133 lines
5.9 KiB
Nginx Configuration File
133 lines
5.9 KiB
Nginx Configuration File
user nginx;
|
|
pid /run/nginx.pid;
|
|
worker_processes auto;
|
|
worker_cpu_affinity auto;
|
|
worker_rlimit_nofile 65535;
|
|
|
|
events {
|
|
multi_accept on;
|
|
use epoll;
|
|
worker_connections 65535;
|
|
}
|
|
|
|
http {
|
|
# =================== LOAD LUA ========================= #
|
|
lua_package_path "/usr/nginx_lua/lib/lua/?.lua;;";
|
|
lua_package_cpath "/usr/nginx_lua/lib/lua/5.1/?.so;;";
|
|
# =================== END LUA ========================== #
|
|
|
|
# =================== LOAD L7 ========================== #
|
|
include modsec/l7.conf;
|
|
# =================== END L7 =========================== #
|
|
|
|
# ===================== LOGS =========================== #
|
|
map $upstream_cache_status $log_cache_status {
|
|
"" "STATIC";
|
|
default $upstream_cache_status;
|
|
}
|
|
more_set_headers "X-Cache-Status: $log_cache_status";
|
|
log_format main 'DATE: $time_local FROM: $remote_addr | STATUS: $status | TO: $request | CACHE: $log_cache_status | A: $http_user_agent';
|
|
# =================== END LOGS ========================= #
|
|
|
|
# ==================== GENERAL ========================= #
|
|
client_header_buffer_size 8k;
|
|
large_client_header_buffers 8 16k;
|
|
client_body_buffer_size 16k;
|
|
client_max_body_size 2M;
|
|
client_body_timeout 30s;
|
|
client_header_timeout 30s;
|
|
send_timeout 30s;
|
|
reset_timedout_connection on;
|
|
keepalive_timeout 65s;
|
|
keepalive_requests 2000;
|
|
max_headers 100;
|
|
port_in_redirect off;
|
|
sendfile on;
|
|
sendfile_max_chunk 1m;
|
|
tcp_nodelay on;
|
|
tcp_nopush on;
|
|
server_tokens off;
|
|
server_name_in_redirect off;
|
|
|
|
server_names_hash_bucket_size 128;
|
|
server_names_hash_max_size 32768;
|
|
types_hash_max_size 4096;
|
|
|
|
# File metadata cache — biggest single win for static-heavy shared hosting.
|
|
open_file_cache max=200000 inactive=30s;
|
|
open_file_cache_valid 30s;
|
|
open_file_cache_min_uses 2;
|
|
open_file_cache_errors on;
|
|
|
|
# Symlink backstop for tenant_isolation, checked at the serving open(): catches
|
|
# the probe->open race and the paths the patch skips (gzip_static, autoindex,
|
|
# dav, mp4/flv). if_not_owner allows a tenant's own symlinks, blocks ones whose
|
|
# target has a different owner (docroot/x -> /etc/passwd => 403).
|
|
disable_symlinks if_not_owner from=$document_root;
|
|
|
|
# ===================== TLS ============================ #
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_session_cache shared:SSL:200m;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_tickets off;
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
|
|
# Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch).
|
|
# Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS
|
|
# overhead once the connection is past head-of-line blocking.
|
|
# INVARIANT: ssl_dyn_rec_size_lo/hi must never exceed ssl_buffer_size. The
|
|
# SSL buffer is allocated at ssl_buffer_size bytes, but the patch points
|
|
# buf->end at buf->start + size_hi -- a larger size_hi makes the copy loop
|
|
# memcpy response body past the end of that allocation and over adjacent
|
|
# nginx pools. Hit in production 2026-08-20: ssl_buffer_size 4k against
|
|
# size_hi 4229 overflowed by 133 bytes and crashed workers in unrelated
|
|
# code (ngx_http_v2_handle_frame, ngx_destroy_pool). The patch now clamps
|
|
# with ngx_min() so this is fail-safe, but exceeding it still silently caps
|
|
# records at ssl_buffer_size and wastes the ramp these values buy.
|
|
# ssl_buffer_size is NOT set here -- it lives in ssl.conf (outside this
|
|
# repo) and is settable per server block, so a single vhost can lower it.
|
|
ssl_dyn_rec_enable on;
|
|
ssl_dyn_rec_size_lo 1369;
|
|
ssl_dyn_rec_size_hi 4229;
|
|
ssl_dyn_rec_threshold 40;
|
|
ssl_dyn_rec_timeout 1000;
|
|
# ===================== END TLS ======================== #
|
|
resolver 1.1.1.1 1.0.0.1 valid=300s;
|
|
resolver_timeout 5s;
|
|
default_type application/octet-stream;
|
|
include /nginx/mime.types;
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
# ==================== COMPRESSION ===================== #
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_proxied any;
|
|
gzip_comp_level 4;
|
|
gzip_min_length 256;
|
|
gzip_types text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss application/atom+xml image/svg+xml font/ttf font/otf font/woff font/woff2;
|
|
|
|
brotli on;
|
|
brotli_comp_level 4;
|
|
brotli_min_length 256;
|
|
brotli_types text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss application/atom+xml image/svg+xml font/ttf font/otf font/woff font/woff2;
|
|
|
|
zstd on;
|
|
zstd_comp_level 4;
|
|
zstd_min_length 256;
|
|
zstd_types text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss application/atom+xml image/svg+xml font/ttf font/otf font/woff font/woff2;
|
|
# =================== END COMPRESSION ================== #
|
|
# =================== END GENERAL ====================== #
|
|
|
|
# ================ LOAD VHOST +CONFIGS ================= #
|
|
include live/*;
|
|
include conf.d/*;
|
|
include modsec/naxi.core;
|
|
# =================== END CONFIGS ====================== #
|
|
}
|