datarhei-restreamer/conf/nginx_ssl.conf

daemon off;

error_log stderr error;

worker_processes 1;
events {
    worker_connections 1024;
}

rtmp {
    server {
        listen [::]:1935 ipv6only=off;
        chunk_size 4000;

        application live {
            live on;
            idle_streams off;
            on_publish http://localhost:3000/token;
            notify_method get;
        }

        application hls {
            live on;
            hls on;
            hls_type live;
            hls_playlist_length 60s;
            hls_fragment 2s;
            hls_sync 2ms;
            hls_path /tmp/hls;
            idle_streams off;
            on_publish http://localhost:3000/token;
            notify_method get;
        }
    }
}

http {
    sendfile off;
    tcp_nopush on;
    access_log off;
    gzip on;
    gzip_vary on;
    gzip_min_length 1000;
    gzip_types text/css application/javascript;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;
    ssl_ecdh_curve secp384r1;

    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES128-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA128:DHE-RSA-AES128-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA128:ECDHE-RSA-AES128-SHA384:ECDHE-RSA-AES128-SHA128:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA384:AES128-GCM-SHA128:AES128-SHA128:AES128-SHA128:AES128-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    ssl_prefer_server_ciphers on;

    # openssl dhparam -out dhparam.pem 2048
    #ssl_dhparam ../db/dhparam.pem;

    #ssl_stapling on;
    #ssl_stapling_verify on;
    #resolver 8.8.4.4 8.8.8.8 valid=300s;
    #resolver_timeout 3s;

    ssl_certificate ../db/ssl/cert.pem;
    ssl_certificate_key ../db/ssl/key.pem;

    server {
        listen 8080;
        listen [::]:8080;
        listen 8181 ssl http2;
        listen [::]:8181 ssl http2;
        root /restreamer/src/webserver/public;
        include /usr/local/nginx/conf/mime.types;
        location / {
            try_files $uri @node;
            add_header Access-Control-Allow-Origin *;
            add_header Cache-Control no-cache;
        }
        location @node {
            add_header Access-Control-Allow-Origin *;
            add_header Cache-Control no-cache;
            proxy_pass http://localhost:3000;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
        }
        location /hls {
            types {
                application/vnd.apple.mpegurl m3u8;
                video/mp2t ts;
            }
            root /tmp;
            add_header Cache-Control no-cache;
            add_header Access-Control-Allow-Origin *;
        }
        location /debug {
            autoindex on;
        }
        location = /ping {
            add_header Content-Type text/plain;
            return 200 "pong";
        }
    }
}