user www www;
worker_processes 1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

pcre_jit on;

events {
    use epoll;
    multi_accept on;
    worker_connections 1024;

    # accept_mutex off;
    # accept_mutex_delay 50ms;
}

http {
    include koi-utf;
    charset utf-8;
    charset_types text/xml text/plain text/vnd.wap.wml
                  application/javascript application/x-javascript
                  application/rss+xml text/css;
    override_charset on;

    map_hash_bucket_size 256;
    map_hash_max_size 4096;
    server_names_hash_bucket_size 128;
    server_names_hash_max_size 2048;
    variables_hash_max_size 2048;

    # Cloudflare CDN
    set_real_ip_from   199.27.128.0/21;
    set_real_ip_from   173.245.48.0/20;
    set_real_ip_from   103.21.244.0/22;
    set_real_ip_from   103.22.200.0/22;
    set_real_ip_from   103.31.4.0/22;
    set_real_ip_from   141.101.64.0/18;
    set_real_ip_from   108.162.192.0/18;
    set_real_ip_from   190.93.240.0/20;
    set_real_ip_from   188.114.96.0/20;
    set_real_ip_from   197.234.240.0/22;
    set_real_ip_from   198.41.128.0/17;
    set_real_ip_from   162.158.0.0/15;
    set_real_ip_from   104.16.0.0/12;
    #set_real_ip_from   2400:cb00::/32;
    #set_real_ip_from   2606:4700::/32;
    #set_real_ip_from   2803:f800::/32;
    #set_real_ip_from   2405:b500::/32;
    #set_real_ip_from   2405:8100::/32;
    real_ip_header     CF-Connecting-IP;

    # SSL Config
    strict_sni on;
    strict_sni_header on;
    ssl_dyn_rec_enable on;
    ssl_early_data on;

    ## SSL OCSP Stapling
    resolver 1.1.1.1 1.0.0.1 valid=86400s ipv6=off;
    resolver_timeout 15s;
    ssl_stapling on;
    ssl_stapling_verify on;

    include mime.types;
    default_type application/octet-stream;
    sendfile on;
    server_tokens off;
    tcp_nopush on;
    tcp_nodelay on;

    # HTTP2 PUSH
    #http2_push on;
    #http2_push_preload on;

    client_header_timeout  45s;  # 45s = 45s
    client_body_timeout    450s; # 450s = 7m 30s
    send_timeout           45s;  # 45s = 45s

    log_not_found off;

    open_file_cache max=50000 inactive=60s;
    open_file_cache_valid 120s;
    open_file_cache_min_uses 2;
    open_file_cache_errors off;
    open_log_file_cache max=10000 inactive=30s min_uses=2;

    # Keepalive timeout
    keepalive_timeout 60s;
    keepalive_requests 15000;
    lingering_time 60s;
    lingering_close on;
    lingering_timeout 10s;
    keepalive_disable msie6;

    # php upload size
    client_max_body_size 4G; # 4GB = 4096MB

    # Brotli compression
    brotli on;
    brotli_static on;
    brotli_min_length 150;
    brotli_window 16m;
    brotli_buffers 2048 4k;
    brotli_comp_level 6;
    brotli_types text/richtext
                 text/plain
                 text/css
                 text/x-script
                 text/x-component
                 text/x-java-source
                 application/javascript
                 application/x-javascript
                 text/javascript
                 text/js
                 image/x-icon
                 application/x-perl
                 application/x-httpd-cgi
                 text/xml
                 application/xml
                 application/rss+xml
                 application/json
                 multipart/bag
                 multipart/mixed
                 application/xhtml+xml
                 font/ttf
                 font/otf
                 font/woff
                 font/woff2
                 image/svg+xml
                 application/vnd.ms-fontobject
                 application/ttf
                 application/x-ttf
                 application/otf
                 application/x-otf
                 application/x-font-ttf
                 application/x-font-truetype
                 application/x-font-opentype
                 application/x-opentype
                 application/woff
                 application/eot
                 application/font
                 application/font-woff
                 application/font-woff2
                 application/x-font-woff2
                 application/font-sfnt;

    # gzip compression
    gzip on;
    gzip_comp_level 9;
    gzip_static on;
    gzip_vary on;
    gzip_proxied any;
    gzip_min_length 150;
    gzip_buffers 2048 4k;
    gzip_http_version 1.1;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types text/richtext
               text/plain
               text/css
               text/x-script
               text/x-component
               text/x-java-source
               application/javascript
               application/x-javascript
               text/javascript
               text/js
               image/x-icon
               application/x-perl
               application/x-httpd-cgi
               text/xml
               application/xml
               application/rss+xml
               application/json
               multipart/bag
               multipart/mixed
               application/xhtml+xml
               font/ttf
               font/otf
               font/woff
               font/woff2
               image/svg+xml
               application/vnd.ms-fontobject
               application/ttf
               application/x-ttf
               application/otf
               application/x-otf
               application/x-font-ttf
               application/x-font-truetype
               application/x-font-opentype
               application/x-opentype
               application/woff
               application/eot
               application/font
               application/font-woff
               application/font-woff2
               application/x-font-woff2
               application/font-sfnt;
    gzip_disable "MSIE [1-6].(?!.*SV1)";

    # GeoIP2
    #geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
    #    $geoip2_metadata_country_build metadata build_epoch;
    #    $geoip2_data_country_code default=US source=$remote_addr country iso_code;
    #    $geoip2_data_country_name country names en;
    #}

    #geoip2 /usr/share/GeoIP/GeoLite2-City.mmdb {
    #    $geoip2_data_city_name default=London city names en;
    #    $geoip2_data_continent_name default=Europe continent names en;
    #    $geoip2_data_subdivisions_name default=London subdivisions 0 names en;
    #}

    # index
    index index.html index.htm index.php;

    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
            root   html;
            index  index.html index.htm;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }

    # HTTPS server
    #
    #server {
    #    listen       443 ssl http2;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:20m;
    #    ssl_session_timeout  1d;
    #    ssl_session_tickets  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}
}
