Lab 023

user nginx;
worker_processes 8;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections   1024;
    use epoll;
    multi_accept on;
}

http {
    include                     mime.types;

    keepalive_timeout           65;
    keepalive_requests          10000;
    sendfile                    on;
    tcp_nopush                  on;
    tcp_nodelay                 on;
    server_tokens               off;

    client_header_buffer_size   1k;
    large_client_header_buffers 4 4k;
    output_buffers              1 32k;
    postpone_output             1460;

    client_header_timeout       3m;
    client_body_timeout         3m;
    send_timeout                3m;

    open_file_cache max=1000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 5;
    open_file_cache_errors off;

    gzip on;
    gzip_min_length  1000;
    gzip_buffers     4 4k;
    gzip_types       application/x-javascript text/css application/javascript text/javascript text/plain text/xml application/json application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/xml font/eot font/opentype font/otf image/svg+xml image/vnd.microsoft.icon;
    gzip_disable "MSIE [1-6]\.";

    log_format main      '$remote_addr - $remote_user [$time_local]  '
      '"$request" $status $bytes_sent '
      '"$http_referer" "$http_user_agent" '
      '"$gzip_ratio"';

    log_format download  '$remote_addr - $remote_user [$time_local]  '
      '"$request" $status $bytes_sent '
      '"$http_referer" "$http_user_agent" '
      '"$http_range" "$sent_http_content_range"';

    ########################################
    # Reverse Proxy Config
    ########################################
    proxy_redirect          off;
    proxy_set_header        Host                $host;
    proxy_set_header        X-Real-IP           $remote_addr;
    proxy_set_header        X-Forwarded-Proto   $scheme;
    proxy_set_header        X-Forwarded-For     $proxy_add_x_forwarded_for;
    client_max_body_size    10m;
    client_body_buffer_size 128k;
    proxy_connect_timeout   180;
    proxy_send_timeout      180;
    proxy_read_timeout      180;
    proxy_buffers           32 4k;

    server
    {
        listen          80;
        listen          443 ssl http2 default_server;
        server_name     023sec.com;
        underscores_in_headers      on;
        server_name_in_redirect     off;
        error_page 404 = /404.html;
        ########################################
        # Security Config
        ########################################
        resolver 223.5.5.5;
        add_header X-Frame-Options "DENY";
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Content-Type-Options nosniff;
        add_header Public-Key-Pins 'pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; pin-sha256="aef6IF2UF6jNEwA2pNmP7kpgT6NFSdt7Tqf5HzaIGWI="; max-age=5184000; includeSubDomains; report-uri="https://***.com/noHPKP"' always;
        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" always;

        ########################################
        # SSL Config
        ########################################
        ssl_session_cache               shared:SSL:10m;
        ssl_session_timeout             10m;
        ssl_session_tickets             off;
        ssl_certificate                 /etc/letsencrypt/live/***.com/fullchain.pem;
        ssl_certificate_key             /etc/letsencrypt/live/***.com/privkey.pem;
        ssl_dhparam                     /etc/letsencrypt/live/***.com/dhparams.pem.4096;
        ssl_ecdh_curve                  secp384r1:secp521r1;
        ssl_verify_client               off;
        ssl_protocols                   TLSv1.2;
        ssl_ciphers                     'CHACHA20:ECDH+AES256:DHE+AES256:!aNULL:!MD5:!DSS';

        ssl_prefer_server_ciphers       on;
        ssl_stapling                    on;
        ssl_stapling_verify             on;

        ########################################
        # Force https
        ########################################
        if ($scheme = http) {
            return 301 https://***.com$request_uri;
        }

        ########################################
        # Reverse Proxy config
        ########################################
        proxy_redirect          off;
        proxy_set_header        Host                $host;
        proxy_set_header        X-Real-IP           $remote_addr;
        proxy_set_header        X-Forwarded-Proto   $scheme;
        proxy_set_header        X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_set_header        Cookie              $http_cookie;
        client_max_body_size    64m;
        client_body_buffer_size 128k;
        proxy_connect_timeout   180;
        proxy_send_timeout      180;
        proxy_read_timeout      180;
        proxy_buffers           32 4k;

        location / {
            access_log      /var/log/nginx/access.log;
            error_log       /var/log/nginx/error.log warn;
            proxy_pass      http://localhost:48080;
            index           index.html index.htm index.jsp;
        }

        location /nginx_status
        {
           stub_status on;
           access_log off;
           allow 127.0.0.1;
           deny all;
        }

        location /api/ {
            proxy_pass      http://127.0.0.1:10001;
            index           index.html index.htm index.jsp;
        }

        error_page   500 502 503 504 /50x.html;
        location = /50x.html {
            root   html;
        }
    }
}