This repository has been archived by the owner on Oct 17, 2018. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #15 from wunderkraut/better_conf
Better conf
- Loading branch information
Showing
5 changed files
with
164 additions
and
70 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| user app; | ||
| worker_processes auto; | ||
|
|
||
| error_log /var/log/nginx/error.log info; | ||
|
|
||
| pid /var/run/nginx.pid; | ||
|
|
||
| worker_rlimit_nofile 8192; | ||
|
|
||
| events { | ||
| worker_connections 4096; | ||
| ## epoll is preferred on 2.6 Linux | ||
| ## kernels. Cf. http://www.kegel.com/c10k.html#nb.epoll | ||
| use epoll; | ||
| ## Accept as many connections as possible. | ||
| multi_accept on; | ||
| } | ||
|
|
||
| http { | ||
| ## Get correct ip from X-Forwarded-For as we are behind Varnish | ||
| set_real_ip_from 0.0.0.0/0; | ||
| real_ip_header X-Forwarded-For; | ||
|
|
||
| include /etc/nginx/mime.types; | ||
| default_type application/octet-stream; | ||
| index index.htm, index.html, index.php; | ||
|
|
||
| log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | ||
| '$status $body_bytes_sent "$http_referer" ' | ||
| '"$http_user_agent" "$http_x_forwarded_for"'; | ||
|
|
||
| access_log /var/log/nginx/access.log main buffer=32k; | ||
| error_log /var/log/nginx/error.log info; | ||
|
|
||
| ## Define a zone for limiting the number of simultaneous | ||
| ## connections nginx accepts. 1m means 32000 simultaneous | ||
| ## sessions. We need to define for each server the limit_conn | ||
| ## value refering to this or other zones. | ||
| ## ** This syntax requires nginx version >= | ||
| ## ** 1.1.8. Cf. http://nginx.org/en/CHANGES. If using an older | ||
| ## ** version then use the limit_zone directive below | ||
| ## ** instead. Comment out this | ||
| ## ** one if not using nginx version >= 1.1.8. | ||
| limit_conn_zone $binary_remote_addr zone=arbeit:10m; | ||
|
|
||
| ## Use a SSL/TLS cache for SSL session resume. This needs to be | ||
| ## here (in this context, for session resumption to work. See this | ||
| ## thread on the Nginx mailing list: | ||
| ## http://nginx.org/pipermail/nginx/2010-November/023736.html. | ||
| ssl_session_cache shared:SSL:10m; | ||
| ssl_session_timeout 10m; | ||
|
|
||
| # Enable HSTS; | ||
| add_header Strict-Transport-Security max-age=31536000; | ||
|
|
||
| # Enable X-Frame-Options | ||
| add_header X-Frame-Options "SAMEORIGIN" always; | ||
|
|
||
| # Enable Content Security Policy | ||
| add_header Content-Security-Policy "default-src https: data: 'unsafe-inline' 'unsafe-eval'" always; | ||
|
|
||
| ## Enable the builtin cross-site scripting (XSS) filter available | ||
| ## in modern browsers. Usually enabled by default we just | ||
| ## reinstate in case it has been somehow disabled for this | ||
| ## particular server instance. | ||
| ## https://www.owasp.org/index.php/List_of_useful_HTTP_headers. | ||
| add_header X-XSS-Protection '1; mode=block'; | ||
|
|
||
| ## Block MIME type sniffing on IE. | ||
| add_header X-Content-Options nosniff; | ||
|
|
||
| sendfile on; | ||
| tcp_nopush on; | ||
| tcp_nodelay on; | ||
| client_header_timeout 10; | ||
| client_body_timeout 120; | ||
| send_timeout 120; | ||
| keepalive_timeout 15 10; | ||
| client_max_body_size 100M; | ||
| client_body_buffer_size 128k; | ||
| proxy_read_timeout 60; | ||
|
|
||
| ## Reset lingering timed out connections. Deflect DDoS. | ||
| reset_timedout_connection on; | ||
|
|
||
| port_in_redirect off; | ||
|
|
||
| merge_slashes off; | ||
|
|
||
| types_hash_max_size 8192; | ||
| server_names_hash_bucket_size 64; | ||
|
|
||
| ## Compression. | ||
| gzip on; | ||
| gzip_buffers 16 8k; | ||
| gzip_comp_level 3; | ||
| gzip_http_version 1.1; | ||
| gzip_min_length 10; | ||
| gzip_types text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript image/x-icon application/vnd.ms-fontobject font/opentype application/x-font-ttf application/json image/svg+xml; | ||
| gzip_vary on; | ||
| gzip_proxied any; # Compression for all requests. | ||
| ## No need for regexps. See | ||
| ## http://wiki.nginx.org/NginxHttpGzipModule#gzip_disable | ||
| gzip_disable "msie6"; | ||
|
|
||
| ## Hide the Nginx version number. | ||
| server_tokens off; | ||
|
|
||
| ## Include nginx configs. | ||
| include conf.d/nginx_*.conf; | ||
|
|
||
| ## Load sites files from the /etc/nginx/sites-enabled directory | ||
| include /etc/nginx/sites-enabled/*.conf; | ||
| } |