diff --git a/ArchLinux/static/nginx.conf b/ArchLinux/static/nginx.conf new file mode 100644 index 0000000..bed5634 --- /dev/null +++ b/ArchLinux/static/nginx.conf @@ -0,0 +1,120 @@ +# Suggestions? => https://github.com/theraw/The-World-Is-Yours/issues +# Problems? => https://github.com/theraw/The-World-Is-Yours/issues +# Errors? => https://github.com/theraw/The-World-Is-Yours/issues +user root; +worker_processes auto; +worker_rlimit_nofile 65535; +events { + multi_accept on; + use epoll; + worker_connections 65535; +} + +http { + # ////////////////////////////////////////////////////// # + # =================== START L7 ========================= # + # turn this 'on' if you want to use L7 For every domain hosted in your server + testcookie off; + testcookie_name DOPEHOSTING; + testcookie_secret random; + testcookie_session $remote_addr; + #testcookie_arg GO; + testcookie_httponly_flag on; + testcookie_max_attempts 3; + testcookie_secure_flag on; + testcookie_get_only on; + testcookie_p3p 'CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"'; + testcookie_fallback /cookies.html?backurl=$scheme://$host$request_uri; + + # Those are some ip's whitelisted by me. mostly are search engines. But not everything! + testcookie_whitelist { + 8.8.8.8/32; + 127.0.0.1/32; + # I don't suggest using alot of IPs here as this whitelist can fail!. + } + testcookie_redirect_via_refresh on; + testcookie_refresh_encrypt_cookie on; + testcookie_refresh_encrypt_cookie_key random; + testcookie_refresh_encrypt_cookie_iv random; + testcookie_refresh_template 'Just a moment please... '; + # ===================== END L7 ========================= # + # ////////////////////////////////////////////////////// # + + # ////////////////////////////////////////////////////// # + # ===================== LOGS =========================== # + log_format main '$remote_addr |==| $status |==| $request |==| $time_local'; + # -------------------------------------------------------# + log_format agent '$remote_addr |==| $status |==| $request |==| $http_user_agent'; + # -------------------------------------------------------# + log_format full '$remote_addr |==| $remote_user |==| $time_local |==| $request |==| $status |==| $body_bytes_sent |==| $http_referer |==| $http_user_agent |==| $http_x_forwarded_for'; + # =================== END LOGS ========================= # + # ////////////////////////////////////////////////////// # + + # ////////////////////////////////////////////////////// # + # ===================== GEIP =========================== # + geoip2 /nginx/db/GeoLite2-Country.mmdb { + $geoip2_data_country_code default=US country iso_code; + $geoip2_data_country_name country names en; + } + + # EX Ban China! + #map $geoip2_data_country_code $allowed_country { + # default yes; + # CN no; + #} + # =================== END GEIP ========================= # + # ////////////////////////////////////////////////////// # + + # ////////////////////////////////////////////////////// # + # ===================== EXTRA ========================== # + # Don't Go with "Nginx Can Handle Everything" ! + limit_conn_zone $server_name zone=max:1m; + limit_req_zone $binary_remote_addr zone=one:1m rate=1r/s; + # =================== END EXTRA ======================== # + # ////////////////////////////////////////////////////// # + + # ////////////////////////////////////////////////////// # + # ==================== BACKENDS ======================== # + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + # Example Of Backend + #upstream varnish { + # zone tcp_servers 64k; + # server 10.10.10.39:80; + #} + # =================== END BACKENDS ===================== # + # ////////////////////////////////////////////////////// # + + # ////////////////////////////////////////////////////// # + # ==================== GENERAL ========================= # + client_body_buffer_size 1M; + client_header_buffer_size 1M; + client_body_timeout 90s; + client_header_timeout 90s; + client_max_body_size 2M; + keepalive_timeout 10s; + port_in_redirect off; + sendfile on; + server_names_hash_bucket_size 6969; + server_name_in_redirect off; + server_tokens off; + tcp_nodelay on; + tcp_nopush on; + types_hash_max_size 2048; + resolver 8.8.8.8 8.8.4.4; + default_type application/octet-stream; + include /nginx/mime.types; + # =================== END GENERAL ====================== # + # ////////////////////////////////////////////////////// # + + # ////////////////////////////////////////////////////// # + # =================== LOAD CONFIGS ===================== # + include /nginx/live/*; + include /nginx/conf.d/*; + include /nginx/naxsi_core.rules; + # =================== END CONFIGS ====================== # + # ////////////////////////////////////////////////////// # +}