Skip to content

Instantly share code, notes, and snippets.

@mascot6699

mascot6699/letsencrypt.conf

Forked from bouroo/general.conf
Created January 8, 2019 15:01
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save mascot6699/817968372ce773b1ff312b0da529f0cd to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save mascot6699/817968372ce773b1ff312b0da529f0cd to your computer and use it in GitHub Desktop.
Download ZIP
Nginx Config
Raw
letsencrypt.conf
server {
listen 80 default_server deferred;
listen [::]:80 default_server deferred;
server_name _;
location ^~ /.well-known/acme-challenge {
allow all;
# Install https://certbot.eff.org/
# certbot certonly --webroot --email your@email --agree-tos --preferred-challenges http -w /etc/letsencrypt/webroot/ -d your.domain -d your2.domain
default_type text/plain;
# apt -y install certbot
# mkdir -p /etc/letsencrypt/webroot
root /etc/letsencrypt/webroot;
try_files $uri $uri/ =404;
}
location / {
# redirect all requests to https
return 301 https://$host$request_uri;
}
}
Raw
mariadb.conf
upstream mariaDB {
# Least time return data load balancing
least_time first_byte;
zone tcp_servers 64k;
server 192.168.69.2:3306;
server 192.168.69.3:3306;
server 192.168.69.4:3306;
}
upstream php-server {
# Session persistence
# hash $remote_addr consistent;
# Least connected load balancing
least_conn;
server 192.168.69.5:9000;
server 192.168.69.6:9000;
server 192.168.69.7:9000;
}
server {
listen 3306;
proxy_pass mariaDB;
proxy_connect_timeout 1s;
}
server {
listen 9000;
proxy_pass php-server;
proxy_connect_timeout 1s;
}
Raw
nginx.conf
# Server globals
user www-data;
# Set number of worker processes automatically based on number of CPU cores.
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 65535;
timer_resolution 50ms;
# Enables the use of JIT for regular expressions to speed-up their processing.
pcre_jit on;
# Configures default error logger.
error_log /var/log/nginx/error.log crit;
pid /var/run/nginx.pid;
# Includes files with directives to load dynamic modules.
#load_module "/usr/lib/nginx/modules/*.so";
#load_module "modules/ndk_http_module.so";
#load_module "modules/ngx_http_lua_module.so";
#load_module "modules/ngx_http_websockify_module.so";
#load_module "modules/ngx_rtmp_module.so";
#load_module "modules/ngx_http_modsecurity_module.so";
# Worker config
events {
# determines how much clients will be served per worker
# max clients = worker_connections * worker_processes
# max clients is also limited by the number of socket connections available on the system (~64k)
worker_connections 4096;
# optmized to serve many clients with each thread, essential for linux
use epoll;
# accept as many connections as possible, may flood worker connections if set too low
multi_accept on;
}
http {
# Main settings
# Enable of asynchronous file I/O works on linux
aio threads;
aio_write on;
# copies data between one FD and other from within the kernel
# faster then read() + write()
sendfile on;
# send headers in one peace, its better then sending them one by one
tcp_nopush on;
# don't buffer data sent, good for small data bursts in real time
tcp_nodelay on;
# server will close connection after this time
keepalive_timeout 60 60;
# if client stop responding, free up memory
send_timeout 30;
# allow the server to close connection on non responding client, this will free up memory
reset_timedout_connection on;
# Nginx Simple DDoS Defense
client_header_timeout 1m;
client_body_timeout 1m;
client_header_buffer_size 2k;
client_body_buffer_size 256k;
client_max_body_size 256m;
large_client_header_buffers 4 8k;
# Just For Security Reason
server_tokens off;
server_name_in_redirect off;
server_names_hash_max_size 512;
server_names_hash_bucket_size 512;
# Log format
log_format main '$remote_addr - $remote_user [$time_local] $request '
'"$status" $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
log_format bytes '$body_bytes_sent';
# to boost I/O on HDD we can disable access logs
#access_log /var/log/nginx/access.log main;
access_log off;
# Mime settings
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Compression
gzip on;
gzip_vary on;
gzip_comp_level 6;
gzip_min_length 512;
gzip_types text/plain
text/css
text/javascript
text/js
text/xml
application/json
application/javascript
application/x-javascript
application/xml
application/xml+rss
application/x-font-ttf
image/svg+xml
font/opentype;
gzip_proxied any;
gzip_disable "msie6";
# Proxy settings
proxy_redirect off;
proxy_set_header proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $http_cf_connecting_ip;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-NginX-Proxy true;
proxy_pass_header Set-Cookie;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
proxy_buffers 32 4k;
# Restore Real IP Cloudflare https://www.cloudflare.com/ips
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 199.27.128.0/21;
#set_real_ip_from 2400:cb00::/32;
#set_real_ip_from 2405:8100::/32;
#set_real_ip_from 2405:b500::/32;
#set_real_ip_from 2606:4700::/32;
#set_real_ip_from 2803:f800::/32;
#set_real_ip_from 2c0f:f248::/32;
#set_real_ip_from 2a06:98c0::/29;
real_ip_header CF-Connecting-IP;
resolver 8.8.8.8 1.1.1.1 valid=30s;
# SSL PCI Compliance
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve X25519:secp384r1;
# Server Side TLS
# SSL/TLS Configuration Generator
# https://mozilla.github.io/server-side-tls/ssl-config-generator/
# Oldest compatible clients
# Firefox 27, Chrome 30, IE 11 on Windows 7, Edge, Opera 17, Safari 9, Android 5.0, and Java 8
#ssl_ciphers "ECDHE+CHACHA20:ECDHE+AESGCM:ECDHE+AES";
# Oldest compatible clients
# Firefox 1, Chrome 1, IE 8 on Windows 7, Opera 5, Safari 1, Android 2.3, Java 7
ssl_ciphers "ECDHE+CHACHA20:ECDHE+AESGCM:DHE+AESGCM:ECDHE+AES:DHE+AES:RSA+AESGCM:RSA+AES:!DES-CBC3-SHA:!DSS";
# DH parameter for Perfect Forward Secrecy
# openssl dhparam -dsaparam -out /etc/ssl/dhparam.pem 4096
ssl_dhparam /etc/ssl/dhparam.pem;
# Various security headers
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
# Error pages
error_page 403 /error/403.html;
error_page 404 /error/404.html;
error_page 502 503 504 /error/50x.html;
# Cache
proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=512m;
proxy_cache_key md5("$host$request_uri$cookie_user");
proxy_temp_path /var/cache/nginx/temp;
proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
proxy_cache_use_stale error timeout invalid_header updating http_502;
proxy_cache_valid any 24h;
proxy_cache_bypass $http_upgrade;
# Cache bypass
map $http_cookie $no_cache {
default 0;
~SESS 1;
~wordpress_logged_in 1;
}
# File cache settings
open_file_cache max=10000 inactive=30s;
open_file_cache_valid 60s;
open_file_cache_min_uses 2;
open_file_cache_errors off;
# ModSecurity
#modsecurity on;
#modsecurity_rules_file /etc/nginx/modsec/main.conf;
# Wildcard include
include /etc/nginx/conf.d/http/*.conf;
}
stream {
resolver 8.8.8.8 1.1.1.1 valid=30s;
# Wildcard include
include /etc/nginx/conf.d/stream/*.conf;
}
Raw
reverse-proxy.conf
server {
# Enable HTTP2
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name _;
# log (optional)
access_log /var/log/nginx/domains/$host.log combined;
access_log /var/log/nginx/domains/$host.bytes bytes;
error_log /var/log/nginx/domains/$host.error.log error;
charset utf-8;
# Enable SSL
ssl on;
ssl_certificate /etc/letsencrypt/live/$host/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/$host/privkey.pem;
# Enable SSL verification
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/$host/chain.pem;
resolver 8.8.8.8 1.1.1.1;
# Enforce STS
# Strict SSL include sub domain
#add_header Strict-Transport-Security "max-age=15768000; includeSubdomains;";
# Strict SSL only top domain
add_header Strict-Transport-Security max-age=15768000;
# Web entrypoint
location / {
proxy_pass http://back-end:80/;
proxy_set_header proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-NginX-Proxy true;
proxy_redirect off;
}
# Basic security
location ~ /\.ht {return 404;}
location ~ /\.sh {return 404;}
location ~ /\.svn/ {return 404;}
location ~ /\.git/ {return 404;}
location ~ /\.hg/ {return 404;}
location ~ /\.bzr/ {return 404;}
}
Raw
web.conf
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;
server {
# Rate limit
limit_req zone=mylimit burst=20 nodelay;
limit_req_status 444;
# Enable HTTP2
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name _;
set $root "/srv/www/$host/public";
root $root;
index index.php index.html index.htm;
# log (optional)
access_log /var/log/nginx/domains/$host.log combined;
access_log /var/log/nginx/domains/$host.bytes bytes;
error_log /var/log/nginx/domains/$host.error.log error;
charset utf-8;
# Enable SSL
ssl on;
ssl_certificate /etc/letsencrypt/live/$host/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/$host/privkey.pem;
# Enable SSL verification
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/$host/chain.pem;
resolver 1.1.1.1 64.6.64.6;
# Enforce STS
# Strict SSL include sub domain
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;
# Strict SSL only top domain
add_header Strict-Transport-Security "max-age=15768000" always;
# Cache static files
location = /robots.txt { access_log off; log_not_found off; }
location = /favicon.ico { access_log off; log_not_found off; }
location ~ /\. { deny all; }
location ~* \.(js|css|svg|png|jpg|jpeg|gif|ico)$ { expires 24h; }
location ~* ^/tmp/ { deny all; }
# Letsencrypt webroot
location ^~ /.well-known/acme-challenge/ {
# Install https://certbot.eff.org/
# letsencrypt/certbot certonly --webroot --email your@email --agree-tos --standalone-supported-challenges http-01 -w /etc/letsencrypt/webroot/ -d your.domain -d your2.domain
default_type text/plain;
root /etc/letsencrypt/webroot;
try_files $uri $uri/ =404;
}
# Web entrypoint
location / {
try_files $uri $uri/ /index.php$is_args$args;
#include /etc/nginx/naxsi.rules;
}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
location ~ \.php$ {
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
if (!-f $document_root$fastcgi_script_name) {
return 404;
}
fastcgi_pass unix:/run/php/php7.1-fpm.sock;
fastcgi_index index.php;
include /etc/nginx/fastcgi_params;
}
# Basic security
location ~ /\.ht {return 404;}
location ~ /\.sh {return 404;}
location ~ /\.svn/ {return 404;}
location ~ /\.git/ {return 404;}
location ~ /\.hg/ {return 404;}
location ~ /\.bzr/ {return 404;}
disable_symlinks if_not_owner from=$root;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment