| 1 | #user nginx nginx;
|
|---|
| 2 | worker_processes auto;
|
|---|
| 3 | pid /var/run/nginx.pid;
|
|---|
| 4 | daemon off;
|
|---|
| 5 | events {
|
|---|
| 6 | worker_connections 12288;
|
|---|
| 7 | use epoll;
|
|---|
| 8 | }
|
|---|
| 9 |
|
|---|
| 10 | http {
|
|---|
| 11 | include /etc/nginx/naxsi_core.rules;
|
|---|
| 12 | include mime.types;
|
|---|
| 13 | underscores_in_headers on;
|
|---|
| 14 | ignore_invalid_headers off;
|
|---|
| 15 | default_type application/octet-stream;
|
|---|
| 16 |
|
|---|
| 17 | add_header asp-ip2 $remote_addr always;
|
|---|
| 18 |
|
|---|
| 19 | limit_req_zone $binary_remote_addr zone=limitreq:20m rate=650r/s;
|
|---|
| 20 | # Putting this in location sections instead
|
|---|
| 21 | # limit_req zone=limitreq burst=350 nodelay;
|
|---|
| 22 | limit_req_status 429;
|
|---|
| 23 | limit_conn_status 429;
|
|---|
| 24 |
|
|---|
| 25 |
|
|---|
| 26 | log_format main escape=json '{ "time":"$time_local", "asp-ip":"$remote_addr", "request":"$request", "status":"$status", "size":"$bytes_sent", "req_duration":"$request_time", "response_duration":"$upstream_response_time" }';
|
|---|
| 27 | log_format errors escape=json '{ "time":"$time_local", "asp-ip":"$remote_addr", "request":"$request", "status":"$status", "size":"$bytes_sent", "req_duration":"$request_time", "response_duration":"$upstream_response_time"}';
|
|---|
| 28 |
|
|---|
| 29 | access_log /var/log/nginx/access.log main buffer=10k flush=1s;
|
|---|
| 30 | access_log /var/log/nginx/access_abnormal.log errors buffer=10k flush=1s if=$abnormal;
|
|---|
| 31 | error_log /var/log/nginx/error.log warn;
|
|---|
| 32 | reset_timedout_connection on;
|
|---|
| 33 | sendfile off;
|
|---|
| 34 | server_name_in_redirect off;
|
|---|
| 35 | server_tokens off;
|
|---|
| 36 | tcp_nopush on;
|
|---|
| 37 | tcp_nodelay on;
|
|---|
| 38 | port_in_redirect off;
|
|---|
| 39 | client_max_body_size 10M;
|
|---|
| 40 | keepalive_timeout 60s 60s;
|
|---|
| 41 | proxy_next_upstream off;
|
|---|
| 42 | map $status $abnormal {
|
|---|
| 43 | ~^2 0;
|
|---|
| 44 | default 1;
|
|---|
| 45 | }
|
|---|
| 46 | upstream haproxy {
|
|---|
| 47 | server 127.0.0.1:81 weight=1 max_fails=0; # shapping traffic using weights
|
|---|
| 48 | server 127.0.0.1:81 weight=2 max_fails=0; # useful while application rolling updates
|
|---|
| 49 | server 127.0.0.1:81 weight=3 max_fails=0;
|
|---|
| 50 | server 127.0.0.1:81 weight=4 max_fails=0;
|
|---|
| 51 |
|
|---|
| 52 | keepalive 2048; # //see locahost.conf for service level additional params
|
|---|
| 53 | }
|
|---|
| 54 |
|
|---|
| 55 | include /etc/nginx/localhost.conf;
|
|---|
| 56 | }
|
|---|
