default.conf

server {
        listen 80;        
        server_name tweaxybackend.mywire.org;
        location ~ /.well-known/acme-challenge{
        allow all;
        root /usr/share/nginx/html/letsencrypt;
       }
       location / {
        return 301 https://tweaxybackend.mywire.org$request_uri;
        }
      
}
server {
     listen 443 ssl http2;
     server_name tweaxybackend.mywire.org;

     ssl on;
     server_tokens off;
     ssl_certificate /etc/nginx/ssl/live/tweaxybackend.mywire.org/fullchain.pem;
     ssl_certificate_key /etc/nginx/ssl/live/tweaxybackend.mywire.org/privkey.pem;
     ssl_dhparam /etc/nginx/dhparam/dhparam-2048.pem;
     
     ssl_buffer_size 8k;
     ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
     ssl_prefer_server_ciphers on;
     ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       }

}