Configure a performance, secure, and stable NGINX server

general.conf

# favicon.ico
location = /favicon.ico {
    log_not_found off;
    access_log    off;
}

# robots.txt
location = /robots.txt {
    log_not_found off;
    access_log    off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires    7d;
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires    7d;
    access_log off;
}

# gzip
gzip            on;
gzip_vary       on;
gzip_proxied    any;
gzip_comp_level 6;
gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

nginx.conf

# Server globals
user nginx;

# Set number of worker processes automatically based on number of CPU cores.
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 65535;

# Configures default error logger.
#error_log /var/log/nginx/error.log crit;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;

# Includes files with directives to load dynamic modules.
#load_module modules/ngx_http_modsecurity_module.so;

# Worker config
events {
	# determines how much clients will be served per worker
	# max clients = worker_connections * worker_processes
	# max clients is also limited by the number of socket connections available on the system (~64k)
	worker_connections 4096;

	# optmized to serve many clients with each thread, essential for linux
	use epoll;

	# accept as many connections as possible, may flood worker connections if set too low
	multi_accept on;
}

http {
	# Main settings
	limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=30r/m;
	limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;

	# Enable of asynchronous file I/O works on linux
	aio threads;
	aio_write on;

	# copies data between one FD and other from within the kernel
	# faster then read() + write()
	sendfile on;

	# send headers in one peace, its better then sending them one by one
	tcp_nopush on;

	# don't buffer data sent, good for small data bursts in real time
	tcp_nodelay on;
	
	# allow the server to close connection on non responding client, this will free up memory
	reset_timedout_connection on;

	# Nginx Simple DDoS Defense
	client_header_timeout 1m;
	client_body_timeout 1m;
	client_header_buffer_size 2k;
	client_body_buffer_size 256k;
	client_max_body_size 16m;
	large_client_header_buffers 4 8k;
	
	# Just For Security Reason
	server_tokens off;
	server_name_in_redirect off;
	server_names_hash_max_size 512;
	server_names_hash_bucket_size 512;

	# Log format
	log_format main	'$remote_addr - $remote_user [$time_local] $request '
			'"$status" $body_bytes_sent "$http_referer" '
			'"$http_user_agent" "$http_x_forwarded_for"';
	log_format bytes '$body_bytes_sent';

	# to boost I/O on HDD we can disable access logs
	#access_log /var/log/nginx/access.log main;
	access_log off;

	# Mime settings
	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	# Proxy settings
	proxy_http_version 1.1;
	proxy_cache_bypass $http_upgrade;

	# Proxy headers
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "upgrade";
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto $scheme;
	proxy_set_header X-Forwarded-Host $host;
	proxy_set_header X-Forwarded-Port $server_port;

	# Proxy timeouts
	proxy_connect_timeout 60s;
	proxy_send_timeout 90s;
	proxy_read_timeout 90s;

	# Restore Real IP Cloudflare https://www.cloudflare.com/ips
	set_real_ip_from 103.21.244.0/22;
	set_real_ip_from 103.22.200.0/22;
	set_real_ip_from 103.31.4.0/22;
	set_real_ip_from 104.16.0.0/12;
	set_real_ip_from 108.162.192.0/18;
	set_real_ip_from 131.0.72.0/22;
	set_real_ip_from 141.101.64.0/18;
	set_real_ip_from 162.158.0.0/15;
	set_real_ip_from 172.64.0.0/13;
	set_real_ip_from 173.245.48.0/20;
	set_real_ip_from 188.114.96.0/20;
	set_real_ip_from 190.93.240.0/20;
	set_real_ip_from 197.234.240.0/22;
	set_real_ip_from 198.41.128.0/17;
	set_real_ip_from 2400:cb00::/32;
	set_real_ip_from 2606:4700::/32;
	set_real_ip_from 2803:f800::/32;
	set_real_ip_from 2405:b500::/32;
	set_real_ip_from 2405:8100::/32;
	set_real_ip_from 2c0f:f248::/32;
	set_real_ip_from 2a06:98c0::/29;

	# Use real IPs
	real_ip_header CF-Connecting-IP;
	#real_ip_header X-Forwarded-For;

	# OCSP Stapling
	ssl_stapling on;
	ssl_stapling_verify on;
	resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s;
	resolver_timeout 2s;

	# SSL PCI Compliance
	ssl_session_timeout 1d;
	ssl_session_cache shared:SSL:10m;
	ssl_session_tickets off;
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_prefer_server_ciphers on;
	ssl_ecdh_curve X25519:prime256v1:secp384r1;
	
	# Server Side TLS
	# SSL/TLS Configuration Generator
	# https://mozilla.github.io/server-side-tls/ssl-config-generator/
	
	# Oldest compatible clients
	# Firefox 1, Chrome 1, IE 8 on Windows 7, Opera 5, Safari 1, Android 2.3, Java 7
	ssl_ciphers "ECDHE+CHACHA20:ECDHE+AESGCM:DHE+AESGCM:ECDHE+AES:DHE+AES:RSA+AESGCM:RSA+AES:!DES-CBC3-SHA:!DSS";

	# DH parameter for Perfect Forward Secrecy
	# openssl dhparam -dsaparam -out /etc/ssl/dhparam.pem 4096
	ssl_dhparam /etc/ssl/dhparam.pem;

	# Various security headers
	add_header X-Frame-Options           "SAMEORIGIN";
	add_header X-XSS-Protection          "1; mode=block";
	add_header X-Content-Type-Options    "nosniff";
	add_header Referrer-Policy           "no-referrer-when-downgrade";
	add_header Content-Security-Policy   "default-src 'self' http: https: data: blob: 'unsafe-inline'";
	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

	# Error pages
	error_page 403		/var/www/error/403.html;
	error_page 404		/var/www/error/404.html;
	error_page 502 503 504	/var/www/error/500.html;

	# Cache
	proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=512m;
	proxy_cache_key md5("$host$request_uri$cookie_user");
	proxy_temp_path /var/cache/nginx/temp;
	proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
	proxy_cache_use_stale error timeout invalid_header updating http_502;
	proxy_cache_valid any 24h;
	proxy_cache_bypass $http_upgrade;

	# Cache bypass
	map $http_cookie $no_cache {
		default 0;
		~SESS 1;
		~wordpress_logged_in 1;
	}

	# File cache settings
	open_file_cache max=10000 inactive=30s;
	open_file_cache_valid 60s;
	open_file_cache_min_uses 2;
	open_file_cache_errors off;
	
	# ModSecurity
	#modsecurity on;
	#modsecurity_rules_file /etc/nginx/modsec/main.conf;

	# Wildcard include
	include /etc/nginx/conf.d/http/*.conf;
}

stream {
	resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s;
	resolver_timeout 2s;

	# Wildcard include
	include /etc/nginx/conf.d/stream/*.conf;
}

php_fastcgi.conf

# 404
try_files $fastcgi_script_name =404;

# default fastcgi_params
include fastcgi_params;

# fastcgi settings
fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
fastcgi_index index.php;
fastcgi_buffers 8 16k;
fastcgi_buffer_size 32k;

# fastcgi params
fastcgi_param DOCUMENT_ROOT $realpath_root;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param PHP_ADMIN_VALUE "open_basedir=$base/:/usr/lib/php/:/tmp/";

proxy.conf

# Proxy Config
proxy_http_version 1.1;
proxy_cache_bypass $http_upgrade;

# Proxy headers
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;

# Proxy timeouts
proxy_connect_timeout 60s;
proxy_send_timeout 90s;
proxy_read_timeout 90s;