Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- # Generated by nginxconfig.io
- # See nginxconfig.txt for the configuration share link
- user nginx;
- pid /tmp/nginx.pid;
- worker_processes auto;
- worker_rlimit_nofile 65535;
- # Load modules
- include /etc/nginx/modules-enabled/*.conf;
- events {
- multi_accept on;
- worker_connections 65535;
- }
- http {
- charset utf-8;
- sendfile on;
- tcp_nopush on;
- tcp_nodelay on;
- server_tokens off;
- log_not_found off;
- types_hash_max_size 2048;
- types_hash_bucket_size 64;
- client_max_body_size 16M;
- # MIME
- include mime.types;
- default_type application/octet-stream;
- # Logging
- access_log off;
- error_log /var/log/nginx/error.log error;
- # Limits
- limit_req_log_level warn;
- limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
- # SSL
- ssl_session_timeout 1d;
- ssl_session_cache shared:SSL:10m;
- ssl_session_tickets off;
- # Diffie-Hellman parameter for DHE ciphersuites
- ssl_dhparam /etc/ssl/certs/dhparam.pem;
- # Mozilla Intermediate configuration
- ssl_protocols TLSv1.2 TLSv1.3;
- ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
- # OCSP Stapling
- ssl_stapling on;
- ssl_stapling_verify on;
- resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
- resolver_timeout 2s;
- # Connection header for WebSocket reverse proxy
- map $http_upgrade $connection_upgrade {
- default upgrade;
- "" close;
- }
- map $remote_addr $proxy_forwarded_elem {
- # IPv4 addresses can be sent as-is
- ~^[0-9.]+$ "for=$remote_addr";
- # IPv6 addresses need to be bracketed and quoted
- ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";
- # Unix domain socket names cannot be represented in RFC 7239 syntax
- default "for=unknown";
- }
- map $http_forwarded $proxy_add_forwarded {
- # If the incoming Forwarded header is syntactically valid, append to it
- "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
- # Otherwise, replace it
- default "$proxy_forwarded_elem";
- }
- # Load configs
- include /etc/nginx/conf.d/*.conf;
- # api.ch.com
- server {
- listen 443 ssl http2 reuseport;
- listen [::]:443 ssl http2 reuseport;
- server_name www.api.ch.com;
- root /var/www/_letsencrypt;
- # SSL
- ssl_certificate /etc/letsencrypt/live/api.ch.com/fullchain.pem;
- ssl_certificate_key /etc/letsencrypt/live/api.ch.com/privkey.pem;
- ssl_trusted_certificate /etc/letsencrypt/live/api.ch.com/chain.pem;
- # security headers
- add_header X-XSS-Protection "1; mode=block" always;
- add_header X-Content-Type-Options "nosniff" always;
- add_header Referrer-Policy "no-referrer-when-downgrade" always;
- add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
- add_header Permissions-Policy "interest-cohort=()" always;
- add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
- # . files
- location ~ /\.(?!well-known) {
- deny all;
- }
- # security.txt
- location /security.txt {
- return 301 /.well-known/security.txt;
- }
- location = /.well-known/security.txt {
- alias ~/security.txt;
- }
- # logging
- access_log /var/log/nginx/access.log combined buffer=512k flush=1m;
- error_log /var/log/nginx/error.log error;
- # reverse proxy
- location / {
- proxy_pass http://api_server_prod:21347;
- proxy_set_header Host $host;
- proxy_http_version 1.1;
- proxy_cache_bypass $http_upgrade;
- # Proxy SSL
- proxy_ssl_server_name on;
- # Proxy headers
- proxy_set_header Upgrade $http_upgrade;
- proxy_set_header Connection $connection_upgrade;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header Forwarded $proxy_add_forwarded;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- proxy_set_header X-Forwarded-Proto $scheme;
- proxy_set_header X-Forwarded-Host $host;
- proxy_set_header X-Forwarded-Port $server_port;
- # Proxy timeouts
- proxy_connect_timeout 60s;
- proxy_send_timeout 60s;
- proxy_read_timeout 60s;
- }
- # favicon.ico
- location = /favicon.ico {
- log_not_found off;
- }
- # robots.txt
- location = /robots.txt {
- log_not_found off;
- }
- # gzip
- gzip on;
- gzip_vary on;
- gzip_proxied any;
- gzip_comp_level 6;
- gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
- }
- # non-www, subdomains redirect
- server {
- listen 443 ssl http2;
- listen [::]:443 ssl http2;
- server_name .api.ch.com;
- # SSL
- ssl_certificate /etc/letsencrypt/live/api.ch.com/fullchain.pem;
- ssl_certificate_key /etc/letsencrypt/live/api.ch.com/privkey.pem;
- ssl_trusted_certificate /etc/letsencrypt/live/api.ch.com/chain.pem;
- # logging
- error_log /var/log/nginx/error.log error;
- return 301 https://www.api.ch.com$request_uri;
- }
- # HTTP redirect
- server {
- listen 80 reuseport;
- listen [::]:80 reuseport;
- server_name .api.ch.com;
- # logging
- error_log /var/log/nginx/error.log error;
- # ACME-challenge
- location ^~ /.well-known/acme-challenge/ {
- allow all;
- root /var/www/_letsencrypt;
- }
- location / {
- return 301 https://www.api.ch.com$request_uri;
- }
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement