add nginx configuration

2025-08-09 14:52:27 -04:00 · 2021-05-24 13:52:50 -04:00 · 2021-05-24 13:52:50 -04:00 · b5b55be1a6
commit b5b55be1a6
3 changed files with 224 additions and 0 deletions
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@ -0,0 +1,124 @@
+# nginx 1.20.x
+
+load_module modules/ngx_http_brotli_static_module.so;
+
+worker_processes auto;
+worker_rlimit_nofile 16384;
+
+events {
+    worker_connections 4096;
+}
+
+http {
+    include mime.types;
+    default_type application/octet-stream;
+
+    charset utf-8;
+
+    sendfile on;
+    sendfile_max_chunk 512k;
+    tcp_nopush on;
+    keepalive_timeout 3m;
+    server_tokens off;
+    msie_padding off;
+
+    client_max_body_size 1k;
+    client_body_buffer_size 1k;
+    client_header_buffer_size 1k;
+    large_client_header_buffers 4 4k;
+    http2_recv_buffer_size 128k;
+
+    client_body_timeout 30s;
+    client_header_timeout 30s;
+    send_timeout 30s;
+
+    http2_max_concurrent_streams 32;
+    limit_conn_status 429;
+    limit_conn_zone $binary_remote_addr zone=addr:10m;
+    limit_conn addr 256;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256;
+    ssl_prefer_server_ciphers on;
+    ssl_conf_command Options PrioritizeChaCha;
+
+    ssl_certificate /etc/letsencrypt/live/matrix.grapheneos.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/matrix.grapheneos.org/privkey.pem;
+
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    # maintained by nginx-rotate-session-ticket-keys in ramfs
+    ssl_session_ticket_key session-ticket-keys/4.key;
+    ssl_session_ticket_key session-ticket-keys/3.key;
+    ssl_session_ticket_key session-ticket-keys/2.key;
+    ssl_session_ticket_key session-ticket-keys/1.key;
+    ssl_buffer_size 4k;
+
+    ssl_trusted_certificate /etc/letsencrypt/live/matrix.grapheneos.org/chain.pem;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    # maintained by certbot-ocsp-fetcher
+    ssl_stapling_file ocsp-cache/matrix.grapheneos.org.der;
+
+    log_format main '$remote_addr - $remote_user [$time_local] '
+                    '"$request_method $scheme://$host$request_uri $server_protocol" $status $body_bytes_sent '
+                    '"$http_referer" "$http_user_agent"';
+    access_log /var/log/nginx/access.log main buffer=64k flush=1m;
+    error_log /var/log/nginx/error.log;
+    log_not_found off;
+
+    upstream backend {
+        server [::1]:8008 fail_timeout=1s;
+    }
+
+    server {
+        listen 80 backlog=4096;
+        listen [::]:80 backlog=4096;
+        server_name matrix.grapheneos.org;
+
+        root /var/empty;
+
+        return 301 https://matrix.grapheneos.org$request_uri;
+    }
+
+    server {
+        listen 443 ssl http2 backlog=4096;
+        listen [::]:443 ssl http2 backlog=4096;
+        server_name matrix.grapheneos.org;
+
+        root /var/empty;
+
+        include snippets/security-headers.conf;
+
+        location = / {
+            return 301 https://grapheneos.org/articles/grapheneos-servers#matrix.grapheneos.org;
+        }
+
+        location ~* ^(\/_matrix|\/_synapse\/client) {
+            include snippets/security-headers.conf;
+            add_header X-Robots-Tag "none";
+
+            proxy_pass http://backend;
+            proxy_set_header X-Forwarded-For $remote_addr;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Host $host;
+
+            client_max_body_size 50m;
+            client_body_buffer_size 16k;
+        }
+
+        location / {
+            return 404;
+        }
+    }
+
+    server {
+        listen 127.0.0.1:81;
+        listen [::1]:81;
+
+        location /nginx_status {
+            stub_status;
+            access_log off;
+        }
+    }
+}