Secure nginx (1.10+) server configuration with reverse proxy

Below is an nginx (version 1.10+) configuration that I like to use as a baseline. It has been adapted from several sources (all mentioned below.)

server {
  # We bind to a specific interface - NOT 0.0.0.0
  listen X.X.X.X:443 ssl;
  server_name yourwebsite.com www.yourwebsite.com;

  ssl_certificate /etc/nginx/ssl/yourwebsite_cert.pem;
  # Ensure that your key has the correct its set e.g. chmod 600.
  ssl_certificate_key /etc/nginx/ssl/yourwebsite_key.key;

  # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets off;

  # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
  ssl_dhparam /etc/nginx/ssl/dhparam.pem;

  # enables server-side protection from BEAST attacks
  ssl_prefer_server_ciphers on;
  # disable SSLv3 - we only want TLSv1/1.1/1.2 (ideally just 1.2 if we can get away with it.)
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  # ciphers chosen for forward secrecy and compatibility: https://mozilla.github.io/server-side-tls/ssl-config-generator/
  ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";

  # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
  ssl_stapling on;
  ssl_stapling_verify on;

  # verify chain of trust of OCSP response using Root CA and Intermediate certs
  ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

  # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
  add_header Strict-Transport-Security max-age=15768000;

  # Prevent clickjacking: https://www.owasp.org/index.php/Clickjacking
  add_header X-Frame-Options "SAMEORIGIN";

  # Disable sniffing in browsers: https://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx?Redirected=true
  add_header X-Content-Type-Options nosniff;

  # X-XSS Protection header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
  add_header X-XSS-Protection "1; mode=block";

  # Define DNS resolver   resolver 8.8.8.8

  access_log  /var/log/nginx/yourdomain.log  combined;
  error_log  /var/log/nginx/yourdomain.error.log;

  # Reverse proxy configuration
     location / {
     proxy_pass  https://10.11.12.13:443;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
     proxy_redirect off;
     proxy_buffering off;
     proxy_set_header        Host            $host;
     proxy_set_header        X-Real-IP       $remote_addr;
     proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
     client_max_body_size 10M;
     allow      1.2.3.4;
     deny       all;
   }

}

# redirect all http traffic to https
server {
  listen 80;
  server_name yourserver.com;
  return 301 https://$host$request_uri;
}


Sources:

https://mozilla.github.io/server-side-tls/ssl-config-generator/ (nginx 1.10.1 | intermediate profile | OpenSSL 1.0.1e)
https://geekflare.com/add-x-frame-options-nginx/
https://blog.dnsimple.com/2017/01/introducing-caa-records/