You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docker/nginx.conf
+48-24
Original file line number
Diff line number
Diff line change
@@ -2,25 +2,45 @@
2
2
3
3
# This value auto allows binding worker processes automatically to available CPU
4
4
worker_processes auto;
5
-
#worker_cpu_affinity auto;
5
+
# Allows binding worker processes automatically to available CPUs
6
+
worker_cpu_affinity auto;
7
+
# The number of simultaneous connections is limited by the number of file descriptors available on the system as each socket will open a file descriptor. If NGINX tries to open more sockets than the available file descriptors, it will lead to the Too many opened files message in the error.log.
8
+
worker_rlimit_nofile65535;
6
9
7
10
# logging
11
+
error_log /var/log/nginx/error.log;
8
12
error_log /var/log/nginx/error.log warn;
13
+
error_log /var/log/nginx/error.log notice;
14
+
error_log /var/log/nginx/error.log info;
9
15
10
16
pid /var/run/nginx.pid;
11
17
12
18
13
19
events {
14
-
multi_accept on;
20
+
# The maximum number of connections that each worker process can handle simultaneously. The default is 512, but most systems have enough resources to support a larger number. The appropriate setting depends on the size of the server and the nature of the traffic, and can be discovered through testing.
15
21
worker_connections65535;
22
+
# This directive allows a worker to accept many connections in the queue at a time. A queue in this context simply means a sequence of data objects waiting to be processed.
23
+
multi_accept on;
24
+
# With this directive worker processes will accept new connections by turn. Otherwise, all worker processes will be notified about new connections, and if volume of new connections is low, some of the worker processes may just waste system resources.
25
+
accept_mutex on;
26
+
# This directive determines how long a worker should wait before accepting a new connection. Once the accept_mutex is turned on, a mutex lock is assigned to a worker for a timeframe specified by the accept_mutex_delay . When the timeframe is up, the next worker in line is ready to accept new connections.
27
+
accept_mutex_delay 200ms;
28
+
# This directive specifies the method to process a connection from the client. We decided to set the value to epoll because we are working on a Ubuntu platform. The epoll method is the most effective processing method for Linux platforms.
29
+
use epoll;
30
+
# This specifies the number of events that NGINX will pass to the kernel.
31
+
epoll_events1024;
16
32
}
17
33
18
34
http {
35
+
# To support larger number of server names that are defined
36
+
server_names_hash_bucket_size64;
37
+
# Sets the bucket size for the server names hash tables. The default value depends on the size of the processor’s cache line.
38
+
server_names_hash_max_size512;
19
39
# redirect all http traffic to https
20
40
server {
21
41
listen80 default_server;
22
42
listen [::]:80 default_server ipv6only=on;
23
-
server_name_;
43
+
server_namesamwanekeya.com;
24
44
root /usr/share/nginx/html;
25
45
index index.html index.htm index.nginx-debian.html;
26
46
return301 https://$host$request_uri;
@@ -29,35 +49,42 @@ http {
29
49
server {
30
50
listen443 ssl;
31
51
listen [::]:443 ssl ipv6only=on;
32
-
server_name_;
52
+
server_namesamwanekeya.com;
33
53
# MIME
34
54
include /etc/nginx/mime.types;
35
55
default_type application/octet-stream;
36
-
# Display nginx Version number in error or http header may result in hacker to search for known vulnerability.
37
-
# Therefore, the version number should be removed for every http response.
56
+
# Display nginx Version number in error or http header may result in hacker to search for known vulnerability. Therefore, the version number should be removed for every http response.
38
57
server_tokens"off";
39
-
charset utf-8;
40
-
sendfile on;
41
-
tcp_nopush on;
58
+
#charset utf-8;
59
+
# This directive, by default, is disabled to allow small packets to wait for a specified period before they are sent at once. To allow all data to be sent at once, this directive is enabled.
42
60
tcp_nodelay on;
43
-
#Defines a timeout for reading client request body. The timeout is set only for a period between two successive read operations, not for the transmission of the whole request body. If a client does not transmit anything within this time, the 408 (Request Time-out) error is returned to the client.
61
+
# Because we have enabled tcp_nodelay directive, small packets are sent at once. However, if you still want to make use of John Nagle’s buffering algorithm, we can also enable the tcp_nopush to add packets to each other and send them all at once.
62
+
tcp_nopush on;
63
+
# Defines a timeout for reading client request body. The timeout is set only for a period between two successive read operations, not for the transmission of the whole request body. If a client does not transmit anything within this time, the 408 (Request Time-out) error is returned to the client.
44
64
client_body_timeout12;
45
-
#Defines a timeout for reading client request header. If a client does not transmit the entire header within this time, the 408 (Request Time-out) error is returned to the client.
65
+
#Defines a timeout for reading client request header. If a client does not transmit the entire header within this time, the 408 (Request Time-out) error is returned to the client.
46
66
client_header_timeout12;
47
-
#The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the “Keep-Alive: timeout=time” response header field. Two parameters may differ. The “Keep-Alive: timeout=time” header field is recognized by Mozilla and Konqueror. MSIE closes keep-alive connections by itself in about 60 seconds.
48
-
keepalive_timeout15;
49
-
#Sets a timeout for transmitting a response to the client. The timeout is set only between two successive write operations, not for the transmission of the whole response. If the client does not receive anything within this time, the connection is closed.
50
-
send_timeout10;
51
-
#Size Limits & Buffer Overflows
52
-
client_body_buffer_size10K;
67
+
# This directive sets the buffer size for the request body. If you plan to run the webserver on 64-bit systems, you need to set the value to 16k. If you want to run the webserver on the 32-bit system, set the value to 8k.
68
+
client_body_buffer_size16K;
69
+
# Similar to the previous directive, only instead it handles the client header size. For all intents and purposes, 1K is usually a decent size for this directive not unless you're sending mayopic stuff via header i.e permissions.
53
70
client_header_buffer_size1k;
71
+
# The maximum number and size of buffers for large client headers.
54
72
large_client_header_buffers21k;
55
-
types_hash_max_size2048;
56
-
client_max_body_size16M;
57
-
73
+
# The maximum allowed size for a client request. If the maximum size is exceeded, then Nginx will spit out a 413 error or Request Entity Too Large.
74
+
client_max_body_size64M;
75
+
# Defines the maximum size of an entry in the MIME types hash tables.
76
+
types_hash_max_size4096;
77
+
# The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the “Keep-Alive: timeout=time” response header field. Two parameters may differ. The “Keep-Alive: timeout=time” header field is recognized by Mozilla and Konqueror. The default is 75 seconds.
78
+
keepalive_timeout120s;
79
+
# Configure a number of requests to keep alive for a specific period of time. You can set the number of requests to 20 or 30.
80
+
keepalive_requests120;
81
+
# if you want to disable keepalive connection for a specific group of browsers, use this directive.
82
+
#keepalive_disable;
83
+
#Sets a timeout for transmitting a response to the client. The timeout is set only between two successive write operations, not for the transmission of the whole response. If the client does not receive anything within this time, the connection is closed.
# Nginx logs every request that hits the server to a log file. If you use analytics to monitor this, you may want to turn this functionality off. Simply edit the access_log directive:
19
+
access_log on;
13
20
}
14
21
15
22
# deny access to .htaccess files
16
23
location ~ /\.ht {
17
24
deny all;
25
+
error_log off;
26
+
log_not_found off;
18
27
}
19
28
20
29
# Deny access to hidden files (beginning with a period)
21
30
location ~ /\. {
22
31
deny all;
32
+
error_log off;
33
+
log_not_found off;
34
+
}
35
+
36
+
37
+
location /video/ {
38
+
# To utilize operating system resources, set the value of this directive to on. sendfile transfers data between file descriptors within the OS kernel space without sending it to the application buffers. This directive will be used to serve small files.
39
+
sendfile on;
40
+
# This directive enables multi-threading when set to on for write and read operation. Multi-threading is an execution model that allows multiple threads to execute separately from each other whilst sharing their hosting process resources.
41
+
aio threads;
42
+
# This directive improves cache effectiveness by allowing read and write to be sent directly to the application. directio is a filesystem feature of every modern operating system. This directive will be used to serve larger files like videos.
43
+
directio 8m;
44
+
# This directive assigns a block size value to the data transfer. It related to the directio directive.
45
+
directio_alignment 1024;
23
46
}
24
47
25
48
# define error pages
@@ -46,4 +69,31 @@ if ($request_method !~ ^(GET|PUT|POST)$ ) {
46
69
if ($host !~ ^(samwanekeya.com|localhost)$ ) {
47
70
return 444;
48
71
}
49
-
##
72
+
73
+
#Gzip can help reduce the amount of network transfer Nginx deals with. However, be careful increasing the gzip_comp_level too high as the server will begin wasting cpu cycles.
74
+
#For those using Cloudflare as their CDN this is already taken care of - https://support.cloudflare.com/hc/en-us/articles/200168086-Does-Cloudflare-compress-resources-
75
+
76
+
#If you want to enable compression, set the value of this directive to on. By default, it is disabled.
77
+
#gzip on;
78
+
# You can make use of this directive to set the compression level. In order not to waste CPU resources, you need not set the compression level too high. Between 1 and 9, you can set the compression level to 2 or 3.
79
+
#gzip_comp_level 2;
80
+
# Set the minimum response length for compression via the content-length response header field. You can set it to more than 20 bytes.
# This directive allows you to choose the response type you want to compress. By default, the response type text/html is always compressed. You can add other response type such as text/plain application/x-javascript text/xml as shown in the code above.
# This directive allows you to choose the minimum HTTP version of a request for a compressed response. You can make use of the default value which is 1.1.
86
+
#gzip_http_version 1.1;
87
+
# When gzip directive is enabled, this directive add the header field Vary:Accept Encoding to the response.
88
+
#gzip_vary on;
89
+
# Some browsers such as Internet Explorer 6 do not have support for gzip compression. This directive make use of User-Agent request header field to disable compression for certain browsers.
90
+
#gzip_disable "MSIE [4-6] \.";
91
+
92
+
# This directive is disabled by default. Enable it if you want implement caching in Nginx. This directive stores metadata of files and directories commonly requested by users.
93
+
open_file_cache max=1000 inactive=30s;
94
+
# This directive contains backup information inside the open_file_cache directive. You can use this directive to set a valid period usually in seconds after which the information related to files and directories is re-validated again.
95
+
open_file_cache_valid 30s;
96
+
# Nginx usually clear information inside the open_file_cache directive after a period of inactivity based on the open_file_cache_min_uses. You can use this directive to set a minimum number of access to identify which files and directories are actively accessed.
97
+
open_file_cache_min_uses 4;
98
+
# You can make use of this directive to allow Nginx to cache errors such as “permission denied” or “can’t access this file” when files are accessed. So anytime a resource is accessed by a user who does not have the right to do so, Nginx displays the same error report “permission denied”.
0 commit comments