semi-optimal setup; ip_hash might give you issues if you have to server a lot of mobile-clients (at least here in europe), because of central proxies used by mobile-providers. this one might help if you need stickyness: https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng/o...
instead of "if ($host !~ ^(api.yourdomain.com)$ )" you should use a "server_name api.yourdomain.com;" - directive for your proxy_config and a catch_all - server{} block that consist only of "return 444;" to avoid that "if"-processing on any request.
oh, and you might want to use "ssl_session_cache shared:SSL:1440m;" for better performance (adjust the timeframe accordingly, i've seen values from 10 minutes up to 48hours like google)
> SSL certs tend to be rather confusing ... no not, really, but i leave it up to you to figure out what a key is and what a cert :D
i wasnt able (yet) to exploit php-fpm, although i was able to sneak the user-agent into it and had an exploitable bash and a system() - call within this file
11. turn off server_tokens
e3c4676d14a8ddd07d140f6d3e771ae8994ff5f4a159ba70fa5f5a9eaf026ada9a9f61021ef5ec27466718573c8a73621d119c385eb284fe322eaefaff2d1b42
i think it depends on the terms&conditions of google's playstore. just because you are german doesnt meant you cant ge sued by american laws, and i know that german and american laws are quite dirrefent when it comes to compensation (schadensersatz).
suggestions: delete references to "Yo" from your product-name (name it Jo instead); "Yo" is a registered trademark; you wouldnt name a chocolate you created "ritter sport", even if your name was armin ritter