Alternatively, my working configuration for clustering enabled + SSL:
# redirects http requests to https
server {
  listen 80;
  
	# change this!
  server_name example.com;

	# change this!
  return 301 https://example.com$request_uri;
}

# create multiple instances for scaling
upstream io_nodes {
    ip_hash;
    server 127.0.0.1:4567;
    server 127.0.0.1:4568;
    server 127.0.0.1:4569;
}

# the actual encrypted server
server {
  listen 443 ssl spdy;

	# change this!
	 server_name example.com;

  ssl on;
  
  # change this!
  ssl_certificate /etc/nginx/ssl/bundle.crt;
  
  #change this!
  ssl_certificate_key /etc/nginx/ssl/site.de.key;

  # enables all versions of TLS, but not SSLv2 or 3 which are weak and now deprecated.
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

  # disables all weak ciphers
	ssl_ciphers 'AES128+EECDH:AES128+EDH';
  ssl_prefer_server_ciphers on;

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_set_header X-NginX-Proxy true;
    proxy_redirect off;

    # Socket.io Support
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    
    # watch out - no quotes!
    proxy_set_header Connection upgrade;

    gzip            on;
    gzip_min_length 1000;
    gzip_proxied    off;
    gzip_types      text/plain application/xml application/x-javascript text/css application/json;

    location @nodebb {
        proxy_pass http://io_nodes;
    }

    location ~ ^/(images|language|sounds|templates|uploads|vendor|src\/modules|nodebb\.min\.js|stylesheet\.css|admin\.css) {
       
        # change this! 
        root /var/www/nodebb/public/;
        try_files $uri $uri/ @nodebb;
    }

    location / {
			proxy_pass http://io_nodes;
    }

}
Community

Moritz Friedrich
