update nginx to 1.10.1 and open ssl 1.0.2h

Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx:1.8-alpine
+FROM nginx:1.10-alpine
 
 RUN apk update && apk add \
     python3 \

backend.conf.j2

@@ -1,45 +1,42 @@
 server {
-    server_name www.{{ domain }};
-    return 301 $scheme://{{ domain }}$request_uri;
-}
-
-server {
     server_name {{ domain }} localhost;
     return 301 https://$server_name$request_uri;
 }
 
 server {
-    listen [::]:443 ssl;
-    listen 443 ssl;
-
-    server_name {{ domain }} localhost;
-
-    charset utf-8;
-
-    ssl_certificate      /etc/ssl/certs/certificate.crt;
-    ssl_certificate_key  /etc/ssl/private/private.key;
-
-    ssl_session_cache    shared:SSL:20m;
-    ssl_session_timeout  30m;
-
-    ssl_protocols                           TLSv1 TLSv1.1 TLSv1.2;
-    ssl_ciphers                             ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
-    ssl_prefer_server_ciphers               on;
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
 
+    ssl_certificate /etc/ssl/certs/certificate.crt;
+    ssl_certificate_key /etc/ssl/private/private.key;
+    ssl_session_timeout 30m;
+    ssl_session_cache shared:SSL:20m;
+    ssl_session_tickets off;
 
 {% if dhparam %}
+    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
     ssl_dhparam /etc/ssl/certs/dhparam.pem;
 {% endif %}
+
+    # modern configuration. tweak to your needs.
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+    ssl_prefer_server_ciphers on;
+
+    # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
+    add_header Strict-Transport-Security max-age=15768000;
+
 {% if ssl_trusted_certificate %}
-    resolver                   8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=300s;
-    resolver_timeout           10s;
+    # OCSP Stapling ---
+    # fetch OCSP records from URL in ssl_certificate and cache them
+    ssl_stapling on;
+    ssl_stapling_verify on;
 
-    ssl_stapling               on;
-    ssl_stapling_verify        on;
+    ## verify chain of trust of OCSP response using Root CA and Intermediate certs
     ssl_trusted_certificate /etc/ssl/certs/ca.crt;
-{% endif %}
 
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    resolver 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=300s;
+{% endif %}
 
     location ~ /(static|media)/ {
        autoindex on;