Basic Nginx config - ssl

Question

Background, I'd been using just Node/expressJS over https like so
const httpsOptions = {
key: fs.readFileSync('config/example_com.key'),
cert: fs.readFileSync('config/example_com.crt'),
ca: [
fs.readFileSync('config/COMODORSAAddTrustCA.crt'),
fs.readFileSync('config/COMODORSADomainValidationSecureServerCA.crt')
]
};
https.createServer(httpsOptions, app).listen(port, function () {
});
All has been working fine - https establishing fine. Now I have a goal to establish to i) help with the server load; and ii) route to a static page that says "Too many people here now, please try again later" if there is too much traffic (rather than crashing the site).
To do that, I'm just trying to migrate to nginx as reverse proxy on the same server and same everything and it just won't do at all!
Latest I tried, it's "403 Forbidden" when I go to https://www.example.com/images/picture.jpg
Can anyone please help proofread my current setup?
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
include /etc/nginx/conf.d/*.conf;
server {
listen 443 ssl default_server;
listen [::]:443 default_server;
server_name example.com www.example.com;
ssl on;
ssl_certificate /home/ec2-user/MIP/config/example_com.crt;
ssl_certificate_key /home/ec2-user/MIP/config/example_com.key;
if ($http_host = www.example) {
return 302 https://example.com$request_uri;
}
root /home/ec2-user/MIP/views;
include /etc/nginx/default.d/*.conf;
location / {
return 302 https://www.example.com$request_uri;
}
location /images/ {
root /home/ec2-user/MIP/public;
}
}
}
Yes, I do have a .jpg file at /home/ec2-user/MIP/public/images/picture.jpg and I've done chmod +r on this file.
Also, for the record, for now, I have sudo killall node because otherwise when I do "sudo service nginx start", it'd complain "Job for nginx.service failed because the control process exited with error code. See "systemctl status nginx.service" and "journalctl -xe" for details."
Many thanks in advance
[UPDATE]
For the record, I've actually got the routing to external link bit working by:
location /images/ {
return 302 https://<bucketName>.s3-us-west-2.amazonaws.com/public$request_uri;
}
Now only struggling with serving internal content from an absolute path - which's been giving me 403 Forbidden despite I've done chown -R on the public folder, and have done chmod +r on the file too
location /js/ {
root /home/ec2-user/MIP/public/;
}