updated directory structure to match actual install

etc/nginx/availableSites/catch-all_dropConnection.conf

@@ -0,0 +1,29 @@
+#######
+### NGINX server configuration
+### Drop all connections that do not match configured servers
+#######
+
+# Drop connections over HTTP by default
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    # have nginx silently drop the connection
+    return 444;
+}
+
+# Drop connections over HTTPS by default
+# This could only happen after user proceeds past certificate mismatch warning
+# or if using a wildcard certificate where obviously not all possible hosts
+# could be configured.
+# Respond with default certificates then drop connection
+server {
+    listen 443 default_server ssl http2;
+    listen [::]:443 default_server ssl http2;
+
+    # SSL certificates for this server
+    include /etc/nginx/snippets/ssl/ssl_certs.conf;
+
+    # have nginx silently drop the connection
+    return 444;
+}

etc/nginx/availableSites/redirectHTTPS.conf

@@ -0,0 +1,28 @@
+#######
+### NGINX server configuration
+### Redirect to secure connection
+#######
+
+server {
+    listen 80;
+    listen [::]:80;
+
+    # specify server name(s)
+    include /etc/nginx/snippets/server_names.conf;
+
+    # redirect to properly formed HTTPS request
+    return 301 https://$host$request_uri;
+
+    # error pages
+    error_page 404 /404.html;
+    location = /404.html {
+        root /usr/share/nginx/html;
+        internal;
+    }
+
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        root /usr/share/nginx/html;
+        internal;
+    }
+}

etc/nginx/availableSites/redirectHTTPS_LE.conf

@@ -0,0 +1,42 @@
+#######
+### NGINX server configuration
+### Redirect to secure connection
+### Process LetsEncrypt verification requests
+#######
+
+server {
+    listen 80;
+    listen [::]:80;
+
+    # specify server name(s)
+    include /etc/nginx/snippets/server_names.conf;
+
+    # redirect to properly formed HTTPS request
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    # process LetsEncrypt requests
+    location ^~ /.well-known/acme-challenge {
+        # log requests to review issued certs or for security auditing
+        access_log /var/log/nginx/LetsEncrypt_access.log main;
+        error_log /var/log/nginx/LetsEncrypt_error.log warn;
+
+        default_type text/plain;
+        root /usr/share/nginx/html/letsencrypt;
+        autoindex on;
+    }
+
+    # error pages
+    error_page 404 /404.html;
+    location = /404.html {
+        root /usr/share/nginx/html;
+        internal;
+    }
+
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        root /usr/share/nginx/html;
+        internal;
+    }
+}

etc/nginx/conf.d/buffers.conf

@@ -0,0 +1,8 @@
+#######
+### NGINX configuration - buffers
+#######
+
+client_body_buffer_size 10k;
+client_header_buffer_size 1k;
+client_max_body_size 10M;
+large_client_header_buffers 2 1k;

etc/nginx/conf.d/gzip.conf

@@ -0,0 +1,18 @@
+#######
+### NGINX configuration - gzip
+#######
+
+gzip on;
+gzip_vary on;
+gzip_comp_level 4;
+gzip_min_length 256;
+gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+gzip_types application/atom+xml application/javascript application/json
+    application/ld+json application/manifest+json application/rss+xml
+    application/vnd.geo+json application/vnd.ms-fontobject
+    application/x-font-ttf application/x-web-app-manifest+json
+    application/xhtml+xml application/xml font/opentype image/bmp
+    image/svg+xml image/x-icon text/cache-manifest text/css text/plain
+    text/vcard text/vnd.rim.location.xloc text/vtt text/x-component
+    text/x-cross-domain-policy;
+gzip_disable "MSIE [1-6]\.";

etc/nginx/conf.d/mozModern_ssl.conf

@@ -0,0 +1,37 @@
+#######
+### NGINX SSL configuration
+### Generated with help from Mozilla Configuration Generator
+### (https://mozilla.github.io/server-side-tls/ssl-config-generator/)
+### 'Modern' profile for NGINX 1.15.8 with OpenSSL 1.1.1b HSTS optional
+### Last generated: January 4, 2019
+#######
+
+# SSL certificates should be defined in the relevant server block
+
+# SSL parameters
+ssl_session_timeout 1d;
+ssl_session_cache shared:SSL:50m;
+ssl_session_tickets off;
+
+# SSL ciphers
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers 'TLS-CHACHA20-POLY1305-SHA256:TLS-AES-256-GCM-SHA384:TLS-AES-128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'
+ssl_prefer_server_ciphers on;
+
+# Diffie-Hellman parameter for DHE cipher suites, using 4096 bits
+ssl_dhparam /path/to/your_dhparam.pem;
+
+# HSTS -- please understand the implications of HSTS before enabling it
+# do NOT implement while still testing configurations or site parameters
+# (15768000 seconds = 6 months)
+#add_header Strict-Transport-Security max-age=15768000;
+
+# OCSP Stapling
+# fetch OCSP records from URL in ssl_certificate and cache them
+ssl_stapling on;
+ssl_stapling_verify on;
+
+# verify chain of trust of OCSP response using Root CA and Intermediate certs
+ssl_trusted_certificate /path/to/your_CA_bundle.crt;
+
+# resolver should be specified in nginx.conf or in networking configuration

etc/nginx/conf.d/optimizeStatic.conf

@@ -0,0 +1,8 @@
+#######
+### NGINX configuration - optimze static content delivery
+#######
+
+sendfile on;
+sendfile_max_chunk 1m;
+tcp_nopush on;
+tcp_nodelay on;

etc/nginx/conf.d/securityHeaders.conf

@@ -0,0 +1,11 @@
+#######
+### NGINX configuration - add security related headers
+### (HTTPS specific headers are added in HTTPS configuration)
+#######
+
+add_header X-Robots-Tag none;
+add_header X-Download-Options noopen;
+add_header X-Permitted-Cross-Domain-Policies none;
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-XSS-Protection "1; mode=block" always;
+add_header Referrer-Policy "same-origin" always;

etc/nginx/conf.d/timeouts.conf

@@ -0,0 +1,8 @@
+#######
+### NGINX configurations - timeouts
+#######
+
+client_body_timeout 12s;
+client_header_timeout 12s;
+keepalive_timeout 15s;
+send_timeout 10s;

etc/nginx/snippets/server_names.conf

@@ -0,0 +1,6 @@
+#######
+### NGINX configuration -- list of server names
+#######
+
+server_name
+    ;

etc/nginx/snippets/ssl/ssl_certs.conf

@@ -0,0 +1,6 @@
+#######
+### NGINX configuration - location of SSL certificates
+#######
+
+ssl_certificate /path/to/your_ssl_certificate_fullchain;
+ssl_certificate_key /path/to/your_certificate_private_key.key;