nginx.conf

server {
  listen 80;
  listen [::]:80;
  server_name _;

  access_log /dev/stdout;

  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name _;

  access_log /dev/stdout;

  ssl_certificate_key '/etc/nginx/graylog.key';
  ssl_certificate     '/etc/nginx/graylog.crt';
  ssl_stapling off;
  ssl_stapling_verify off;

  if ($request_method !~ ^(GET|POST|PATCH|PUT|DELETE)$ ) {
    return 405;
  }

  autoindex off;
  server_tokens off;
  proxy_pass_request_headers on;
  proxy_connect_timeout 150;
  proxy_send_timeout 100;
  proxy_read_timeout 100;
  proxy_buffers 4 32k;
  client_max_body_size 50m;
  client_body_buffer_size 128k;
  client_body_timeout 5s;
  client_header_buffer_size 2k;
  client_header_timeout 5s;
  large_client_header_buffers 3 1k;
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 10m;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4;

  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  add_header Referrer-Policy same-origin;
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header Set-Cookie "Path=/;HttpOnly;Secure;SameSite=none";

  location / {
    proxy_pass http://graylog:9000;

    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;

  }
}