upstream tile_cache_backend { server 127.0.0.1; <% @caches.each do |cache| -%> <% if cache[:hostname] != node[:hostname] -%> #Server <%= cache[:hostname] %> <% cache.ipaddresses(:family => :inet, :role => :external).sort.each do |address| -%> server <%= address %> backup; <% end -%> <% end -%> <% end -%> keepalive 32; } server { listen 443 ssl http2 default_server; server_name localhost; proxy_buffers 8 64k; ssl_certificate /etc/ssl/certs/<%= @certificate %>.pem; ssl_certificate_key /etc/ssl/private/<%= @certificate %>.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers <%= node[:ssl][:ciphers] -%>; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:50m; ssl_session_timeout 30m; ssl_stapling on; ssl_dhparam /etc/ssl/certs/dhparam.pem; resolver <%= @resolvers.join(" ") %>; location / { proxy_pass http://tile_cache_backend; proxy_set_header X-Forwarded-For $remote_addr; proxy_http_version 1.1; proxy_set_header Connection ""; } }