Sanitized full NGINX Configuration Snippets
This does not include individual site confs and headers but rather global configurations. Its also not a full configuration but rather pieces people might find helpful
Init block
## Initialize and Load Modules
user nginx;
worker_processes 4;
worker_rlimit_nofile 65535;
error_log /var/log/nginx.error_log info;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;
## Events Block
events {
worker_connections 8192;
multi_accept on;
use epoll;
}
In the HTTP block
Note that I have turned off global compression
....
# Rate Limitng
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
# Web Proxy MIME Types
include /etc/nginx/mime.types;
default_type application/octet-stream;
types_hash_max_size 4096;
# Web Proxy Logging
log_format main '$remote_addr - $remote_user [$time_local] '
'"$request" $status $bytes_sent '
'"$http_referer" "$http_user_agent" '
'"$gzip_ratio"';
access_log /var/log/nginx.access_log main;
# Web Proxy Send Settings
sendfile on;
sendfile_max_chunk 256m;
# Web Proxy Timeout Settings
proxy_connect_timeout 120;
proxy_send_timeout 120;
proxy_read_timeout 120;
send_timeout 10;
reset_timedout_connection on;
keepalive_timeout 15;
# Web Proxy Client Settings
client_body_buffer_size 16K;
client_header_buffer_size 4k;
client_max_body_size 100G;
client_body_timeout 12;
client_header_timeout 12;
large_client_header_buffers 4 4k;
# Web Proxy TCP and Tokens Settings
tcp_nopush on;
tcp_nodelay on;
server_tokens off;
# Web Proxy SSL Settings
ssl_certificate /etc/nginx/ssl/<MY-TLD>/cert.crt;
ssl_certificate_key /etc/nginx/ssl/<MY-TLD>/privkey.key;
ssl_dhparam /etc/nginx/ssl/<MY-TLD>/dhparam.pem;
ssl_trusted_certificate /etc/nginx/ssl/<MY-TLD>/cert.crt;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers !AES128:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_ecdh_curve secp521r1:secp384r1;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL7:30m;
ssl_session_timeout 30m;
ssl_stapling on;
ssl_stapling_verify on;
ssl_ocsp on;
ssl_verify_client off;
ssl_conf_command Options PrioritizeChaCha;
ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256;
# Web Proxy Mandatory Headers
add_header Strict-Transport-Security "max-age=94608000; includeSubDomains; preload";
add_header Clear-Site-Data "*";
add_header X-Powered-By "Black Jack and Hookers" always; # TOP LOL
add_header X-Provided-By "Sweet Sweeeeet Walls" always; # TOP LOL
# Web Proxy Compression Settings
gzip off;
# Web Server Base Settings
include /etc/nginx/conf.d/*.conf;
server {
listen 80;
listen [::]:80;
server_name _;
include /etc/nginx/ErrorPages/error_pages.conf;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name _;
include /etc/nginx/ErrorPages/error_pages.conf;
}
...
In the Stream Block
...
# Socket Proxy Logging and Includes
log_format socket_main '$remote_addr - [$time_local] '
'"$status $bytes_sent';
access_log /var/log/nginx/socket_access.log socket_main;
error_log /var/log/nginx/error_log warn;
include /etc/nginx/stream.d/*.conf;
# Socket Proxy SSL Settings
ssl_certificate /etc/nginx/ssl/<My-TLD>/cert.crt;
ssl_certificate_key /etc/nginx/ssl/<My-TLD>/privkey.key;
ssl_dhparam /etc/nginx/ssl/<My-TLD>/dhparam.pem;
ssl_trusted_certificate /etc/nginx/ssl/<My-TLD>/cert.crt;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers !AES128:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_ecdh_curve secp521r1:secp384r1;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL4:15m;
ssl_session_timeout 15m;
...