Last active
July 31, 2021 19:57
-
-
Save thely/32ae2f5d6c284277874204500ec54026 to your computer and use it in GitHub Desktop.
nginx -T
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# configuration file /etc/nginx/nginx.conf: | |
user www-data; | |
worker_processes auto; | |
pid /run/nginx.pid; | |
events { | |
worker_connections 768; | |
# multi_accept on; | |
} | |
http { | |
## | |
# Basic Settings | |
## | |
sendfile on; | |
tcp_nopush on; | |
tcp_nodelay on; | |
keepalive_timeout 65; | |
types_hash_max_size 2048; | |
# server_tokens off; | |
# server_names_hash_bucket_size 64; | |
# server_name_in_redirect off; | |
include /etc/nginx/mime.types; | |
default_type application/octet-stream; | |
client_max_body_size 450M; | |
## | |
# SSL Settings | |
## | |
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE | |
ssl_prefer_server_ciphers on; | |
## | |
# Logging Settings | |
## | |
access_log /var/log/nginx/access.log; | |
error_log /var/log/nginx/error.log; | |
## | |
# Gzip Settings | |
## | |
gzip on; | |
gzip_disable "msie6"; | |
# gzip_vary on; | |
# gzip_proxied any; | |
# gzip_comp_level 6; | |
# gzip_buffers 16 8k; | |
# gzip_http_version 1.1; | |
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; | |
## | |
# Virtual Host Configs | |
## | |
include /etc/nginx/conf.d/*.conf; | |
include /etc/nginx/sites-enabled/*; | |
} | |
# configuration file /etc/nginx/mime.types: | |
types { | |
text/html html htm shtml; | |
text/css css; | |
text/xml xml; | |
image/gif gif; | |
image/jpeg jpeg jpg; | |
application/javascript js; | |
application/atom+xml atom; | |
application/rss+xml rss; | |
text/mathml mml; | |
text/plain txt; | |
text/vnd.sun.j2me.app-descriptor jad; | |
text/vnd.wap.wml wml; | |
text/x-component htc; | |
image/png png; | |
image/tiff tif tiff; | |
image/vnd.wap.wbmp wbmp; | |
image/x-icon ico; | |
image/x-jng jng; | |
image/x-ms-bmp bmp; | |
image/svg+xml svg svgz; | |
image/webp webp; | |
application/font-woff woff; | |
application/java-archive jar war ear; | |
application/json json; | |
application/mac-binhex40 hqx; | |
application/msword doc; | |
application/pdf pdf; | |
application/postscript ps eps ai; | |
application/rtf rtf; | |
application/vnd.apple.mpegurl m3u8; | |
application/vnd.ms-excel xls; | |
application/vnd.ms-fontobject eot; | |
application/vnd.ms-powerpoint ppt; | |
application/vnd.wap.wmlc wmlc; | |
application/vnd.google-earth.kml+xml kml; | |
application/vnd.google-earth.kmz kmz; | |
application/x-7z-compressed 7z; | |
application/x-cocoa cco; | |
application/x-java-archive-diff jardiff; | |
application/x-java-jnlp-file jnlp; | |
application/x-makeself run; | |
application/x-perl pl pm; | |
application/x-pilot prc pdb; | |
application/x-rar-compressed rar; | |
application/x-redhat-package-manager rpm; | |
application/x-sea sea; | |
application/x-shockwave-flash swf; | |
application/x-stuffit sit; | |
application/x-tcl tcl tk; | |
application/x-x509-ca-cert der pem crt; | |
application/x-xpinstall xpi; | |
application/xhtml+xml xhtml; | |
application/xspf+xml xspf; | |
application/zip zip; | |
application/octet-stream bin exe dll; | |
application/octet-stream deb; | |
application/octet-stream dmg; | |
application/octet-stream iso img; | |
application/octet-stream msi msp msm; | |
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; | |
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; | |
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; | |
audio/midi mid midi kar; | |
audio/mpeg mp3; | |
audio/ogg ogg; | |
audio/x-m4a m4a; | |
audio/x-realaudio ra; | |
video/3gpp 3gpp 3gp; | |
video/mp2t ts; | |
video/mp4 mp4; | |
video/mpeg mpeg mpg; | |
video/quicktime mov; | |
video/webm webm; | |
video/x-flv flv; | |
video/x-m4v m4v; | |
video/x-mng mng; | |
video/x-ms-asf asx asf; | |
video/x-ms-wmv wmv; | |
video/x-msvideo avi; | |
} | |
#### NOTE ––– THIS IS A WORDPRESS SITE THAT IS CURRENTLY INACTIVE (intentionally) ######## | |
# configuration file /etc/nginx/sites-enabled/site-1.conf: | |
limit_req_zone $binary_remote_addr zone=andlimit:10m rate=10r/s; | |
server { | |
server_name site-1.com; | |
root /var/www/html/site-1; | |
index index.php index.html; | |
client_max_body_size 450M; | |
location / { | |
limit_req zone=andlimit burst=20 nodelay; | |
try_files $uri $uri/ /index.php?$is_args$args; | |
} | |
location = /wp-admin { | |
limit_req zone=andlimit burst=10 nodelay; | |
} | |
location = /favicon.ico { log_not_found off; access_log off; } | |
location = /robots.txt { log_not_found off; access_log off; allow all; } | |
location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ { | |
expires max; | |
log_not_found off; | |
} | |
location ~ \.php$ { | |
include snippets/fastcgi-php.conf; | |
fastcgi_pass unix:/run/php/php7.2-fpm.sock; | |
# try_files $uri =404; | |
# fastcgi_pass 127.0.0.1:9000; | |
# fastcgi_index index.php; | |
# fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; | |
# include fastcgi_params; | |
} | |
location ~ /\.ht { | |
deny all; | |
} | |
listen 443 ssl; # managed by Certbot | |
ssl_certificate /etc/letsencrypt/live/andrea.become.monster/fullchain.pem; # managed by Certbot | |
ssl_certificate_key /etc/letsencrypt/live/andrea.become.monster/privkey.pem; # managed by Certbot | |
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot | |
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot | |
} | |
server { | |
if ($host = www.site-1.com) { | |
return 301 https://$host$request_uri; | |
} # managed by Certbot | |
if ($host = site-1.com) { | |
return 301 https://$host$request_uri; | |
} # managed by Certbot | |
server_name site-1.com www.site-1.com; | |
listen 80; | |
return 404; # managed by Certbot | |
} | |
# configuration file /etc/nginx/snippets/fastcgi-php.conf: | |
# regex to split $uri to $fastcgi_script_name and $fastcgi_path | |
fastcgi_split_path_info ^(.+\.php)(/.+)$; | |
# Check that the PHP script exists before passing it | |
try_files $fastcgi_script_name =404; | |
# Bypass the fact that try_files resets $fastcgi_path_info | |
# see: http://trac.nginx.org/nginx/ticket/321 | |
set $path_info $fastcgi_path_info; | |
fastcgi_param PATH_INFO $path_info; | |
fastcgi_index index.php; | |
include fastcgi.conf; | |
# configuration file /etc/nginx/fastcgi.conf: | |
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; | |
fastcgi_param QUERY_STRING $query_string; | |
fastcgi_param REQUEST_METHOD $request_method; | |
fastcgi_param CONTENT_TYPE $content_type; | |
fastcgi_param CONTENT_LENGTH $content_length; | |
fastcgi_param SCRIPT_NAME $fastcgi_script_name; | |
fastcgi_param REQUEST_URI $request_uri; | |
fastcgi_param DOCUMENT_URI $document_uri; | |
fastcgi_param DOCUMENT_ROOT $document_root; | |
fastcgi_param SERVER_PROTOCOL $server_protocol; | |
fastcgi_param REQUEST_SCHEME $scheme; | |
fastcgi_param HTTPS $https if_not_empty; | |
fastcgi_param GATEWAY_INTERFACE CGI/1.1; | |
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; | |
fastcgi_param REMOTE_ADDR $remote_addr; | |
fastcgi_param REMOTE_PORT $remote_port; | |
fastcgi_param SERVER_ADDR $server_addr; | |
fastcgi_param SERVER_PORT $server_port; | |
fastcgi_param SERVER_NAME $server_name; | |
# PHP only, required if PHP was built with --enable-force-cgi-redirect | |
fastcgi_param REDIRECT_STATUS 200; | |
# configuration file /etc/letsencrypt/options-ssl-nginx.conf: | |
# This file contains important security parameters. If you modify this file | |
# manually, Certbot will be unable to automatically provide future security | |
# updates. Instead, Certbot will print and log an error message with a path to | |
# the up-to-date file that you will need to refer to when manually updating | |
# this file. | |
ssl_session_cache shared:le_nginx_SSL:1m; | |
ssl_session_timeout 1440m; | |
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | |
ssl_prefer_server_ciphers on; | |
# ssl_ciphers hidden here, in case it matters | |
# configuration file /etc/nginx/sites-enabled/main-site.conf: | |
map $sent_http_content_type $expires { | |
"text/html" epoch; | |
"text/html; charset=utf-8" epoch; | |
default off; | |
} | |
## -------- This is the site that actually matters! ---------- | |
server { | |
listen 443 ssl http2; | |
server_name main-site.org www.main-site.org dev.main-site.org | |
gzip on; | |
gzip_types text/plain application/xml text/css application/javascript; | |
gzip_min_length 1000; | |
location / { | |
expires $expires; | |
proxy_redirect off; | |
proxy_set_header Host $host; | |
proxy_set_header X-Real-IP $remote_addr; | |
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
proxy_set_header X-Forwarded-Proto $scheme; | |
proxy_read_timeout 1m; | |
proxy_connect_timeout 1m; | |
proxy_pass http://127.0.0.1:3000; | |
} | |
ssl_certificate /etc/letsencrypt/live/main-site.org/fullchain.pem; # managed by Certbot | |
ssl_certificate_key /etc/letsencrypt/live/main-site.org/privkey.pem; # managed by Certbot | |
include /etc/letsencrypt/options-ssl-nginx.conf; | |
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; | |
} | |
server { | |
if ($host = www.main-site.org) { | |
return 301 https://$host$request_uri; | |
} | |
if ($host = main-site.org) { | |
return 301 https://$host$request_uri; | |
} | |
if ($host = dev.main-site.org) { | |
return 301 https://$host$request_uri; | |
} | |
listen 80; | |
server_name dev.main-site.org main-site.org www.main-site.org; | |
return 404; | |
} | |
# configuration file /etc/letsencrypt/options-ssl-nginx.conf: | |
# This file contains important security parameters. If you modify this file | |
# manually, Certbot will be unable to automatically provide future security | |
# updates. Instead, Certbot will print and log an error message with a path to | |
# the up-to-date file that you will need to refer to when manually updating | |
# this file. | |
ssl_session_cache shared:le_nginx_SSL:1m; | |
ssl_session_timeout 1440m; | |
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | |
ssl_prefer_server_ciphers on; | |
ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"; | |
# configuration file /etc/nginx/sites-enabled/birds.conf: | |
map $sent_http_content_type $expires { | |
"text/html" epoch; | |
"text/html; charset=utf-8" epoch; | |
default off; | |
} | |
server { | |
listen 443 ssl http2; | |
server_name birds.main-site.org; | |
gzip on; | |
gzip_types text/plain application/xml text/css application/javascript; | |
gzip_min_length 1000; | |
location / { | |
expires $expires; | |
proxy_redirect off; | |
proxy_set_header Host $host; | |
proxy_set_header X-Real-IP $remote_addr; | |
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
proxy_set_header X-Forwarded-Proto $scheme; | |
proxy_read_timeout 1m; | |
proxy_connect_timeout 1m; | |
proxy_pass http://127.0.0.1:5000; | |
} | |
ssl_certificate /etc/letsencrypt/live/birds.main-site.org/fullchain.pem; # managed by Certbot | |
ssl_certificate_key /etc/letsencrypt/live/birds.main-site.org/privkey.pem; # managed by Certbot | |
include /etc/letsencrypt/options-ssl-nginx.conf; | |
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; | |
} | |
server { | |
if ($host = birds.main-site.org) { | |
return 301 https://$host$request_uri; | |
} | |
listen 80; | |
server_name birds.main-site.org; | |
return 404; | |
} | |
# configuration file /etc/letsencrypt/options-ssl-nginx.conf: | |
# This file contains important security parameters. If you modify this file | |
# manually, Certbot will be unable to automatically provide future security | |
# updates. Instead, Certbot will print and log an error message with a path to | |
# the up-to-date file that you will need to refer to when manually updating | |
# this file. | |
ssl_session_cache shared:le_nginx_SSL:1m; | |
ssl_session_timeout 1440m; | |
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | |
ssl_prefer_server_ciphers on; | |
ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"; | |
# configuration file /etc/nginx/sites-enabled/over.conf: | |
upstream over_socket { | |
server 127.0.0.1:7000; | |
keepalive 64; | |
} | |
server { | |
# root /var/www/html/over-over/client; | |
server_name over.main-site.org further.main-site.org; | |
# ssl_certificate_key /etc/ssl/main.key; | |
# ssl_certificate /etc/ssl/main.crt; | |
location / { | |
proxy_redirect off; | |
proxy_http_version 1.1; | |
proxy_set_header Host $host; | |
proxy_set_header X-Real-IP $remote_addr; | |
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
proxy_set_header X-Forwarded-Proto $scheme; | |
proxy_set_header X-NginX-Proxy true; | |
proxy_read_timeout 1m; | |
proxy_connect_timeout 1m; | |
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
# proxy_set_header X-Real-IP $remote_addr; | |
# proxy_set_header Host $host; | |
# proxy_cache_bypass $http_upgrade; | |
# proxy_http_version 1.1; | |
proxy_set_header Upgrade $http_upgrade; | |
proxy_set_header Connection "upgrade"; | |
proxy_pass http://over_socket; | |
# proxy_pass http://localhost:7000/; | |
# proxy_redirect off; | |
# proxy_read_timeout 240s; | |
} | |
listen 443 ssl; # managed by Certbot | |
ssl_certificate /etc/letsencrypt/live/further.main-site.org/fullchain.pem; # managed by Certbot | |
ssl_certificate_key /etc/letsencrypt/live/further.main-site.org/privkey.pem; # managed by Certbot | |
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot | |
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot | |
} | |
server { | |
if ($host = over.main-site.org) { | |
return 301 https://$host$request_uri; | |
} # managed by Certbot | |
if ($host = further.main-site.org) { | |
return 301 https://$host$request_uri; | |
} | |
listen 80; | |
server_name over.main-site.org further.main-site.org; | |
return 404; # managed by Certbot | |
} | |
# configuration file /etc/letsencrypt/options-ssl-nginx.conf: | |
# This file contains important security parameters. If you modify this file | |
# manually, Certbot will be unable to automatically provide future security | |
# updates. Instead, Certbot will print and log an error message with a path to | |
# the up-to-date file that you will need to refer to when manually updating | |
# this file. | |
ssl_session_cache shared:le_nginx_SSL:1m; | |
ssl_session_timeout 1440m; | |
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | |
ssl_prefer_server_ciphers on; | |
# ssl_ciphers removed in case it matters |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment