upstream gitlab-workhorse {
	#server localhost:8081 fail_timeout=0;
	server unix://run/gitlab/gitlab-workhorse.socket fail_timeout=0;
}

server {
	  listen 80; 
	  server_name git.smirky.net;
	  # enforce https
	  return 301 https://$server_name$request_uri;
}

server {
	listen 443 ssl http2;
	keepalive_timeout 70;
	server_name git.smirky.net git.localhost
	server_tokens off;
	
	ssl_certificate	/etc/letsencrypt/live/smirky.net/fullchain.pem;
	ssl_certificate_key  /etc/letsencrypt/live/smirky.net/privkey.pem;
	#ssl_trusted_certificate  /etc/letsencrypt/live/smirky.net/fullchain.pem;
	ssl_stapling on;
	ssl_stapling_verify on;
	
	ssl_prefer_server_ciphers on; 
	ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_dhparam /etc/ssl/private/dhparam.pem;

	charset utf-8;
	root /dev/null;
  
	# Increase this if you want to upload larger attachments
	client_max_body_size 20m;
  
	access_log /var/log/nginx/gitlab_access.log;
	error_log /var/log/nginx/gitlab_error.log;

	location / {
		proxy_read_timeout 300;
		proxy_connect_timeout 300;
		proxy_redirect off;
		proxy_hide_header Strict-Transport-Security;
		proxy_set_header Host $http_host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-Ssl on;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Frame-Options SAMEORIGIN;
	
		proxy_pass http://gitlab-workhorse;
	}  
}