upstream webserver {
	server 127.0.0.1:8001 weight=1 max_fails=3 fail_timeout=3;
	server 127.0.0.1:8002 backup;
}
           
proxy_cache_path cache levels=1:2 keys_zone=cache:128m max_size=1G; 

# HTTPS server
server {
	listen       443 ssl;
	server_name  zx.com;
	server_tokens off;  
	# ssl_client_certificate keys/server.cer;
	ssl_certificate      keys/zx.cer;
	ssl_certificate_key  keys/zx.key;
	ssl_session_cache    shared:SSL:10m;
	ssl_session_timeout  120m;
	
	#the following three line cannt be replace before confirm with secruty group
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers  AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:!aNULL:!eNULL:!MD5:!DH:!ECDH:!DHE:!ECDHE:!RC4:!EXPORT;
	ssl_prefer_server_ciphers  on;

	 if ($request_method !~* GET|HEAD|POST|PUT) {
		return 403;
	}

	location ~ ^/.*WEB-INF.*$ {
		deny all;
	
	}
	#静态资源
	location ~ \.(html|css|gif|jpeg|jpg|png|bmp|swf|woff2|ico|js)$
	{
	  access_log off;
	  proxy_pass http://webserver;
	}

	location /nginxstatus {
		stub_status on;
		allow 127.0.0.1;
		deny all;
		access_log off;
	}
   
	location  / {
		#安全配置
		set $request_body_data "";
		set $response_body_data "";
		set $response_header_data "";
		
		#安全配置
		proxy_pass http://webserver;
		proxy_set_header   HOST   $host;
		proxy_set_header   X-Real-IP $remote_addr;
		proxy_set_header  X-Forwarded-For $remote_addr;
		proxy_intercept_errors on; 
		proxy_set_header Accept-Encoding "";
		#静态资源
		location ~* \.(html|css|gif|jpeg|jpg|png|bmp|swf|woff2|ico|js)$ {
					access_log off;
					proxy_pass http://webserver;
		}
	}
	
	#设置错误信息返回页面，通过error_page指令可以指定各种错误code对应的展示页面。Nginx默认会在主目录的html目录中查找指定的展示页面。需要注意的是，这些展示页面的大小一定要超过512b，否者会被IE浏览器替换为IE默认的错误页面
	error_page 404 /404.html;
	error_page 500 502 503 504 /50x.html;

	location = /error.html {
		root  html;
	}
   
				 
}