root
116 lines
4.7 KiB
Nginx Configuration File
116 lines
4.7 KiB
Nginx Configuration File
user nginx;
|
|
pid /run/nginx.pid;
|
|
worker_processes auto;
|
|
worker_cpu_affinity auto;
|
|
worker_rlimit_nofile 65535;
|
|
|
|
events {
|
|
multi_accept on;
|
|
use epoll;
|
|
worker_connections 65535;
|
|
}
|
|
|
|
http {
|
|
# =================== LOAD LUA ========================= #
|
|
lua_package_path "/usr/nginx_lua/lib/lua/?.lua;;";
|
|
lua_package_cpath "/usr/nginx_lua/lib/lua/5.1/?.so;;";
|
|
# =================== END LUA ========================== #
|
|
|
|
# =================== LOAD L7 ========================== #
|
|
include modsec/l7.conf;
|
|
# =================== END L7 =========================== #
|
|
|
|
# ===================== LOGS =========================== #
|
|
map $upstream_cache_status $log_cache_status {
|
|
"" "STATIC";
|
|
default $upstream_cache_status;
|
|
}
|
|
more_set_headers "X-Cache-Status: $log_cache_status";
|
|
log_format main 'DATE: $time_local FROM: $remote_addr | STATUS: $status | TO: $request | CACHE: $log_cache_status | A: $http_user_agent';
|
|
# =================== END LOGS ========================= #
|
|
|
|
# ==================== GENERAL ========================= #
|
|
client_header_buffer_size 4k;
|
|
large_client_header_buffers 4 16k;
|
|
client_body_buffer_size 16k;
|
|
client_max_body_size 2M;
|
|
client_body_timeout 30s;
|
|
client_header_timeout 30s;
|
|
send_timeout 30s;
|
|
reset_timedout_connection on;
|
|
keepalive_timeout 65s;
|
|
keepalive_requests 2000;
|
|
max_headers 100;
|
|
port_in_redirect off;
|
|
sendfile on;
|
|
sendfile_max_chunk 1m;
|
|
tcp_nodelay on;
|
|
tcp_nopush on;
|
|
server_tokens off;
|
|
server_name_in_redirect off;
|
|
|
|
server_names_hash_bucket_size 128;
|
|
server_names_hash_max_size 32768;
|
|
types_hash_max_size 4096;
|
|
|
|
# File metadata cache — biggest single win for static-heavy shared hosting.
|
|
open_file_cache max=200000 inactive=30s;
|
|
open_file_cache_valid 30s;
|
|
open_file_cache_min_uses 2;
|
|
open_file_cache_errors on;
|
|
|
|
# ===================== TLS ============================ #
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_session_cache shared:SSL:200m;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_tickets off;
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
|
|
# Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch).
|
|
# Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS
|
|
# overhead once the connection is past head-of-line blocking.
|
|
ssl_dyn_rec_enable on;
|
|
ssl_dyn_rec_size_lo 1369;
|
|
ssl_dyn_rec_size_hi 4229;
|
|
ssl_dyn_rec_threshold 40;
|
|
ssl_dyn_rec_timeout 1000;
|
|
# ===================== END TLS ======================== #
|
|
resolver 1.1.1.1 1.0.0.1 valid=300s;
|
|
resolver_timeout 5s;
|
|
default_type application/octet-stream;
|
|
include /nginx/mime.types;
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
# ==================== COMPRESSION ===================== #
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_proxied any;
|
|
gzip_comp_level 4;
|
|
gzip_min_length 256;
|
|
gzip_types text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss application/atom+xml image/svg+xml font/ttf font/otf font/woff font/woff2;
|
|
|
|
brotli on;
|
|
brotli_comp_level 4;
|
|
brotli_min_length 256;
|
|
brotli_types text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss application/atom+xml image/svg+xml font/ttf font/otf font/woff font/woff2;
|
|
|
|
zstd on;
|
|
zstd_comp_level 4;
|
|
zstd_min_length 256;
|
|
zstd_types text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss application/atom+xml image/svg+xml font/ttf font/otf font/woff font/woff2;
|
|
# =================== END COMPRESSION ================== #
|
|
# =================== END GENERAL ====================== #
|
|
|
|
# ================ LOAD VHOST +CONFIGS ================= #
|
|
include live/*;
|
|
include conf.d/*;
|
|
include modsec/naxi.core;
|
|
# =================== END CONFIGS ====================== #
|
|
}
|