Ticket #2099: nginx_compiled.conf

File nginx_compiled.conf, 10.2 KB (added by bezio@…, 6 years ago)

output as of nginx -T

Line 
1# configuration file /etc/nginx/nginx.conf:
2# nginx.conf
3user www-data;
4
5# attach worker to 80% of the cpu-cores avoiding context-switches as possible - and leaving space for f2b and such stuff
6worker_processes 16;
7
8pid /run/nginx.pid;
9include /etc/nginx/modules-enabled/*.conf;
10
11events {
12 worker_connections 32768;
13 multi_accept on;
14 use epoll;
15}
16
17# must be >= worker_connections! Better double it...
18worker_rlimit_nofile 65535;
19
20http {
21 sendfile on;
22 tcp_nopush on;
23 tcp_nodelay on;
24 keepalive_timeout 30;
25 types_hash_max_size 2048;
26 server_tokens off;
27
28 server_names_hash_bucket_size 128;
29 server_name_in_redirect off;
30
31 include /etc/nginx/mime.types;
32 default_type application/octet-stream;
33
34 ssl_protocols TLSv1.2 TLSv1.3;
35 ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
36 ssl_prefer_server_ciphers on;
37
38 log_format combined_servername '$remote_addr / $http_x_forwarded_for $server_name - $remote_user [$time_local] '
39 '$ssl_protocol/$ssl_cipher '
40 '"$request" $status $body_bytes_sent '
41 '"$http_referer" "$http_user_agent"';
42
43 log_format upstream_log '[$time_local] $remote_addr - $remote_user - $server_name '
44 '$ssl_protocol/$ssl_cipher '
45 '"$request" $status $body_bytes_sent '
46 '$host to=$upstream_addr upstream_response_time=$upstream_response_time msec=$msec request_time=$request_time '
47 '"$http_referer" "$http_user_agent"';
48
49 access_log /var/log/nginx/access.log upstream_log;
50 error_log /var/log/nginx/error.log;
51
52 gzip on;
53 gzip_disable "msie6";
54 gzip_vary on;
55 gzip_proxied any;
56 gzip_comp_level 6;
57 gzip_buffers 16 8k;
58 gzip_types
59 text/plain
60 text/css
61 text/js
62 text/xml
63 text/javascript
64 image/svg+xml
65 application/javascript
66 application/x-javascript
67 application/json
68 application/xml
69 application/xml+rss;
70
71 map_hash_bucket_size 128;
72 include /etc/nginx/conf.d/*.conf;
73 include /etc/nginx/sites-enabled/*;
74}
75
76load_module modules/ngx_http_auth_pam_module.so;
77load_module modules/ngx_http_dav_ext_module.so;
78load_module modules/ngx_http_echo_module.so;
79load_module modules/ngx_http_geoip_module.so;
80load_module modules/ngx_http_geoip2_module.so;
81load_module modules/ngx_http_image_filter_module.so;
82load_module modules/ngx_http_subs_filter_module.so;
83load_module modules/ngx_http_upstream_fair_module.so;
84load_module modules/ngx_http_xslt_filter_module.so;
85load_module modules/ngx_mail_module.so;
86load_module modules/ngx_ssl_ct_module.so;
87load_module modules/ngx_http_ssl_ct_module.so;
88load_module modules/ngx_stream_module.so;
89load_module modules/ngx_stream_geoip_module.so;
90load_module modules/ngx_stream_geoip2_module.so;
91
92# configuration file /etc/nginx/mime.types:
93types {
94 text/html html htm shtml;
95 text/css css;
96 text/xml xml;
97 image/gif gif;
98 image/jpeg jpeg jpg;
99 application/javascript js;
100 application/atom+xml atom;
101 application/rss+xml rss;
102
103 text/mathml mml;
104 text/plain txt;
105 text/vnd.sun.j2me.app-descriptor jad;
106 text/vnd.wap.wml wml;
107 text/x-component htc;
108
109 image/png png;
110 image/tiff tif tiff;
111 image/vnd.wap.wbmp wbmp;
112 image/x-icon ico;
113 image/x-jng jng;
114 image/x-ms-bmp bmp;
115 image/svg+xml svg svgz;
116 image/webp webp;
117
118 application/font-woff woff;
119 application/java-archive jar war ear;
120 application/json json;
121 application/mac-binhex40 hqx;
122 application/msword doc;
123 application/pdf pdf;
124 application/postscript ps eps ai;
125 application/rtf rtf;
126 application/vnd.apple.mpegurl m3u8;
127 application/vnd.ms-excel xls;
128 application/vnd.ms-fontobject eot;
129 application/vnd.ms-powerpoint ppt;
130 application/vnd.wap.wmlc wmlc;
131 application/vnd.google-earth.kml+xml kml;
132 application/vnd.google-earth.kmz kmz;
133 application/x-7z-compressed 7z;
134 application/x-cocoa cco;
135 application/x-java-archive-diff jardiff;
136 application/x-java-jnlp-file jnlp;
137 application/x-makeself run;
138 application/x-perl pl pm;
139 application/x-pilot prc pdb;
140 application/x-rar-compressed rar;
141 application/x-redhat-package-manager rpm;
142 application/x-sea sea;
143 application/x-shockwave-flash swf;
144 application/x-stuffit sit;
145 application/x-tcl tcl tk;
146 application/x-x509-ca-cert der pem crt;
147 application/x-xpinstall xpi;
148 application/xhtml+xml xhtml;
149 application/xspf+xml xspf;
150 application/zip zip;
151
152 application/octet-stream bin exe dll;
153 application/octet-stream deb;
154 application/octet-stream dmg;
155 application/octet-stream iso img;
156 application/octet-stream msi msp msm;
157
158 application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
159 application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
160 application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
161
162 audio/midi mid midi kar;
163 audio/mpeg mp3;
164 audio/ogg ogg;
165 audio/x-m4a m4a;
166 audio/x-realaudio ra;
167
168 video/3gpp 3gpp 3gp;
169 video/mp2t ts;
170 video/mp4 mp4;
171 video/mpeg mpeg mpg;
172 video/quicktime mov;
173 video/webm webm;
174 video/x-flv flv;
175 video/x-m4v m4v;
176 video/x-mng mng;
177 video/x-ms-asf asx asf;
178 video/x-ms-wmv wmv;
179 video/x-msvideo avi;
180}
181
182# configuration file /etc/nginx/conf.d/cluster.conf:
183# all configs on clusters are in one-file-per-cluster here below
184include /etc/nginx/conf.d/cluster/*.conf;
185
186
187# configuration file /etc/nginx/conf.d/cluster/fe-nodes.conf:
188upstream fe-nodes {
189 server 10.111.55.104:80 fail_timeout=10 weight=2; # fe-01
190 server 10.111.55.102:80 fail_timeout=10 weight=2; # fe-02
191 server 10.111.55.103:80 fail_timeout=10 weight=2; # fe-03
192}
193
194# configuration file /etc/nginx/conf.d/forward_proto.conf:
195map $http_x_forwarded_proto $real_scheme {
196 default $http_x_forwarded_proto;
197 '' $scheme;
198}
199
200# configuration file /etc/nginx/conf.d/header.conf:
201add_header X-LB $hostname always;
202
203# configuration file /etc/nginx/conf.d/proxy.conf:
204proxy_temp_path /var/lib/nginx/proxy;
205proxy_cache_path /var/lib/nginx/cache levels=1:2 keys_zone=STATIC:10m inactive=10m max_size=10g;
206proxy_cache_key "$host$request_uri";
207proxy_cache_use_stale error timeout invalid_header updating;
208proxy_ignore_client_abort on;
209proxy_http_version 1.1;
210
211map $scheme $is_https {
212 default '';
213 http '';
214 https 'on';
215}
216
217proxy_cache_path /var/cache/nginx/MAIL keys_zone=MAIL:512m levels=1:2 inactive=5m max_size=5g;
218
219# configuration file /etc/nginx/sites-enabled/postoffice:
220server {
221 listen 443 ssl http2;
222 server_name postoffice.test.me;
223 server_tokens off;
224 #access_log /var/log/nginx/postoffice.access.log combined_servername;
225 access_log off;
226 client_max_body_size 16M;
227
228 include /etc/nginx/cert/star_cert.conf;
229
230 # Restrict access from outside via basic_auth/ldap
231 include /etc/nginx/conf.d/ldap_htaccess.list;
232
233 location / {
234 proxy_pass http://fe-nodes;
235 include /etc/nginx/conf.d/proxy_header_settings;
236 }
237}
238
239# configuration file /etc/nginx/cert/star_cert.conf:
240 ssl_certificate cert/star_cert/star_cert.pem;
241 ssl_certificate_key cert/star_cert/star_cert.key;
242
243 ssl_stapling on;
244 ssl_stapling_verify on;
245 ssl_trusted_certificate cert/star_cert/CertCA.crt;
246 resolver 8.8.8.8 8.8.4.4 valid=300s;
247 resolver_timeout 5s;
248
249 include /etc/nginx/conf.d/ssl_settings;
250
251
252# configuration file /etc/nginx/conf.d/ssl_settings:
253ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
254ssl_prefer_server_ciphers on;
255ssl_dhparam /etc/nginx/dhparams.pem;
256ssl_protocols TLSv1.2 TLSv1.3;
257ssl_session_cache shared:SSL:10m;
258ssl_session_timeout 10m;
259
260# configuration file /etc/nginx/conf.d/ldap_htaccess.list:
261# LDAP/ou=Web-Access/postoffice
262satisfy any;
263
264allow 10.0.0.0/8;
265allow 127.0.0.1;
266
267# Access against the ldap
268auth_pam "Staff Area";
269auth_pam_service_name "nginx.stgtest";
270
271deny all;
272
273# configuration file /etc/nginx/conf.d/proxy_header_settings:
274proxy_set_header Host $host;
275proxy_set_header X-Forwarded-Host $host;
276proxy_set_header X-Forwarded-Server $host;
277proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
278proxy_set_header X-Forwarded-Proto $real_scheme;
279proxy_set_header HTTPS $is_https;
280proxy_pass_header Set-Cookie;
281proxy_pass_header Expires;
282proxy_pass_header ETag;
283proxy_pass_header Last-Modified;
284proxy_pass_header Content-Length;