nginx.conf

user root;
daemon off;
pcre_jit on;
error_log stderr warn;
#error_log /data/nginx/error.log warn;
worker_processes auto;
worker_cpu_affinity auto;

quic_bpf off;
#load_module modules/libngx_module.so;
#load_module modules/otel_ngx_module.so;
#load_module modules/ngx_http_geoip2_module.so;
#load_module modules/ngx_stream_geoip2_module.so;
#load_module modules/ngx_http_js_module.so;
#load_module modules/ngx_stream_js_module.so;
#load_module modules/ngx_http_upstream_ntlm_module.so;
#load_module modules/ngx_http_vhost_traffic_status_module.so;

# Custom
include /data/custom_nginx/root.conf;
include /data/custom_nginx/root_top.conf;

events {
    worker_connections 512;
    # Custom
    include /data/custom_nginx/events.conf;
}

http {
    log_format alog '[$time_local] $host $remote_addr $request_time "$request" $status $body_bytes_sent $bytes_sent $http_referer $http_user_agent';
    access_log off; # http
    log_not_found off;

    include mime.types;
    default_type application/octet-stream;

    lua_package_path "/usr/local/nginx/lib/lua/?.lua;;";
    lua_shared_dict discovery 1m;
    lua_shared_dict jwks 1m;
    lua_ssl_verify_depth 5;
    lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

    server_tokens "";
    more_clear_headers "Server";
    more_set_headers "X-Content-Type-Options: nosniff";
    more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";

    more_clear_headers "Expect-CT";
    more_clear_headers "Public-Key-Pins";
    more_set_headers "X-XSS-Protection: 0";

    server_names_hash_max_size 1024;
    server_names_hash_bucket_size 128;

    aio threads;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    client_max_body_size 0;
    client_body_buffer_size 512k;
    http3_stream_buffer_size 512k;
    reset_timedout_connection on;

    gzip on;
    gzip_vary on;
    gzip_comp_level 1;
    gzip_types text/css application/javascript text/javascript text/xml application/atom+xml application/rss+xml text/markdown text/mathml text/plain text/vnd.sun.j2me.app-descriptor text/vnd.wap.wml text/x-component application/json application/xhtml+xml application/xspf+xml font/woff font/woff2 image/avif image/x-ms-bmp image/bmp image/png image/svg+xml image/tiff image/vnd.wap.wbmp image/webp image/x-icon image/x-jng audio/midi audio/mpeg audio/ogg audio/x-m4a audio/x-realaudio;
    gzip_proxied any;
    gzip_http_version 1.0;
    gunzip on;
    gzip_static on;

    brotli on;
    brotli_types text/css application/javascript text/javascript text/xml application/atom+xml application/rss+xml text/markdown text/mathml text/plain text/vnd.sun.j2me.app-descriptor text/vnd.wap.wml text/x-component application/json application/xhtml+xml application/xspf+xml font/woff font/woff2 image/avif image/x-ms-bmp image/bmp image/png image/svg+xml image/tiff image/vnd.wap.wbmp image/webp image/x-icon image/x-jng audio/midi audio/mpeg audio/ogg audio/x-m4a audio/x-realaudio;
    brotli_comp_level 0;
    brotli_static on;

    proxy_buffering on;
    proxy_request_buffering on;

    grpc_buffer_size 16k;
    proxy_buffer_size 16k;
    proxy_busy_buffers_size 24k;
    proxy_buffers 64 4k;

    http2 on;
    http3 on;
    quic_gso on;
    quic_retry on;

    ssl_dyn_rec_enable on;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;

    ssl_dhparam /etc/dhparam;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ecdh_curve X25519MLKEM768:x25519:x448:secp521r1:secp384r1:secp256r1;

    ssl_early_data off;
    ssl_prefer_server_ciphers on;
    ssl_conf_command Options PrioritizeChaCha;
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256;

    resolver local=on valid=10s ipv6=on;
    fastcgi_index index.php;
    index index.html index.php;

    #error_page 404 =307 $scheme://$host:$server_port;
    error_page 497 =301 https://$host:$server_port$request_uri;

    grpc_read_timeout 86400s;
    proxy_http_version 1.1;
    proxy_read_timeout 86400s;
    proxy_headers_hash_max_size 1024;
    proxy_headers_hash_bucket_size 128;

    map $scheme $hsts_header {
        https "max-age=63072000; preload";
    }

    map $scheme $hsts_includeSubDomains_header {
        https "max-age=63072000; includeSubDomains; preload";
    }

    # Websocket
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    # Fancy Index
    index off;
    fancyindex off;
    fancyindex_localtime on;
    fancyindex_show_path on;
    fancyindex_exact_size off;
    fancyindex_show_dotfiles off;
    fancyindex_hide_symlinks off;
    fancyindex_case_sensitive on;
    fancyindex_default_sort name;
    fancyindex_hide_parent_dir off;
    fancyindex_directories_first on;
    fancyindex_time_format "%Y-%m-%d %T";
    fancyindex_header /html/fancyindex/header.html local;
    fancyindex_footer /html/fancyindex/footer.html local;

    # Real IP Determination
    real_ip_recursive on;
    set_real_ip_from 127.0.0.0/8;
    set_real_ip_from 10.0.0.0/8;
    set_real_ip_from 172.16.0.0/12;
    set_real_ip_from 192.168.0.0/16;
    set_real_ip_from 169.254.0.0/16;
    set_real_ip_from ::1/128;
    set_real_ip_from fc00::/7;
    set_real_ip_from fec0::/10;
    include /tmp/ip_ranges.conf;
    real_ip_header X-Forwarded-For;

    more_clear_headers "via";
    more_clear_headers "$wsep";
    more_clear_headers "Host-Header";
    more_clear_headers "K-Proxy-Request";
    more_clear_headers "Liferay-Portal";
    more_clear_headers "OracleCommerceCloud-Version";
    more_clear_headers "Pega-Host";
    more_clear_headers "Powered-By";
    more_clear_headers "Product";
    more_clear_headers "SourceMap";
    more_clear_headers "X-AspNet-Version";
    more_clear_headers "X-AspNetMvc-Version";
    more_clear_headers "X-Atmosphere-error";
    more_clear_headers "X-Atmosphere-first-request";
    more_clear_headers "X-Atmosphere-tracking-id";
    more_clear_headers "X-B3-ParentSpanId";
    more_clear_headers "X-B3-Sampled";
    more_clear_headers "X-B3-SpanId";
    more_clear_headers "X-B3-TraceId";
    more_clear_headers "X-BEServer";
    more_clear_headers "X-Backside-Transport";
    more_clear_headers "X-CF-Powered-By";
    more_clear_headers "X-CMS";
    more_clear_headers "X-CalculatedBETarget";
    more_clear_headers "X-Cocoon-Version";
    more_clear_headers "X-Content-Encoded-By";
    more_clear_headers "X-DiagInfo";
    more_clear_headers "X-Envoy-Attempt-Count";
    more_clear_headers "X-Envoy-External-Address";
    more_clear_headers "X-Envoy-Internal";
    more_clear_headers "X-Envoy-Original-Dst-Host";
    more_clear_headers "X-Envoy-Upstream-Service-Time";
    more_clear_headers "X-FEServer";
    more_clear_headers "X-Framework";
    more_clear_headers "X-Generated-By";
    more_clear_headers "X-Generator";
    more_clear_headers "X-Jitsi-Release";
    more_clear_headers "X-Joomla-Version";
    more_clear_headers "X-Kubernetes-PF-FlowSchema-UI";
    more_clear_headers "X-Kubernetes-PF-PriorityLevel-UID";
    more_clear_headers "X-LiteSpeed-Cache";
    more_clear_headers "X-LiteSpeed-Purge";
    more_clear_headers "X-LiteSpeed-Tag";
    more_clear_headers "X-LiteSpeed-Vary";
    more_clear_headers "X-Litespeed-Cache-Control";
    more_clear_headers "X-Mod-Pagespeed";
    more_clear_headers "X-Nextjs-Cache";
    more_clear_headers "X-Nextjs-Matched-Path";
    more_clear_headers "X-Nextjs-Page";
    more_clear_headers "X-Nextjs-Redirect";
    more_clear_headers "X-OWA-Version";
    more_clear_headers "X-Old-Content-Length";
    more_clear_headers "X-OneAgent-JS-Injection";
    more_clear_headers "X-Page-Speed";
    more_clear_headers "X-Php-Version";
    more_clear_headers "X-Powered-By";
    more_clear_headers "X-Powered-By-Plesk";
    more_clear_headers "X-Powered-CMS";
    more_clear_headers "X-Redirect-By";
    more_clear_headers "X-Server-Powered-By";
    more_clear_headers "X-SourceFiles";
    more_clear_headers "X-SourceMap";
    more_clear_headers "X-Turbo-Charged-By";
    more_clear_headers "X-Umbraco-Version";
    more_clear_headers "X-Varnish-Backend";
    more_clear_headers "X-Varnish-Server";
    more_clear_headers "X-dtAgentId";
    more_clear_headers "X-dtHealthCheck";
    more_clear_headers "X-dtInjectedServlet";
    more_clear_headers "X-ruxit-JS-Agent"

    include fastcgi.conf;
    fastcgi_request_buffering off;

    include conf.d/*.conf;

    # Custom
    include /data/custom_nginx/http_top.conf;

    # Files generated by NPM
    include /data/nginx/proxy_host/*.conf;
    include /data/nginx/redirection_host/*.conf;
    include /data/nginx/dead_host/*.conf;

    # Custom
    include /data/custom_nginx/http.conf;
}

stream {
    log_format slog '[$time_local] $server_port $remote_addr $protocol $status $bytes_sent $bytes_received $session_time';
    access_log off; # stream
    resolver local=on valid=10s ipv6=on;

    # Custom
    include /data/custom_nginx/stream_top.conf;

    # Files generated by NPM
    include /data/nginx/stream/*.conf;

    # Custom
    include /data/custom_nginx/stream.conf;
}