nginx.conf

# For nginx compiled with:
# ./configure --with-http_ssl_module --with-openssl=/root/openssl-1.0.2 --with-http_realip_module --prefix=/usr/local/nginx --add-module=/root/nginx-1.7.10/lua-nginx-module-0.9.15 --add-module=/root/nginx-1.7.10/headers-more-nginx-module-0.25
user              nginx;
worker_processes  1;
error_log  /dev/null;
pid        /var/run/nginx.pid;
events {
	worker_connections  1024;
}
http {
	include       /usr/local/nginx/conf/mime.types;
	default_type  application/octet-stream;
	access_log  /dev/null;
	sendfile        on;
	keepalive_timeout  65;
	server_tokens off;
	# the next lua lines provide the useless (but neat) feature of randomly 
	# changing the webserver banner version for every request
	# P.S. /usr/local/nginx/conf/server-versions-2.txt is
	# https://philip.html5.org/data/server-versions-2.txt (with the count # removed)
	lua_code_cache off;
	init_by_lua '
	        handle = io.popen("echo -n $(shuf -n 1 /usr/local/nginx/conf/server-versions-2.txt)")
	        result = handle:read("*a")
	        handle:close()
	';

	error_page 404 /404.html;
	error_page 403 /403.html;

	server {
		listen 76.164.235.18:80;
		# send random Server: banner
		header_filter_by_lua 'ngx.header.Server = result';
		# then redirect all http to https
		return 301 https://$host$request_uri;
	}

	# this server block handles all .onion requests and forwards them to onion2web.lua
	server {
		listen	76.164.235.18:443;
		server_name *.onion;
		ssl on;
		ssl_certificate      bundle.crt;
		ssl_certificate_key  cert.key;
		ssl_protocols TLSv1.1 TLSv1.2;
		ssl_prefer_server_ciphers on;
		ssl_ciphers 'EECDH+aRSA+AESGCM:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
		ssl_ecdh_curve secp521r1;
		ssl_session_cache shared:SSL:10m;
		add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
		add_header X-Frame-Options DENY;
		add_header X-Content-Type-Options nosniff;
		ssl_stapling on;
		ssl_stapling_verify on;
		# send random Server: banner
		header_filter_by_lua 'ngx.header.Server = result';
		location / {
        		default_type text/html;
        		# the actual onion2web bit
        		content_by_lua '
				require("onion2web").handle_onion2web(".torstorm.org");
        		';
    		}
	}

	# this server block handles requests made to the main torstorm.org (or www.torstorm.org)
	server {
		more_clear_headers 'Accept-Ranges';
		listen	76.164.235.18:443;
		server_name torstorm.org www.torstorm.org;
		ssl on;
		ssl_certificate      bundle.crt;
		ssl_certificate_key  cert.key;
		ssl_protocols TLSv1.1 TLSv1.2;
		ssl_prefer_server_ciphers on;
		ssl_ciphers 'EECDH+aRSA+AESGCM:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
		ssl_ecdh_curve secp521r1;	
		ssl_session_cache shared:SSL:10m;
		add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
		add_header X-Frame-Options DENY;
		add_header X-Content-Type-Options nosniff;
		ssl_stapling on; # Requires nginx >= 1.3.7
		ssl_stapling_verify on; # Requires nginx => 1.3.7
		root /usr/share/nginx/html;
		# send random Server: banner
		header_filter_by_lua 'ngx.header.Server = result';
	}
}