nginx Archives | Zercle Technology Co., Ltd.

/etc/nginx/nginx.conf
# Server globals

user nginx;

# Set number of worker processes automatically based on number of CPU cores.

worker_processes auto;

worker_cpu_affinity auto;

worker_rlimit_nofile 65535;

# Configures default error logger.

#error_log /var/log/nginx/error.log crit;

error_log /var/log/nginx/error.log;

pid /var/run/nginx.pid;

# Includes files with directives to load dynamic modules.

#load_module modules/ngx_http_modsecurity_module.so;

# Worker config

events {

	# determines how much clients will be served per worker

	# max clients = worker_connections * worker_processes

	# max clients is also limited by the number of socket connections available on the system (~64k)

	worker_connections 4096;

	# optmized to serve many clients with each thread, essential for linux

	use epoll;

	# accept as many connections as possible, may flood worker connections if set too low

	multi_accept on;

}

http {

	# Main settings

	limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=30r/m;

	limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;

	# Enable of asynchronous file I/O works on linux

	aio threads;

	aio_write on;

	# copies data between one FD and other from within the kernel

	# faster then read() + write()

	sendfile on;

	# send headers in one peace, its better then sending them one by one

	tcp_nopush on;

	# don't buffer data sent, good for small data bursts in real time

	tcp_nodelay on;

	# allow the server to close connection on non responding client, this will free up memory

	reset_timedout_connection on;

	# Nginx Simple DDoS Defense

	client_header_timeout 1m;

	client_body_timeout 1m;

	client_header_buffer_size 2k;

	client_body_buffer_size 256k;

	client_max_body_size 16m;

	large_client_header_buffers 4 8k;

	# Just For Security Reason

	server_tokens off;

	server_name_in_redirect off;

	server_names_hash_max_size 512;

	server_names_hash_bucket_size 512;

	# Log format

	log_format main	'$remote_addr – $remote_user [$time_local] $request '

			'"$status" $body_bytes_sent "$http_referer" '

			'"$http_user_agent" "$http_x_forwarded_for"';

	log_format bytes '$body_bytes_sent';

	# to boost I/O on HDD we can disable access logs

	#access_log /var/log/nginx/access.log main;

	access_log off;

	# Mime settings

	include /etc/nginx/mime.types;

	default_type application/octet-stream;

	# Proxy settings

	proxy_http_version 1.1;

	proxy_cache_bypass $http_upgrade;

	# Proxy headers

	proxy_set_header Upgrade $http_upgrade;

	proxy_set_header Connection "upgrade";

	proxy_set_header Host $host;

	proxy_set_header X-Real-IP $remote_addr;

	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

	proxy_set_header X-Forwarded-Proto $scheme;

	proxy_set_header X-Forwarded-Host $host;

	proxy_set_header X-Forwarded-Port $server_port;

	# Proxy timeouts

	proxy_connect_timeout 60s;

	proxy_send_timeout 90s;

	proxy_read_timeout 90s;

	# Restore Real IP Cloudflare https://www.cloudflare.com/ips

	set_real_ip_from 103.21.244.0/22;

	set_real_ip_from 103.22.200.0/22;

	set_real_ip_from 103.31.4.0/22;

	set_real_ip_from 104.16.0.0/12;

	set_real_ip_from 108.162.192.0/18;

	set_real_ip_from 131.0.72.0/22;

	set_real_ip_from 141.101.64.0/18;

	set_real_ip_from 162.158.0.0/15;

	set_real_ip_from 172.64.0.0/13;

	set_real_ip_from 173.245.48.0/20;

	set_real_ip_from 188.114.96.0/20;

	set_real_ip_from 190.93.240.0/20;

	set_real_ip_from 197.234.240.0/22;

	set_real_ip_from 198.41.128.0/17;

	set_real_ip_from 2400:cb00::/32;

	set_real_ip_from 2606:4700::/32;

	set_real_ip_from 2803:f800::/32;

	set_real_ip_from 2405:b500::/32;

	set_real_ip_from 2405:8100::/32;

	set_real_ip_from 2c0f:f248::/32;

	set_real_ip_from 2a06:98c0::/29;

	# Use real IPs

	real_ip_header CF-Connecting-IP;

	#real_ip_header X-Forwarded-For;

	# OCSP Stapling

	ssl_stapling on;

	ssl_stapling_verify on;

	resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s;

	resolver_timeout 2s;

	# SSL PCI Compliance

	ssl_session_timeout 1d;

	ssl_session_cache shared:SSL:10m;

	ssl_session_tickets off;

	ssl_protocols TLSv1.2 TLSv1.3;

	ssl_prefer_server_ciphers on;

	ssl_ecdh_curve X25519:prime256v1:secp384r1;

	# Server Side TLS

	# SSL/TLS Configuration Generator

	# https://mozilla.github.io/server-side-tls/ssl-config-generator/

	# Oldest compatible clients

	# Firefox 1, Chrome 1, IE 8 on Windows 7, Opera 5, Safari 1, Android 2.3, Java 7

	ssl_ciphers "ECDHE+CHACHA20:ECDHE+AESGCM:DHE+AESGCM:ECDHE+AES:DHE+AES:RSA+AESGCM:RSA+AES:!DES-CBC3-SHA:!DSS";

	# DH parameter for Perfect Forward Secrecy

	# openssl dhparam -dsaparam -out /etc/ssl/dhparam.pem 4096

	ssl_dhparam /etc/ssl/dhparam.pem;

	# Various security headers

	add_header X-Frame-Options           "SAMEORIGIN";

	add_header X-XSS-Protection          "1; mode=block";

	add_header X-Content-Type-Options    "nosniff";

	add_header Referrer-Policy           "no-referrer-when-downgrade";

	add_header Content-Security-Policy   "default-src 'self' http: https: data: blob: 'unsafe-inline'";

	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

	# Error pages

	error_page 403		/var/www/error/403.html;

	error_page 404		/var/www/error/404.html;

	error_page 502 503 504	/var/www/error/500.html;

	# Cache

	proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=512m;

	proxy_cache_key md5("$host$request_uri$cookie_user");

	proxy_temp_path /var/cache/nginx/temp;

	proxy_ignore_headers X-Accel-Expires Expires Cache-Control;

	proxy_cache_use_stale error timeout invalid_header updating http_502;

	proxy_cache_valid any 24h;

	proxy_cache_bypass $http_upgrade;

	# Cache bypass

	map $http_cookie $no_cache {

		default 0;

		~SESS 1;

		~wordpress_logged_in 1;

	}

	# File cache settings

	open_file_cache max=10000 inactive=30s;

	open_file_cache_valid 60s;

	open_file_cache_min_uses 2;

	open_file_cache_errors off;

	# ModSecurity

	#modsecurity on;

	#modsecurity_rules_file /etc/nginx/modsec/main.conf;

	# Wildcard include

	include /etc/nginx/conf.d/http/*.conf;

}

stream {

	resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s;

	resolver_timeout 2s;

	# Wildcard include

	include /etc/nginx/conf.d/stream/*.conf;

}
view raw
nginx.conf
hosted with ❤ by GitHub
/etc/nginx/conf.d/http/letsencrypt.conf
https://gist.github.com/bouroo/fb391e2de7fa05a0d528031b97728cef#file-letsencrypt-conf
/etc/nginx/conf.d/http/web.conf
https://gist.github.com/bouroo/fb391e2de7fa05a0d528031b97728cef#file-web-conf
/etc/nginx/conf.d/stream/mariadb.conf
https://gist.github.com/bouroo/fb391e2de7fa05a0d528031b97728cef#file-mariadb-conf
Tag: nginx

nginx prevent process undefined server names

HPKP with letsencrypt and nginx

nginx rtmp dynamic module

nginx config
