# 代理

```conf
# 可以用来做负载均衡，或者只需要一个后端 ip+端口
upstream backend-server {
server 192.168.0.99:443;
}

# 所有 http 请求，都跳转到 https
server {
listen 80;
server_name www.sample.org;
return 301 https://$host$request_uri;
}

# https
server {
listen 443 ssl;
server_name www.sample.org;

ssl_certificate /etc/nginx/ssl/xxxxx.crt;
ssl_certificate_key /etc/nginx/ssl/xxxxxxxx.key;

location / {
proxy_redirect off;
proxy_set_header host $host;
proxy_set_header x-real-ip $remote_addr;
proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
proxy_set_header X-Forwarded-Proto https;

proxy_ssl_certificate /etc/nginx/ssl/xxxxxxxxx.crt;
proxy_ssl_certificate_key /etc/nginx/ssl/xxxxxxxxx.key;

# proxy_ssl_verify on;
# proxy_ssl_verify_depth 2;

# proxy_ssl_session_reuse on;
# proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
# proxy_ssl_ciphers HIGH:!aNULL:!MD5;

proxy_pass https://backend-server;
}
}

```


# 后端主机

```
server {
listen 443 ssl;
server_name www.sample.org;

ssl_certificate /etc/nginx/ssl/xxxxx.crt;
ssl_certificate_key /etc/nginx/ssl/xxxxxxxx.key;

location / {
try_files $uri $uri/ /index.php?$query_string;
}
}
```