nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    resolver 1.1.1.1;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    proxy_cache_path /var/cache/nginx/ keys_zone=cache:20m inactive=1y max_size=30g;

    server {
        server_name media.mastodong.lol;
        listen [2602:fe90:2:5dd::368d]:80;
        listen [2602:fe90:2:5dd::368d]:443 ssl http2;
        listen 2.56.173.221:80;
        listen 2.56.173.221:443 ssl http2;

        #listen [::]:80;
        #listen [::]:443 ssl http2;
        #listen 0.0.0.0:80;
        #listen 0.0.0.0:443 ssl http2;

        ssl_certificate /etc/letsencrypt/live/media.mastodong.lol/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/media.mastodong.lol/privkey.pem;

        location /.well-known/ {
            root /var/www/html/;
            try_files $uri =404;
        }

        location = /system/site_uploads/files/000/000/002/@1x/1ee66ad374404372.png {
            return 301 https://files.catbox.moe/nd6pyz.webp;
        }

        location /system {
            limit_except GET {
                deny all;
            }

            proxy_ssl_server_name on;
            proxy_set_header Host mastodong.lol;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass https://mastodong.lol$request_uri;
            proxy_intercept_errors off;

            proxy_cache cache;
            proxy_cache_valid 200 1y;
            proxy_cache_lock on;
            proxy_cache_lock_age 1m;
            proxy_cache_lock_timeout 1m;
            proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
            proxy_ignore_headers Expires Cache-Control;
            proxy_hide_header Expires;
            proxy_hide_header Cache-Control;
            #proxy_cache_revalidate on;
            #proxy_no_cache $http_content_length='0';

            expires 1y;
            add_header Access-Control-Allow-Origin *;
            add_header X-Cache-Status $upstream_cache_status;
        }
    }
}