Skip to content

Instantly share code, notes, and snippets.

@hilja
Last active August 17, 2020 06:19
Show Gist options
  • Save hilja/10869876 to your computer and use it in GitHub Desktop.
Save hilja/10869876 to your computer and use it in GitHub Desktop.
My NGinx configuration files. In no means the perfect setup. /etc/nginx/nginx.conf is the main conf file.
# Global configuration file.
# ESSENTIAL : Configure Nginx Listening Port
#listen 127.0.0.1:8080;
listen 80;
# ESSENTIAL : Default file to serve. If the first file isn't found
index index.php index.html index.htm;
# ESSENTIAL : no favicon logs
location = /favicon.ico {
log_not_found off;
access_log off;
}
# ESSENTIAL : robots.txt
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# ESSENTIAL : Configure 404 Pages
error_page 404 /404.html;
# ESSENTIAL : Configure 50x Pages
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/www;
}
# SECURITY : Deny all attempts to access hidden files .abcde
location ~ /\. {
deny all;
}
# Set expires to year on static file types
location ~* ^.+\.(css|js|jpg|jpeg|gif|png|ico|gz|svg|svgz|ttf|otf|woff|eot|mp4|ogg|ogv|webm)$ {
expires 365d;
#root /sites/example.com/public;
access_log off;
}
# Cache control recommended by google
#location ~* \.js$ {
# add_header Cache-Control public;
# add_header Vary Accept-Encoding;
# #expires 1d;
#}
# Based on this:
# https://github.com/darktable/html5-boilerplate-server-configs
# Set another default user than root for security reasons
user www-data;
# As a thumb rule: One per CPU. If you are serving a large amount
# of static files, which requires blocking disk reads, you may want
# to increase this from the number of cpu_cores available on your
# system.
#
# The maximum number of connections for Nginx is calculated by:
# max_clients = worker_processes * worker_connections
worker_processes 1;
# Maximum file descriptors that can be opened per process
# This should be > worker_connections
worker_rlimit_nofile 8192;
events {
# When you need > 8000 * cpu_cores connections, you start optimizing
# your OS, and this is probably the point at where you hire people
# who are smarter than you, this is *a lot* of requests.
worker_connections 8000;
# This sets up some smart queueing for accept(2)'ing requests
# Set it to "on" if you have > worker_processes
accept_mutex off;
# This was in the original config file
# multi_accept on;
# These settings are OS specific, by defualt Nginx uses select(2),
# however, for a large number of requests epoll(2) and kqueue(2)
# are generally faster than the default (select(2))
# use epoll; # enable for Linux 2.6+
# use kqueue; # enable for *BSD (FreeBSD, OS X, ..)
}
# Change these paths to somewhere that suits you!
error_log logs/error.log;
pid /var/run/nginx.pid;
http {
# Set the mime-types via the mime.types external file
include /etc/nginx/mime.types;
# And the fallback mime-type
default_type application/octet-stream;
# Format for our log files
log_format main '$remote_addr - $remote_user [$time_local] $status '
'"$request" $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
# Log
#access_log /var/log/nginx/access.log;
# ~2 seconds is often enough for HTML/CSS, but connections in
# Nginx are cheap, so generally it's safe to increase it
keepalive_timeout 5;
# You usually want to serve static files with Nginx
sendfile on;
tcp_nopush on; # off may be better for Comet/long-poll stuff
tcp_nodelay on; # on may be better for Comet/long-poll stuff
# Enable Gzip
gzip on;
# http://stackoverflow.com/questions/5131916/how-to-deflate-js-file-in-nginx
gzip_http_version 1.1;
# http://phrogz.net/effects-of-gzip_comp_level-on-html
gzip_comp_level 6;
gzip_min_length 20;
# Set to be high
gzip_buffers 16 8k;
# https://github.com/darktable/html5-boilerplate-server-configs/blob/master/nginx.conf
gzip_proxied any;
gzip_types
# text/html is always compressed by HttpGzipModule
text/css
text/javascript
text/x-javascript
text/xml
text/plain
text/x-component
application/javascript
application/x-javascript
application/json
application/xml
application/rss+xml
font/truetype
font/opentype
application/vnd.ms-fontobject
image/svg+xml;
gzip_static on;
gzip_disable "MSIE [1-6]\.";
gzip_vary on;
# End the html5 boilerplate rules here
# Begin the default nginx conf
types_hash_max_size 2048;
server_tokens off;
server_names_hash_bucket_size 64;
# server_name_in_redirect off;
##
# Virtual Host Configs
##
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
fastcgi_buffers 8 16k;
fastcgi_buffer_size 32k;
fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
}
# WORDPRESS : Rewrite rules, sends everything through index.php and keeps the appended query string intact
location / {
try_files $uri $uri/ /index.php?q=$uri&$args;
}
# SECURITY : Deny all attempts to access PHP Files in the uploads directory
location ~* /(?:uploads|files)/.*\.php$ {
deny all;
}
# REQUIREMENTS : Enable PHP Support
location ~ \.php$ {
# SECURITY : Zero day Exploit Protection
try_files $uri =404;
# ENABLE : Enable PHP, listen fpm sock
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
}
# PLUGINS : Enable Rewrite Rules for Yoast SEO SiteMap
rewrite ^/sitemap_index\.xml$ /index.php?sitemap=1 last;
rewrite ^/([^/]+?)-sitemap([0-9]+)?\.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment