|
# Server globals |
|
user nginx; |
|
|
|
# Set number of worker processes automatically based on number of CPU cores. |
|
worker_processes auto; |
|
worker_cpu_affinity auto; |
|
worker_rlimit_nofile 65535; |
|
|
|
# Configures default error logger. |
|
#error_log /var/log/nginx/error.log crit; |
|
error_log /var/log/nginx/error.log; |
|
pid /var/run/nginx.pid; |
|
|
|
# Includes files with directives to load dynamic modules. |
|
#load_module modules/ngx_http_modsecurity_module.so; |
|
|
|
# Worker config |
|
events { |
|
# determines how much clients will be served per worker |
|
# max clients = worker_connections * worker_processes |
|
# max clients is also limited by the number of socket connections available on the system (~64k) |
|
worker_connections 4096; |
|
|
|
# optmized to serve many clients with each thread, essential for linux |
|
use epoll; |
|
|
|
# accept as many connections as possible, may flood worker connections if set too low |
|
multi_accept on; |
|
} |
|
|
|
http { |
|
# Main settings |
|
limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=30r/m; |
|
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m; |
|
|
|
# Enable of asynchronous file I/O works on linux |
|
aio threads; |
|
aio_write on; |
|
|
|
# copies data between one FD and other from within the kernel |
|
# faster then read() + write() |
|
sendfile on; |
|
|
|
# send headers in one peace, its better then sending them one by one |
|
tcp_nopush on; |
|
|
|
# don't buffer data sent, good for small data bursts in real time |
|
tcp_nodelay on; |
|
|
|
# allow the server to close connection on non responding client, this will free up memory |
|
reset_timedout_connection on; |
|
|
|
# Nginx Simple DDoS Defense |
|
client_header_timeout 1m; |
|
client_body_timeout 1m; |
|
client_header_buffer_size 2k; |
|
client_body_buffer_size 256k; |
|
client_max_body_size 16m; |
|
large_client_header_buffers 4 8k; |
|
|
|
# Just For Security Reason |
|
server_tokens off; |
|
server_name_in_redirect off; |
|
server_names_hash_max_size 512; |
|
server_names_hash_bucket_size 512; |
|
|
|
# Log format |
|
log_format main '$remote_addr – $remote_user [$time_local] $request ' |
|
'"$status" $body_bytes_sent "$http_referer" ' |
|
'"$http_user_agent" "$http_x_forwarded_for"'; |
|
log_format bytes '$body_bytes_sent'; |
|
|
|
# to boost I/O on HDD we can disable access logs |
|
#access_log /var/log/nginx/access.log main; |
|
access_log off; |
|
|
|
# Mime settings |
|
include /etc/nginx/mime.types; |
|
default_type application/octet-stream; |
|
|
|
# Proxy settings |
|
proxy_http_version 1.1; |
|
proxy_cache_bypass $http_upgrade; |
|
|
|
# Proxy headers |
|
proxy_set_header Upgrade $http_upgrade; |
|
proxy_set_header Connection "upgrade"; |
|
proxy_set_header Host $host; |
|
proxy_set_header X-Real-IP $remote_addr; |
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
|
proxy_set_header X-Forwarded-Proto $scheme; |
|
proxy_set_header X-Forwarded-Host $host; |
|
proxy_set_header X-Forwarded-Port $server_port; |
|
|
|
# Proxy timeouts |
|
proxy_connect_timeout 60s; |
|
proxy_send_timeout 90s; |
|
proxy_read_timeout 90s; |
|
|
|
# Restore Real IP Cloudflare https://www.cloudflare.com/ips |
|
set_real_ip_from 103.21.244.0/22; |
|
set_real_ip_from 103.22.200.0/22; |
|
set_real_ip_from 103.31.4.0/22; |
|
set_real_ip_from 104.16.0.0/12; |
|
set_real_ip_from 108.162.192.0/18; |
|
set_real_ip_from 131.0.72.0/22; |
|
set_real_ip_from 141.101.64.0/18; |
|
set_real_ip_from 162.158.0.0/15; |
|
set_real_ip_from 172.64.0.0/13; |
|
set_real_ip_from 173.245.48.0/20; |
|
set_real_ip_from 188.114.96.0/20; |
|
set_real_ip_from 190.93.240.0/20; |
|
set_real_ip_from 197.234.240.0/22; |
|
set_real_ip_from 198.41.128.0/17; |
|
set_real_ip_from 2400:cb00::/32; |
|
set_real_ip_from 2606:4700::/32; |
|
set_real_ip_from 2803:f800::/32; |
|
set_real_ip_from 2405:b500::/32; |
|
set_real_ip_from 2405:8100::/32; |
|
set_real_ip_from 2c0f:f248::/32; |
|
set_real_ip_from 2a06:98c0::/29; |
|
|
|
# Use real IPs |
|
real_ip_header CF-Connecting-IP; |
|
#real_ip_header X-Forwarded-For; |
|
|
|
# OCSP Stapling |
|
ssl_stapling on; |
|
ssl_stapling_verify on; |
|
resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s; |
|
resolver_timeout 2s; |
|
|
|
# SSL PCI Compliance |
|
ssl_session_timeout 1d; |
|
ssl_session_cache shared:SSL:10m; |
|
ssl_session_tickets off; |
|
ssl_protocols TLSv1.2 TLSv1.3; |
|
ssl_prefer_server_ciphers on; |
|
ssl_ecdh_curve X25519:prime256v1:secp384r1; |
|
|
|
# Server Side TLS |
|
# SSL/TLS Configuration Generator |
|
# https://mozilla.github.io/server-side-tls/ssl-config-generator/ |
|
|
|
# Oldest compatible clients |
|
# Firefox 1, Chrome 1, IE 8 on Windows 7, Opera 5, Safari 1, Android 2.3, Java 7 |
|
ssl_ciphers "ECDHE+CHACHA20:ECDHE+AESGCM:DHE+AESGCM:ECDHE+AES:DHE+AES:RSA+AESGCM:RSA+AES:!DES-CBC3-SHA:!DSS"; |
|
|
|
# DH parameter for Perfect Forward Secrecy |
|
# openssl dhparam -dsaparam -out /etc/ssl/dhparam.pem 4096 |
|
ssl_dhparam /etc/ssl/dhparam.pem; |
|
|
|
# Various security headers |
|
add_header X-Frame-Options "SAMEORIGIN"; |
|
add_header X-XSS-Protection "1; mode=block"; |
|
add_header X-Content-Type-Options "nosniff"; |
|
add_header Referrer-Policy "no-referrer-when-downgrade"; |
|
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'"; |
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; |
|
|
|
# Error pages |
|
error_page 403 /var/www/error/403.html; |
|
error_page 404 /var/www/error/404.html; |
|
error_page 502 503 504 /var/www/error/500.html; |
|
|
|
# Cache |
|
proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=512m; |
|
proxy_cache_key md5("$host$request_uri$cookie_user"); |
|
proxy_temp_path /var/cache/nginx/temp; |
|
proxy_ignore_headers X-Accel-Expires Expires Cache-Control; |
|
proxy_cache_use_stale error timeout invalid_header updating http_502; |
|
proxy_cache_valid any 24h; |
|
proxy_cache_bypass $http_upgrade; |
|
|
|
# Cache bypass |
|
map $http_cookie $no_cache { |
|
default 0; |
|
~SESS 1; |
|
~wordpress_logged_in 1; |
|
} |
|
|
|
# File cache settings |
|
open_file_cache max=10000 inactive=30s; |
|
open_file_cache_valid 60s; |
|
open_file_cache_min_uses 2; |
|
open_file_cache_errors off; |
|
|
|
# ModSecurity |
|
#modsecurity on; |
|
#modsecurity_rules_file /etc/nginx/modsec/main.conf; |
|
|
|
# Wildcard include |
|
include /etc/nginx/conf.d/http/*.conf; |
|
} |
|
|
|
stream { |
|
resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s; |
|
resolver_timeout 2s; |
|
|
|
# Wildcard include |
|
include /etc/nginx/conf.d/stream/*.conf; |
|
} |