upstream odooweb {
    server 127.0.0.1:8069 weight=1 fail_timeout=3600s;
}

upstream odoo8-im {
        server 127.0.0.1:8072 weight=1 fail_timeout=0;
}

server {
    listen      80 default_server;
    charset     utf-8;
    server_name    domain.com;

    add_header Strict-Transport-Security max-age=2592000;

    # necessary for Let's Encrypt
    location /.well-known {
        alias /var/www/html/.well-known;
    }
    location / {
    	rewrite ^ https://$server_name$request_uri? permanent;
    }
}

server {    
    listen      443 default;
    charset     utf-8;
    access_log    /var/log/nginx/odoo-access.log;
    error_log     /var/log/nginx/odoo-error.log;

    keepalive_timeout    60;

    server_name   domain.com;

    # Specifies the maximum accepted body size of a client request,
    # as indicated by the request header Content-Length.
    client_max_body_size 200m;

    # ssl certificate files
    ssl on;    

    # Uncomment 2 lines above for modern browsers compatibility
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

    ssl_prefer_server_ciphers   on;
    ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;

    # increase proxy buffer to handle some OpenERP web requests
    proxy_buffers       16 64k;
    proxy_buffer_size   128k;

    # necessary for Let's Encrypt
    location /.well-known {
        alias /var/www/html/.well-known;
    }

    location / {
        proxy_pass    http://odooweb;

        # force timeouts if the backend dies
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

        # Set timeouts
        proxy_connect_timeout   3600;
        proxy_send_timeout      3600;
        proxy_read_timeout      3600;
        send_timeout            3600;

        # set headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;

        # Let the OpenERP web service know that we're using HTTPS, otherwise
        # it will generate URL using http:// and not https://
        proxy_set_header X-Forwarded-Proto https;

        # by default, do not forward anything
        proxy_redirect off;
    }

    location /longpolling {
       proxy_pass http://odoo8-im;
    }

    # cache some static data in memory for 60mins.
    # under heavy load this should relieve stress on the OpenERP web interface a bit.
    location ~* /web/static/ {
        proxy_cache_valid 200 60m;
        proxy_buffering    on;
        expires 864000;
        proxy_pass http://odooweb;
    }
}