user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 1024;
    multi_accept on;
}

http {
    # Basic Settings
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    server_tokens off;

    # MIME
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # Zero-logs configuration
    # This completely disables all access logs
    access_log off;
    # Minimal error logs - critical only
    error_log /dev/null crit;

    # SSL Settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    
    # Headers to confuse fingerprinting
    # Microsoft-IIS/8.5 server header to throw off analysis
    #more_set_headers 'Server: Microsoft-IIS/8.5';
    add_header Server "Microsoft-IIS/8.5";
    server_name_in_redirect off;

    # OPSEC: Hide proxy headers
    proxy_hide_header X-Powered-By;
    proxy_hide_header X-AspNet-Version;
    proxy_hide_header X-Runtime;
    
    # IP Rotation and proxying
    real_ip_header X-Forwarded-For;
    set_real_ip_from 127.0.0.1;
    
    # Gzip Settings
    gzip off;  # Disabled to avoid BREACH attack
    
    # Virtual Host Configs
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}