nginx.conf

# https://github.com/h5bp/server-configs-nginx/blob/master/nginx.conf

# How many worker threads to run;
# "auto" sets it to the number of CPU cores available in the system, and
# offers the best performance. Don't set it higher than the number of CPU
# cores if changing this parameter.

# The maximum number of connections for Nginx is calculated by:
# max_clients = worker_processes * worker_connections
worker_processes auto;

# Maximum open file descriptors per process;
# should be > worker_connections.
worker_rlimit_nofile 8192;

events {
	# When you need > 8000 * cpu_cores connections, you start optimizing your OS,
	# and this is probably the point at which you hire people who are smarter than
	# you, as this is *a lot* of requests.
	worker_connections 8000;
}

pid /run/nginx.pid;

http {

	# Hide nginx version information.
	server_tokens off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	# from default nginx.conf on ubuntu 14.04
	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	# How long to allow each connection to stay idle; longer values are better
	# for each individual client, particularly for SSL, but means that worker
	# connections are tied up longer. (Default: 65)
	keepalive_timeout 20;

	# Speed up file transfers by using sendfile() to copy directly
	# between descriptors rather than using read()/write().
	# For performance reasons, on FreeBSD systems w/ ZFS
	# this option should be disabled as ZFS's ARC caches
	# frequently used files in RAM by default.
	sendfile on;

	# Tell Nginx not to send out partial frames; this increases throughput
	# since TCP frames are filled up before being sent out. (adds TCP_CORK)
	tcp_nopush on;

	# Enable Gzip compressed.
	gzip on;

	# Compression level (1-9).
	# 5 is a perfect compromise between size and cpu usage, offering about
	# 75% reduction for most ascii files (almost identical to level 9).
	gzip_comp_level 5;

	# Don't compress anything that's already small and unlikely to shrink much
	# if at all (the default is 20 bytes, which is bad as that usually leads to
			# larger files after gzipping).
	gzip_min_length 256;

	# Compress data even for clients that are connecting to us via proxies,
	# identified by the "Via" header (required for CloudFront).
	gzip_proxied any;

	# Tell proxies to cache both the gzipped and regular version of a resource
	# whenever the client's Accept-Encoding capabilities header varies;
	# Avoids the issue where a non-gzip capable client (which is extremely rare
			# today) would display gibberish if their proxy gave them the gzipped version.
	gzip_vary on;

	# Compress all output labeled with one of the following MIME-types.
	gzip_types
		application/atom+xml
		application/javascript
		application/json
		application/ld+json
		application/manifest+json
		application/rss+xml
		application/vnd.geo+json
		application/vnd.ms-fontobject
		application/x-font-ttf
		application/x-web-app-manifest+json
		application/xhtml+xml
		application/xml
		font/opentype
		image/bmp
		image/svg+xml
		image/x-icon
		text/cache-manifest
		text/css
		text/plain
		text/vcard
		text/vnd.rim.location.xloc
		text/vtt
		text/x-component
		text/x-cross-domain-policy;
	# text/html is always compressed by HttpGzipModule

	# https://mozilla.github.io/server-side-tls/ssl-config-generator/
	server {
		listen 6984 ssl http2;
		listen [::]:6984 ssl http2;

		# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
		ssl_certificate /etc/nginx/certs/server.crt;
		ssl_certificate_key /etc/nginx/certs/server.key;
		ssl_session_timeout 1d;
		ssl_session_cache shared:SSL:50m;
		ssl_session_tickets off;

		# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
		ssl_dhparam /etc/nginx/certs/dhparams.pem;

		# modern configuration. tweak to your needs.
		ssl_protocols TLSv1.1 TLSv1.2;
		ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
		ssl_prefer_server_ciphers on;

		# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
		# add_header Strict-Transport-Security max-age=15768000;

		# OCSP Stapling ---
		# fetch OCSP records from URL in ssl_certificate and cache them
		ssl_stapling on;
		ssl_stapling_verify on;

		## verify chain of trust of OCSP response using Root CA and Intermediate certs
		ssl_trusted_certificate /etc/nginx/certs/chain.pem;

		resolver 8.8.8.8 8.8.4.4 valid=86400;
		resolver_timeout 10;

		# https://wiki.apache.org/couchdb/Nginx_As_a_Reverse_Proxy
		location / {
			proxy_pass http://localhost:5984;
			proxy_redirect off;
			proxy_set_header Host $host;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		}

		location ~ ^/(.*)/_changes {
			proxy_pass http://localhost:5984;
			proxy_redirect off;
			proxy_buffering off;
			proxy_set_header Host $host;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		}
	}

}