server {
  listen 443 ssl;
  http2 on;
  if ($server_protocol !~* "HTTP/2") {
    return 444;
  }

  keepalive_timeout 60;
  charset utf-8;

  ssl_certificate /certs/server.cert;
  ssl_certificate_key /certs/server.key;
  ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_protocols TLSv1.3;
  ssl_session_cache shared:SSL:50m;
  ssl_session_timeout 1d;
  ssl_session_tickets off;
  ssl_prefer_server_ciphers on;

  sendfile on;
  tcp_nopush on;

  add_header X-Content-Type-Options "nosniff" always;
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  add_header X-Frame-Options SAMEORIGIN always;
  add_header X-XSS-Protection "1; mode=block" always;
  add_header Referrer-Policy "no-referrer";

  fastcgi_hide_header X-Powered-By;

  error_page 500 502 503 504 /50x.html;
  location = /50x.html {
      root   /usr/share/nginx/html;
  }

  error_page 401 403 404 /404.html;
  location / {
    proxy_pass http://hived:8090;
  }
}