nginx.conf

gistfile1.txt

#user  nobody;
worker_processes  4;
worker_priority  15;
error_log  logs/error.log  notice;

pid        logs/nginx.pid;
events {
        use kqueue;              # event method, kqueue for FreeBSD and OpenBSD
        worker_connections 1024; # number of parallel or concurrent connections per worker_processes
}

http {
        proxy_cache_path  /var/cache/nginx levels=1:2 keys_zone=one:8m max_size=3000m inactive=600m;
        proxy_temp_path /var/tmp;

        # ECDSA ssl ciphers; google chrome prefered order, 128bit most prefered
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!ADH;
        ssl_ecdh_curve secp384r1;      # 384 bit prime modulus curve efficiently supports ECDHE ssl_ciphers up to a SHA384 hash
        ssl_session_cache   shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_buffer_size 1400;
        ssl_stapling on;  

        # Timeouts: do not keep connections open longer then necessary to reduce
        # resource usage and deny Slowloris type attacks. Slow attacks are related to
        # pausing in between packets.
        client_body_timeout      2s;    # maximum time between packets the client can pause when sending nginx any data
        client_header_timeout    2s;    # maximum time the client has to send the entire header to nginx
        keepalive_timeout       28s;    # timeout which a single keep-alive client connection will stay open
        send_timeout            10s;    # maximum time between packets nginx is allowed to pause when sending the client data
        spdy_keepalive_timeout 128s;    # inactivity timeout after which the SPDY connection is closed
        spdy_recv_timeout        2s;    # timeout if nginx is currently expecting data from the client but nothing arrives
        # general options for FreeBSD on ZFS
        aio                     on;     # asynchronous file input/output, fast with ZFS, make sure sendfile=off
        charset                 utf-8;  # adds the line "Content-Type" into response-header, same as "source_charset"
        default_type            application/octet-stream;
        disable_symlinks           on;  # disable symlinks to avoid malicious symlinks out of the document root
        etag                      off;  # disables "ETag" response header so clients use Cache-Control header only
        gzip                      on;   # disable on the fly gzip compression, only use gzip_static to reduce latency
        gzip_http_version         1.0;  # serve gzipped content to all clients including HTTP/1.0 and greater
        gzip_static            always;  # precompress content (gzip -9) with an external script found on this page below
        gzip_proxied              any;  # allows compressed responses for any request even from proxies
        gzip_min_length          1000;
        gzip_types              text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
        gzip_buffers            16 8k;
        gzip_comp_level             9;
        gzip_vary                  on;
        ignore_invalid_headers     on;
        include                  mime.types;
        keepalive_requests         40;  # number of keep alive requests per connection, does not affect SPDY
        keepalive_disable        none;  # allow all browsers to use keepalive connections
        lingering_time              2;  # maximum time during which nginx will process additional data from the client
        lingering_timeout           2;  # maximum waiting time for more client data to arrive
        max_ranges                  1;  # allow a single range header for resumed downloads and to stop large range header DoS attacks
        merge_slashes              on;  # compression of two or more adjacent slashes in a URI into a single slash "//" into "/"
        msie_padding              off;
        output_buffers         1 256K;  # sendfile=off so set to the total size of all objects on an average page
        recursive_error_pages      on;
        reset_timedout_connection  on;  # reset timed out connections freeing ram and resources
        sendfile                  off;  # off for FreeBSD and ZFS to avoid redundant data caching
        server_tokens             off;  # no nginx version number in error pages
        source_charset          utf-8;  # same value as "charset"
        spdy_headers_comp           1;  # SPDY gzip header compression to at least one(1) (default 0)
        spdy_max_concurrent_streams 20; #SPDY maximum parallel client requests (default 100)
        tcp_nodelay                on;  # disable the Nagle buffering algorithm, used for keepalive only
        tcp_nopush                off;  # sendfile=off so tcp_nopush can not be used

        # request limits
        limit_req_zone $binary_remote_addr zone=gulag:1m rate=25r/m;

        # log format
        log_format  main  '$remote_addr $host $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $ssl_protocol $ssl_cipher $request_time';

        upstream continental_clothing_upstream {
                server 10.6.6.8:3000;
                keepalive 64;
        }

        server {
                listen       80;
                server_name  localhost;
                #access_log  logs/host.access.log  main;
                location / {
                        root   html;
                        index  index.html index.htm;
                }
                #error_page  404              /404.html;
                error_page   500 502 503 504  /50x.html;
                location = /50x.html {
                        root   html;
                }
        }
        server {
                access_log              logs/access.log  main;
                error_log               logs/error.log info;
                listen                  80;
                listen                  443 ssl;
                root                    /var/empty;
                server_name             dev.continentalclothing.com;
                ssl_certificate         /etc/ssl/certs/continentalclothing.com.bundle.crt;
                ssl_certificate_key     /etc/ssl/certs/ccc_ssl.key;
                client_max_body_size    20M;
                location / {
                  proxy_set_header       X-Real-IP               $remote_addr;
                  proxy_set_header       X-Forwarded-For         $proxy_add_x_forwarded_for;
                  proxy_set_header       X-Forwarded-Proto       $scheme;
                  proxy_set_header       Host                    $http_host;
                  proxy_set_header       X-NginX-Proxy           true;
                  proxy_read_timeout     5m;
                  proxy_connect_timeout  5m;
                  proxy_pass             http://continental_clothing_upstream;
                  proxy_redirect         off;
                  proxy_http_version     1.1;
                  proxy_set_header       Upgrade $http_upgrade;
                  proxy_set_header       Connection "";
                  #proxy_cache           one;
                  #proxy_cache_key       sfs$request_uri$scheme;
                }
                location ~ ^/(images/|img/|javascript/|js/|css/|stylesheets/|flash/|media/|static/|robots.txt|humans.txt|favicon.ico) {
                  root /var/www;
                  access_log off;
                  expires max;
                }
        }
}