connection_upgrade {
     default upgrade;
     '' close;
}
server {
    listen 443 ssl;
    server_name kritikos.app;
    access_log off;
    ssl_certificate /etc/letsencrypt/live/kritikos.app/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/kritikos.app/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        proxy_pass http://web;
        proxy_set_header X-Real-IP $remote_addr;  # http://wiki.nginx.org/HttpProxyModule
        proxy_set_header Host $host;  # pass the host header - http://wiki.nginx.org/HttpProxyModule#proxy_pass
        proxy_http_version 1.1;  # recommended with keepalive connections - http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_http_version
        # WebSocket proxying - from http://nginx.org/en/docs/http/websocket.html
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}