nathan-io-nginx.conf

server {
	server_name nathan.io;
	listen 80 default_server;
	listen [::]:80 default_server;
	return  301 https://$server_name$request_uri;
 }

server {  
        listen 443 ssl http2 default_server;
        listen [::]:443 ssl http2 default_server;
        ssl_certificate /etc/letsencrypt/live/nathan.io/fullchain.pem;
    	ssl_certificate_key /etc/letsencrypt/live/nathan.io/privkey.pem;
    	ssl_session_timeout 180m;
    	ssl_session_cache shared:SSL:10m;
    	ssl_session_tickets off;
    	ssl_dhparam /etc/nginx/dhparam.pem;

	ssl_protocols TLSv1.2;
	ssl_prefer_server_ciphers on;
	ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS;	
	ssl_ecdh_curve secp384r1;
	
	add_header Strict-Transport-Security max-age=15768000;
	ssl_stapling on;
    	ssl_stapling_verify on;
    	ssl_trusted_certificate /etc/letsencrypt/live/nathan.io/chain.pem;
   	resolver 8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844];
    	resolver_timeout 10;
	
	root /var/www/;

	index index.html;

	gzip on;
	gzip_proxied any;
	gzip_vary on;
	gzip_min_length 128;
	gzip_comp_level 6;
	gzip_types
    		application/atom+xml
    		application/javascript
    		application/json
    		application/rss+xml
    		application/vnd.ms-fontobject
    		application/x-font-ttf
    		application/x-web-app-manifest+json
    		application/xhtml+xml
    		application/xml
    		font/opentype
    		image/svg+xml
    		image/x-icon
    		text/css
    		text/plain
   		 text/x-component;

	location ~* \.(css|js|gif|jpe?g|png|woff|woff2)$ {
 		expires 168h;
  		add_header Pragma public;
  		add_header Cache-Control "public, must-revalidate, proxy-revalidate";
	}
}