<commit_before>upstream unicorn_<%= fetch(:full_app_name) %> {
  server unix:/tmp/unicorn.<%= fetch(:full_app_name) %>.sock fail_timeout=0;
}

<% if fetch(:enable_ssl) %>
server {
  listen 80;
  server_name <%= fetch(:server_name) %>;
  return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl;
  root <%= fetch(:deploy_to) %>/current/public;
  server_name <%= fetch(:server_name) %>;

  location ^~ /assets/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
  }

  try_files $uri/index.html $uri @unicorn;
  location @unicorn {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Proto https;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_pass http://unicorn_<%= fetch(:full_app_name) %>;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 4G;
  keepalive_timeout 10;
  ssl on;
  ssl_certificate /etc/ssl/ssl_cert.crt;
  ssl_certificate_key /etc/ssl/ssl_private_key.key;
}
<% else %>
server {
  listen 80;
  root <%= fetch(:deploy_to) %>/current/public;
  server_name <%= fetch(:server_name) %>;
<commit_msg>extra ssl config from https://mozilla.github.io/server-side-tls/ssl-config-generator/<commit_after>upstream unicorn_<%= fetch(:full_app_name) %> {
  server unix:/tmp/unicorn.<%= fetch(:full_app_name) %>.sock fail_timeout=0;
}

<% if fetch(:enable_ssl) %>
server {
  listen 80;
  server_name <%= fetch(:server_name) %>;
  return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl;
  root <%= fetch(:deploy_to) %>/current/public;
  server_name <%= fetch(:server_name) %>;

  location ^~ /assets/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
  }

  try_files $uri/index.html $uri @unicorn;
  location @unicorn {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Proto https;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_pass http://unicorn_<%= fetch(:full_app_name) %>;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 4G;
  keepalive_timeout 10;
  ssl on;

  # Advanced SSL Config from https://mozilla.github.io/server-side-tls/ssl-config-generator/

  # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
  ssl_certificate /etc/ssl/ssl_cert.crt;
  ssl_certificate_key /etc/ssl/ssl_private_key.key;
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;

  # modern configuration. tweak to your needs.
  ssl_protocols TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
  ssl_prefer_server_ciphers on;

  # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
  add_header Strict-Transport-Security max-age=15768000;

  # OCSP Stapling ---
  # fetch OCSP records from URL in ssl_certificate and cache them
  ssl_stapling on;
  ssl_stapling_verify on;

  resolver 8.8.8.8;
}

<% else %>
server {
  listen 80;
  root <%= fetch(:deploy_to) %>/current/public;
  server_name <%= fetch(:server_name) %>;

{'fraction_non_alphanumeric': 0.13582677165354332, 'fraction_numerical': 0.052868391451068614, 'mean_word_length': 4.455521472392638, 'pattern_counts': {'":': 0, '<': 23, '<?xml version=': 0, '>': 23, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 1, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5443913', 'n_tokens_mistral': 1632, 'n_tokens_neox': 1361, 'n_words': 229}