YukiRTMP nginx.conf

user root;
worker_processes 1; # DON'T ENABLE MULTITHREADING YOU IDIOT!
pid /var/run/nginx.pid;

events {
	worker_connections 4096;
	multi_accept on;
}

# Disabled, as it doesn't work with latest module/nginx
#rtmp_auto_push on;

http {
	sendfile on;
	tcp_nopush on;
	keepalive_timeout 20s;
	types_hash_max_size 2048;
	server_tokens off;
	etag on;

	default_type application/octet-stream;

	error_log logs/error.log info;

	gzip on;
	gzip_comp_level 5;
	gzip_min_length 256;
	gzip_proxied any;
	gzip_vary on;

	gzip_types
		application/atom+xml
		application/javascript
		application/json
		application/ld+json
		application/manifest+json
		application/rss+xml
		application/vnd.geo+json
		application/vnd.ms-fontobject
		application/x-font-ttf
		application/x-web-app-manifest+json
		application/xhtml+xml
		application/xml
		font/opentype
		image/bmp
		image/svg+xml
		image/x-icon
		text/cache-manifest
		text/css
		text/plain
		text/vcard
		text/vnd.rim.location.xloc
		text/vtt
		text/x-component
		text/x-cross-domain-policy;

	server {
		listen 80 default_server;
		listen [::]:80 default_server;

		# Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
		return 301 https://$host$request_uri;
	}

	server {
		listen 443 ssl;
		listen [::]:443 ssl;
		server_name localhost rtmp.yukitheater.org rtmp-hls.yukitheater.org;

		# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
		ssl_certificate /etc/letsencrypt/live/yukitheater.org/fullchain.pem;
		ssl_certificate_key /etc/letsencrypt/live/yukitheater.org/privkey.pem;
		ssl_session_timeout 1d;
		ssl_session_cache shared:SSL:50m;
		ssl_session_tickets off;

		# Diffie-Hellman parameter for DHE ciphersuites, we're using 4096 bits despite Mozilla recommending 2048
		ssl_dhparam /etc/ssl/certs/dhparam.pem;

		# SSL Settings according to Mozilla's "Intermediate" Configuration
		ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
		ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
		ssl_prefer_server_ciphers on;

		# OCSP Stapling ---
		# fetch OCSP records from URL in ssl_certificate and cache them
		ssl_stapling on;
		ssl_stapling_verify on;

		## verify chain of trust of OCSP response using Root CA and Intermediate certs
		ssl_trusted_certificate /etc/letsencrypt/live/yukitheater.org/fullchain.pem;

		resolver 8.8.8.8 valid=360s ipv6=off;

		# Security Headers
		add_header Strict-Transport-Security max-age=15768000; # 6 months
		add_header X-Content-Type-Options "nosniff" always;
		add_header X-Frame-Options "SAMEORIGIN" always;
		add_header X-Xss-Protection "1; mode=block" always;

		location /hls {
			# Disable cache
			add_header Cache-Control no-cache;

			# CORS setup
			add_header "Access-Control-Allow-Origin" "*" always;
			add_header "Access-Control-Expose-Headers" "Content-Length";

			# allow CORS preflight requests
			if ($request_method = "OPTIONS") {
				add_header "Access-Control-Allow-Origin" "*";
				add_header "Access-Control-Max-Age" 1728000;
				add_header "Content-Type" "text/plain charset=UTF-8";
				add_header "Content-Length" 0;
				return 204;
			}

			types {
				application/vnd.apple.mpegurl m3u8;
				video/mp2t ts;
			}

			root /tmp/;
		}
	}
}

rtmp {
	server {
		ping 30s;
		ping_timeout 15s;
		listen 1935;
		chunk_size 8192;
		buflen 10s;
		interleave on;
		wait_video on;

		application show {
			live on;

			hls on;
			hls_path /tmp/hls/;
			hls_fragment 1s;
			hls_playlist_length 5s;
			hls_nested on;

			# Instruct clients to adjust resolution according to bandwidth
			hls_variant _480 BANDWIDTH=448000; # Medium bitrate, SD resolution
			hls_variant _720 BANDWIDTH=2048000; # High bitrate, HD 720p resolution
			hls_variant _src BANDWIDTH=4096000; # Source bitrate, source resolution
		}

		application live/winter {
			allow publish IP.IP.IP.IP;
			deny publish all;
			allow play all;

			live on;
			record off;

			exec ffmpeg -i rtmp://127.0.0.1/live/winter/ -async 1 -vsync -1
				-c:v libx264 -c:a aac -b:v 768k -b:a 96k -vf "scale=720:trunc(ow/a/2)*2" -force_key_frames "expr:gte(t,n_forced*1)" -tune zerolatency -preset veryfast -crf 23 -f flv rtmp://127.0.0.1/show/winter_480
				#-c:v libx264 -c:a aac -b:v 1920k -b:a 128k -vf "scale=1280:trunc(ow/a/2)*2" -force_key_frames "expr:gte(t,n_forced*1)" -tune zerolatency -preset veryfast -crf 23 -f flv rtmp://127.0.0.1/show/winter_720
				-c copy -force_key_frames "expr:gte(t,n_forced*1)" -f flv rtmp://127.0.0.1/show/winter_src;
		}
	}
}