NGinx Config to Make TLS Great Again

nginx.conf

server {
  listen                     [::]:80 ipv6only=off;
  server_name                domain.com www.domain.com;
  rewrite                    ^ https://$host$request_uri permanent;
}

server {
  listen                     [::]:443 ipv6only=off default_server ssl;
  server_name                domain.com www.domain.com;

  ssl_certificate            /etc/letsencrypt/live/domain.com/fullchain.pem;
  ssl_certificate_key        /etc/letsencrypt/live/domain.com/privkey.pem;

  ssl_dhparam                /etc/letsencrypt/dh4096.pem;

  ssl_protocols              TLSv1.2;
  ssl_ecdh_curve             secp384r1;
  ssl_prefer_server_ciphers  on;
  ssl_ciphers                ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA;

  ssl_stapling               on;
  ssl_stapling_verify        on;
  resolver                   8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844] valid=300s;
  resolver_timeout           5s;

  ssl_session_cache          shared:SSL:10m;
  ssl_session_timeout        1h;
  ssl_session_tickets        off;
  
  location / {
    try_files                $uri $uri/index.html;
    root                     /usr/share/nginx/html;
  }

  error_page                 404              /404.html;
  location = /404.html {
    root                     /usr/share/nginx/html;
  }

  error_page                 500 502 503 504  /50x.html;
  location = /50x.html {
    root                     /usr/share/nginx/html;
  }

  add_header                 Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
  add_header                 X-Frame-Options DENY;
  add_header                 X-Content-Type-Options nosniff;
}