/etc/nginx/nginx.conf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Server globals | |
| user nginx; | |
| # Set number of worker processes automatically based on number of CPU cores. | |
| worker_processes auto; | |
| worker_cpu_affinity auto; | |
| worker_rlimit_nofile 65535; | |
| # Configures default error logger. | |
| #error_log /var/log/nginx/error.log crit; | |
| error_log /var/log/nginx/error.log; | |
| pid /var/run/nginx.pid; | |
| # Includes files with directives to load dynamic modules. | |
| #load_module modules/ngx_http_modsecurity_module.so; | |
| # Worker config | |
| events { | |
| # determines how much clients will be served per worker | |
| # max clients = worker_connections * worker_processes | |
| # max clients is also limited by the number of socket connections available on the system (~64k) | |
| worker_connections 4096; | |
| # optmized to serve many clients with each thread, essential for linux | |
| use epoll; | |
| # accept as many connections as possible, may flood worker connections if set too low | |
| multi_accept on; | |
| } | |
| http { | |
| # Main settings | |
| limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=30r/m; | |
| limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m; | |
| # Enable of asynchronous file I/O works on linux | |
| aio threads; | |
| aio_write on; | |
| # copies data between one FD and other from within the kernel | |
| # faster then read() + write() | |
| sendfile on; | |
| # send headers in one peace, its better then sending them one by one | |
| tcp_nopush on; | |
| # don't buffer data sent, good for small data bursts in real time | |
| tcp_nodelay on; | |
| # allow the server to close connection on non responding client, this will free up memory | |
| reset_timedout_connection on; | |
| # Nginx Simple DDoS Defense | |
| client_header_timeout 1m; | |
| client_body_timeout 1m; | |
| client_header_buffer_size 2k; | |
| client_body_buffer_size 256k; | |
| client_max_body_size 16m; | |
| large_client_header_buffers 4 8k; | |
| # Just For Security Reason | |
| server_tokens off; | |
| server_name_in_redirect off; | |
| server_names_hash_max_size 512; | |
| server_names_hash_bucket_size 512; | |
| # Log format | |
| log_format main '$remote_addr – $remote_user [$time_local] $request ' | |
| '"$status" $body_bytes_sent "$http_referer" ' | |
| '"$http_user_agent" "$http_x_forwarded_for"'; | |
| log_format bytes '$body_bytes_sent'; | |
| # to boost I/O on HDD we can disable access logs | |
| #access_log /var/log/nginx/access.log main; | |
| access_log off; | |
| # Mime settings | |
| include /etc/nginx/mime.types; | |
| default_type application/octet-stream; | |
| # Proxy settings | |
| proxy_http_version 1.1; | |
| proxy_cache_bypass $http_upgrade; | |
| # Proxy headers | |
| proxy_set_header Upgrade $http_upgrade; | |
| proxy_set_header Connection "upgrade"; | |
| proxy_set_header Host $host; | |
| proxy_set_header X-Real-IP $remote_addr; | |
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
| proxy_set_header X-Forwarded-Proto $scheme; | |
| proxy_set_header X-Forwarded-Host $host; | |
| proxy_set_header X-Forwarded-Port $server_port; | |
| # Proxy timeouts | |
| proxy_connect_timeout 60s; | |
| proxy_send_timeout 90s; | |
| proxy_read_timeout 90s; | |
| # Restore Real IP Cloudflare https://www.cloudflare.com/ips | |
| set_real_ip_from 103.21.244.0/22; | |
| set_real_ip_from 103.22.200.0/22; | |
| set_real_ip_from 103.31.4.0/22; | |
| set_real_ip_from 104.16.0.0/12; | |
| set_real_ip_from 108.162.192.0/18; | |
| set_real_ip_from 131.0.72.0/22; | |
| set_real_ip_from 141.101.64.0/18; | |
| set_real_ip_from 162.158.0.0/15; | |
| set_real_ip_from 172.64.0.0/13; | |
| set_real_ip_from 173.245.48.0/20; | |
| set_real_ip_from 188.114.96.0/20; | |
| set_real_ip_from 190.93.240.0/20; | |
| set_real_ip_from 197.234.240.0/22; | |
| set_real_ip_from 198.41.128.0/17; | |
| set_real_ip_from 2400:cb00::/32; | |
| set_real_ip_from 2606:4700::/32; | |
| set_real_ip_from 2803:f800::/32; | |
| set_real_ip_from 2405:b500::/32; | |
| set_real_ip_from 2405:8100::/32; | |
| set_real_ip_from 2c0f:f248::/32; | |
| set_real_ip_from 2a06:98c0::/29; | |
| # Use real IPs | |
| real_ip_header CF-Connecting-IP; | |
| #real_ip_header X-Forwarded-For; | |
| # OCSP Stapling | |
| ssl_stapling on; | |
| ssl_stapling_verify on; | |
| resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s; | |
| resolver_timeout 2s; | |
| # SSL PCI Compliance | |
| ssl_session_timeout 1d; | |
| ssl_session_cache shared:SSL:10m; | |
| ssl_session_tickets off; | |
| ssl_protocols TLSv1.2 TLSv1.3; | |
| ssl_prefer_server_ciphers on; | |
| ssl_ecdh_curve X25519:prime256v1:secp384r1; | |
| # Server Side TLS | |
| # SSL/TLS Configuration Generator | |
| # https://mozilla.github.io/server-side-tls/ssl-config-generator/ | |
| # Oldest compatible clients | |
| # Firefox 1, Chrome 1, IE 8 on Windows 7, Opera 5, Safari 1, Android 2.3, Java 7 | |
| ssl_ciphers "ECDHE+CHACHA20:ECDHE+AESGCM:DHE+AESGCM:ECDHE+AES:DHE+AES:RSA+AESGCM:RSA+AES:!DES-CBC3-SHA:!DSS"; | |
| # DH parameter for Perfect Forward Secrecy | |
| # openssl dhparam -dsaparam -out /etc/ssl/dhparam.pem 4096 | |
| ssl_dhparam /etc/ssl/dhparam.pem; | |
| # Various security headers | |
| add_header X-Frame-Options "SAMEORIGIN"; | |
| add_header X-XSS-Protection "1; mode=block"; | |
| add_header X-Content-Type-Options "nosniff"; | |
| add_header Referrer-Policy "no-referrer-when-downgrade"; | |
| add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'"; | |
| add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; | |
| # Error pages | |
| error_page 403 /var/www/error/403.html; | |
| error_page 404 /var/www/error/404.html; | |
| error_page 502 503 504 /var/www/error/500.html; | |
| # Cache | |
| proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=512m; | |
| proxy_cache_key md5("$host$request_uri$cookie_user"); | |
| proxy_temp_path /var/cache/nginx/temp; | |
| proxy_ignore_headers X-Accel-Expires Expires Cache-Control; | |
| proxy_cache_use_stale error timeout invalid_header updating http_502; | |
| proxy_cache_valid any 24h; | |
| proxy_cache_bypass $http_upgrade; | |
| # Cache bypass | |
| map $http_cookie $no_cache { | |
| default 0; | |
| ~SESS 1; | |
| ~wordpress_logged_in 1; | |
| } | |
| # File cache settings | |
| open_file_cache max=10000 inactive=30s; | |
| open_file_cache_valid 60s; | |
| open_file_cache_min_uses 2; | |
| open_file_cache_errors off; | |
| # ModSecurity | |
| #modsecurity on; | |
| #modsecurity_rules_file /etc/nginx/modsec/main.conf; | |
| # Wildcard include | |
| include /etc/nginx/conf.d/http/*.conf; | |
| } | |
| stream { | |
| resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s; | |
| resolver_timeout 2s; | |
| # Wildcard include | |
| include /etc/nginx/conf.d/stream/*.conf; | |
| } |
/etc/nginx/conf.d/http/letsencrypt.conf
https://gist.github.com/bouroo/fb391e2de7fa05a0d528031b97728cef#file-letsencrypt-conf
/etc/nginx/conf.d/http/web.conf
https://gist.github.com/bouroo/fb391e2de7fa05a0d528031b97728cef#file-web-conf
/etc/nginx/conf.d/stream/mariadb.conf
https://gist.github.com/bouroo/fb391e2de7fa05a0d528031b97728cef#file-mariadb-conf
System administrator at Zercle Technology Co., Ltd.
System admin กากๆ
รักในการเล่นเกม
ชอบดู Anime ญี่ปุ่น
รักในการเล่นเกม
ชอบดู Anime ญี่ปุ่น
Latest posts by Kawin Viriyaprasopsook (see all)
- Convert flac audio to opus/ogg/mp3 - 2020-12-20
- Workaround systemd resolved not working (127.0.0.53) - 2019-09-23
- Safely remove SATA disk from a running Linux system - 2019-05-24