Ticket #2440: nginx.conf

# config for nginx unprivileged

worker_processes auto;

# error_log /var/log/nginx/error.log notice;
error_log /dev/stderr;
pid /tmp/nginx.pid;


events {
  worker_connections 1024;
}


http {
  proxy_temp_path /tmp/proxy_temp;
  client_body_temp_path /tmp/client_temp;
  fastcgi_temp_path /tmp/fastcgi_temp;
  uwsgi_temp_path /tmp/uwsgi_temp;
  scgi_temp_path /tmp/scgi_temp;

  include /etc/nginx/mime.types;
  default_type application/octet-stream;

  # log format with application performance metrics in logfmt style
  log_format apm 't="$time_iso8601" h=$host u=$remote_user client=$remote_addr '
  'status=$status '
  'request="$request" '
  'req_time=$request_time '
  'ua="$http_user_agent" '
  'method=$request_method '
  'req_length=$request_length '
  'bytes_sent=$bytes_sent '
  'body_bytes_sent=$body_bytes_sent '
  'referer="$http_referer" '
  'us_addr=$upstream_addr '
  'us_status=$upstream_status '
  'us_connect_time=$upstream_connect_time '
  'us_header_time=$upstream_header_time '
  'us_response_time=$upstream_response_time ';

  access_log /var/log/nginx/access.log apm;

  sendfile on;
  #tcp_nopush     on;

  keepalive_timeout 65;

  #gzip  on;

  include /etc/nginx/conf.d/*.conf;
}

stream {
  # log format logfmt style
  log_format logfmt_stream 't="$time_iso8601" h="$ssl_server_name", client=$remote_addr '
  'protocol="$protocol" '
  'status="$status" '
  'bytes_sent="$bytes_sent" '
  'bytes_received="$bytes_received" '
  'session_time="$session_time" '
  'upstream_addr="$upstream_addr" '
  'upstream_bytes_sent="$upstream_bytes_sent" '
  'upstream_bytes_received="$upstream_bytes_received" '
  'upstream_connect_time="$upstream_connect_time" '
  'connection_id="$connection" '
  'ssl_server_name="$ssl_server_name" '
  'ssl_protocol="$ssl_protocol" '
  'ssl_cipher="$ssl_cipher" '
  'ssl_session_reused="$ssl_session_reused"';

  access_log /var/log/nginx/access.log logfmt_stream;

  upstream stream_backend {
    server backend:9999;
  }

  server {
    listen 9999 ssl;
    proxy_pass stream_backend;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;

    ssl_session_timeout 4h;
    ssl_handshake_timeout 30s;

    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    ssl_certificate /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/key.pem;
    ssl_dhparam /etc/nginx/certs/dhparam.pem;
    ssl_trusted_certificate /etc/nginx/certs/chain.pem;

  }
}