# MANAGED BY PUPPET
load_module "modules/ngx_http_geoip_module.so";
user wwwserver wwwserver;
worker_processes auto;
worker_rlimit_nofile 10000;

pid        /var/run/nginx.pid;


events {
  accept_mutex on;
  accept_mutex_delay 500ms;
  worker_connections 10000;
}

http {

  client_header_buffer_size   16k;
  disable_symlinks            if_not_owner from=$document_root;
  geoip_city                  /usr/share/GeoIP/GeoIPCity.dat;
  geoip_country               /usr/share/GeoIP/GeoIPv6.dat;
  ignore_invalid_headers      off;
  limit_conn                  vhost-limit 312;
  limit_conn_zone             $host zone=vhost-limit:10m;
  limit_req_zone              $limit_req_key zone=limitreq:500m rate=128r/s;
  log_not_found               off;
  map_hash_bucket_size        640;
  map_hash_max_size           20480;
  proxy_buffering             off;
  proxy_cache                 off;
  proxy_cache_key             $scheme$proxy_host$request_uri;
  proxy_cache_path            /var/spool/nginx/proxy_cache levels=2 keys_zone=nginxcache:20m;
  proxy_cache_use_stale       off;
  proxy_headers_hash_max_size 1024;
  proxy_next_upstream         invalid_header;
  real_ip_header              X-Real-IP;
  real_ip_recursive           on;
  reset_timedout_connection   on;
  set_real_ip_from            10.0.0.0/8;
  include       mime.types;
  default_type  application/octet-stream;
  log_format main ''
'$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"'
'';

  access_log /home/log/nginx/access.log;
  error_log /home/log/nginx/error.log warn;


  sendfile on;
  tcp_nopush on;
  server_tokens off;

  types_hash_max_size 1024;
  types_hash_bucket_size 512;

  server_names_hash_bucket_size 2048;
  server_names_hash_max_size 2097152;

  keepalive_timeout   10s 10s;
  keepalive_requests  100;
  client_body_timeout 10m;
  send_timeout        60s;
  lingering_timeout   5s;
  tcp_nodelay         on;

  gzip              on;
  gzip_comp_level   6;
  gzip_disable      msie6;
  gzip_min_length   20;
  gzip_http_version 1.0;
  gzip_proxied      any;
  gzip_types        text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;
  gzip_vary         on;

  client_body_temp_path   /run/nginx/client_body_temp;
  client_max_body_size    80M;
  client_body_buffer_size 8m;
  proxy_redirect          off;
  proxy_temp_path         /run/nginx/proxy_temp;
  proxy_connect_timeout   75s;
  proxy_send_timeout      10m;
  proxy_read_timeout      10m;
  proxy_buffers           512 16k;
  proxy_buffer_size       128k;
  proxy_http_version      1.1;
  proxy_set_header        Host $host;
  proxy_set_header        Port $mh_forwarded_port;
  proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header        X-Real-IP $remote_addr;
  proxy_set_header        X-Forwarded-Port $mh_forwarded_port;
  proxy_set_header        Connection "";
  proxy_set_header        X-MH-Forwarded-Proto "";
  proxy_set_header        X-MH-Backend-IP "";
  proxy_set_header        X-MH-Host $server_name;
  proxy_pass_header        Server;
  proxy_headers_hash_bucket_size 64;

  ssl_dhparam               /etc/nginx/ssl/dhparams.pem;
  ssl_session_cache         shared:SSL:10m;
  ssl_session_timeout       10m;
  ssl_session_tickets       off;
  ssl_protocols             TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
  ssl_ciphers               ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_prefer_server_ciphers on;
  ssl_stapling              off;
  ssl_stapling_verify       off;

  include                    ctrlsh/*.conf;
  proxy_temp_file_write_size 128k;


  include /etc/nginx/conf.d/*.conf;
  include /etc/nginx/sites-enabled/*;
}