diff --git a/conf/nginx.conf b/conf/nginx.conf index 29bc085..2762269 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -1,36 +1,219 @@ - -#user nobody; -worker_processes 1; +user www www; +worker_processes 1; #error_log logs/error.log; #error_log logs/error.log notice; #error_log logs/error.log info; -#pid logs/nginx.pid; - +pcre_jit on; events { - worker_connections 1024; + use epoll; + multi_accept on; + worker_connections 1024; + + # accept_mutex off; + # accept_mutex_delay 50ms; } - http { - include mime.types; - default_type application/octet-stream; + include koi-utf; + charset utf-8; + charset_types text/xml text/plain text/vnd.wap.wml + application/javascript application/x-javascript + application/rss+xml text/css; + override_charset on; - #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - # '$status $body_bytes_sent "$http_referer" ' - # '"$http_user_agent" "$http_x_forwarded_for"'; + map_hash_bucket_size 256; + map_hash_max_size 4096; + server_names_hash_bucket_size 128; + server_names_hash_max_size 2048; + variables_hash_max_size 2048; - #access_log logs/access.log main; + # Cloudflare CDN + set_real_ip_from 199.27.128.0/21; + set_real_ip_from 173.245.48.0/20; + set_real_ip_from 103.21.244.0/22; + set_real_ip_from 103.22.200.0/22; + set_real_ip_from 103.31.4.0/22; + set_real_ip_from 141.101.64.0/18; + set_real_ip_from 108.162.192.0/18; + set_real_ip_from 190.93.240.0/20; + set_real_ip_from 188.114.96.0/20; + set_real_ip_from 197.234.240.0/22; + set_real_ip_from 198.41.128.0/17; + set_real_ip_from 162.158.0.0/15; + set_real_ip_from 104.16.0.0/12; + #set_real_ip_from 2400:cb00::/32; + #set_real_ip_from 2606:4700::/32; + #set_real_ip_from 2803:f800::/32; + #set_real_ip_from 2405:b500::/32; + #set_real_ip_from 2405:8100::/32; + real_ip_header CF-Connecting-IP; - sendfile on; - #tcp_nopush on; + # SSL Config + strict_sni on; + strict_sni_header on; + ssl_dyn_rec_enable on; + ssl_early_data on; - #keepalive_timeout 0; - keepalive_timeout 65; + ## SSL OCSP Stapling + resolver 1.1.1.1 1.0.0.1 valid=86400s ipv6=off; + resolver_timeout 15s; + ssl_stapling on; + ssl_stapling_verify on; - #gzip on; + include mime.types; + default_type application/octet-stream; + sendfile on; + server_tokens off; + tcp_nopush on; + tcp_nodelay on; + + # HTTP2 PUSH + #http2_push on; + #http2_push_preload on; + + client_header_timeout 45s; # 45s = 45s + client_body_timeout 450s; # 450s = 7m 30s + send_timeout 45s; # 45s = 45s + + log_not_found off; + + open_file_cache max=50000 inactive=60s; + open_file_cache_valid 120s; + open_file_cache_min_uses 2; + open_file_cache_errors off; + open_log_file_cache max=10000 inactive=30s min_uses=2; + + # Keepalive timeout + keepalive_timeout 60s; + keepalive_requests 15000; + lingering_time 60s; + lingering_close on; + lingering_timeout 10s; + keepalive_disable msie6; + + # php upload size + client_max_body_size 4G; # 4GB = 4096MB + + # Brotli compression + brotli on; + brotli_static on; + brotli_min_length 150; + brotli_window 16m; + brotli_buffers 2048 4k; + brotli_comp_level 6; + brotli_types text/richtext + text/plain + text/css + text/x-script + text/x-component + text/x-java-source + application/javascript + application/x-javascript + text/javascript + text/js + image/x-icon + application/x-perl + application/x-httpd-cgi + text/xml + application/xml + application/rss+xml + application/json + multipart/bag + multipart/mixed + application/xhtml+xml + font/ttf + font/otf + font/woff + font/woff2 + image/svg+xml + application/vnd.ms-fontobject + application/ttf + application/x-ttf + application/otf + application/x-otf + application/x-font-ttf + application/x-font-truetype + application/x-font-opentype + application/x-opentype + application/woff + application/eot + application/font + application/font-woff + application/font-woff2 + application/x-font-woff2 + application/font-sfnt; + + # gzip compression + gzip on; + gzip_comp_level 9; + gzip_static on; + gzip_vary on; + gzip_proxied any; + gzip_min_length 150; + gzip_buffers 2048 4k; + gzip_http_version 1.1; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types text/richtext + text/plain + text/css + text/x-script + text/x-component + text/x-java-source + application/javascript + application/x-javascript + text/javascript + text/js + image/x-icon + application/x-perl + application/x-httpd-cgi + text/xml + application/xml + application/rss+xml + application/json + multipart/bag + multipart/mixed + application/xhtml+xml + font/ttf + font/otf + font/woff + font/woff2 + image/svg+xml + application/vnd.ms-fontobject + application/ttf + application/x-ttf + application/otf + application/x-otf + application/x-font-ttf + application/x-font-truetype + application/x-font-opentype + application/x-opentype + application/woff + application/eot + application/font + application/font-woff + application/font-woff2 + application/x-font-woff2 + application/font-sfnt; + gzip_disable "MSIE [1-6].(?!.*SV1)"; + + # GeoIP2 + #geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb { + # $geoip2_metadata_country_build metadata build_epoch; + # $geoip2_data_country_code default=US source=$remote_addr country iso_code; + # $geoip2_data_country_name country names en; + #} + + #geoip2 /usr/share/GeoIP/GeoLite2-City.mmdb { + # $geoip2_data_city_name default=London city names en; + # $geoip2_data_continent_name default=Europe continent names en; + # $geoip2_data_subdivisions_name default=London subdivisions 0 names en; + #} + + # index + index index.html index.htm index.php; server { listen 80; @@ -78,21 +261,6 @@ http { #} } - - # another virtual host using mix of IP-, name-, and port-based configuration - # - #server { - # listen 8000; - # listen somename:8080; - # server_name somename alias another.alias; - - # location / { - # root html; - # index index.html index.htm; - # } - #} - - # HTTPS server # #server { @@ -102,16 +270,13 @@ http { # ssl_certificate cert.pem; # ssl_certificate_key cert.key; - # ssl_session_cache shared:SSL:1m; - # ssl_session_timeout 5m; - - # ssl_ciphers HIGH:!aNULL:!MD5; - # ssl_prefer_server_ciphers on; + # ssl_session_cache shared:SSL:20m; + # ssl_session_timeout 1d; + # ssl_session_tickets on; # location / { # root html; # index index.html index.htm; # } #} - }