From 3cc83dd746775f66375335ef2d12e4d0445fd133 Mon Sep 17 00:00:00 2001 From: ervin Date: Fri, 22 Dec 2023 12:44:30 +0100 Subject: [PATCH] =?UTF-8?q?'nginx.conf'=20hozz=C3=A1ad=C3=A1sa?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- nginx.conf | 116 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 nginx.conf diff --git a/nginx.conf b/nginx.conf new file mode 100644 index 0000000..fa11191 --- /dev/null +++ b/nginx.conf @@ -0,0 +1,116 @@ + +# Server globals +user www-data; +worker_processes auto; +worker_rlimit_nofile 65535; + +error_log /var/log/nginx/error.log notice; +pid /var/run/nginx.pid; + +# Worker config +events { + worker_connections 1024; + use epoll; + multi_accept on; +} + + +http { + # Main settings + sendfile on; + tcp_nopush on; + tcp_nodelay on; + client_header_timeout 180s; + client_body_timeout 180s; + client_header_buffer_size 2k; + client_body_buffer_size 256k; + client_max_body_size 1024m; + large_client_header_buffers 4 8k; + send_timeout 60s; + keepalive_timeout 30s; + keepalive_requests 10000; + reset_timedout_connection on; + server_tokens off; + server_name_in_redirect off; + server_names_hash_max_size 512; + server_names_hash_bucket_size 512; + charset utf-8; + # FastCGI settings + fastcgi_buffers 512 4k; + fastcgi_buffer_size 256k; + fastcgi_busy_buffers_size 256k; + fastcgi_temp_file_write_size 256k; + fastcgi_connect_timeout 30s; + fastcgi_read_timeout 300s; + fastcgi_send_timeout 180s; + fastcgi_cache_lock on; + fastcgi_cache_lock_timeout 5s; + fastcgi_cache_background_update on; + fastcgi_cache_revalidate on; + # Proxy settings + proxy_redirect off; + proxy_set_header Host $host; + # proxy_set_header Early-Data $rfc_early_data; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + set_real_ip_from 172.18.0.0/16; + proxy_pass_header Set-Cookie; + proxy_buffers 256 4k; + proxy_buffer_size 32k; + proxy_busy_buffers_size 32k; + proxy_temp_file_write_size 256k; + proxy_connect_timeout 30s; + proxy_read_timeout 300s; + proxy_send_timeout 180s; + # log_not_found off; + # Mime settings + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + # Compression + gzip on; + gzip_vary on; + gzip_static on; + gzip_comp_level 6; + gzip_min_length 1024; + gzip_buffers 128 4k; + gzip_http_version 1.1; + gzip_types text/css text/javascript text/js text/plain text/richtext text/shtml text/x-component text/x-java-source text/x-markdown text/x-script text/xml image/bmp image/svg+xml image/vnd.microsoft.icon image/x-icon font/otf font/ttf font/x-woff multipart/bag multipart/mixed application/eot application/font application/font-sfnt application/font-woff application/javascript application/javascript-binast application/json application/ld+json application/manifest+json application/opentype application/otf application/rss+xml application/ttf application/truetype application/vnd.api+json application/vnd.ms-fontobject application/wasm application/xhtml+xml application/xml application/xml+rss application/x-httpd-cgi application/x-javascript application/x-opentype application/x-otf application/x-perl application/x-protobuf application/x-ttf; + gzip_proxied any; + # SSL PCI compliance + ssl_buffer_size 1369; + ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256"; + ssl_dhparam /etc/ssl/dhparam.pem; + ssl_early_data on; + ssl_ecdh_curve auto; + ssl_prefer_server_ciphers on; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_session_cache shared:SSL:20m; + ssl_session_tickets on; + ssl_session_timeout 7d; + resolver 1.0.0.1 8.8.4.4 1.1.1.1 8.8.8.8 valid=300s ipv6=off; + resolver_timeout 5s; + # Error pages + error_page 403 /error/404.html; + error_page 404 /error/404.html; + error_page 410 /error/410.html; + error_page 500 501 502 503 504 505 /error/50x.html; + # Cache bypass + map $http_cookie $no_cache { + default 0; + ~SESS 1; + ~wordpress_logged_in 1; + } + + # Webp felismerése + map $http_accept $is_webp { + "~*webp" ".webp"; + } + + include /etc/nginx/conf.d/*.conf; +}