Nextcloud Onlyoffice NGINX Reverse Proxy

upstream docservice {
  server zensiert;
}

map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      close;  
}
map $http_host $this_host {
    "" $host;  
    default $http_host;
}

map $http_x_forwarded_proto $the_scheme {
     default $http_x_forwarded_proto;
     "" $scheme;  
}

map $http_x_forwarded_host $the_host {
    default $http_x_forwarded_host;
    "" $this_host;  
}

map $http_upgrade $proxy_connection {
  default upgrade;
  "" close;  
}

proxy_set_header Connection $proxy_connection;
proxy_set_header X-Forwarded-Host $the_host;
proxy_set_header X-Forwarded-Proto $the_scheme;

server {
  listen 80;
  server_name cloud.zensiert.com;
  return 301 https://$host$request_uri;
  client_max_body_size 16000M;
server_tokens off;
}

# SSL configuration
server {
  listen 443 ssl;
  server_name cloud.zensiert.com;
  ssl_certificate      /etc/letsencrypt/live/cloud.zensiert.com/fullchain.pem;
  ssl_certificate_key  /etc/letsencrypt/live/cloud.zensiert.com/privkey.pem;
  server_tokens off;
  # Improve HTTPS performance with session resumption
  ssl_session_cache builtin:1000 shared:SSL:10m;
  ssl_session_timeout 5m;
  ssl_verify_client off;
  # Enable server-side protection against BEAST attacks
  ssl_prefer_server_ciphers on;
  ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

  # Disable SSLv3
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

  # Diffie-Hellman parameter for DHE ciphersuites
  ssl_dhparam /etc/ssl/certs/dhparam.pem;
  add_header Strict-Transport-Security max-age=31536000;
  # add_header X-Frame-Options SAMEORIGIN;
  add_header X-Content-Type-Options nosniff;

  # Enable HSTS (https:{{comment_single_line_double_slash:1}}
#  add_header Strict-Transport-Security "max-age=63072000; includeSubdomains"; 

  # Enable OCSP stapling (http:{{comment_single_line_double_slash:2}}
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /etc/letsencrypt/live/cloud.zensiert.com/fullchain.pem;
  resolver 8.8.8.8 8.8.4.4 valid=300000s;
  resolver_timeout 5s;

  location / {
    proxy_pass http://docservice;
    proxy_set_header Host $host;
    proxy_redirect http:// https://;
    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    client_max_body_size 16000M;
    proxy_set_header X-Real-IP $remote_addr;
  }
}