n0mad1k
59 lines
1.5 KiB
Django/Jinja
59 lines
1.5 KiB
Django/Jinja
user www-data;
|
|
worker_processes auto;
|
|
pid /run/nginx.pid;
|
|
include /etc/nginx/modules-enabled/*.conf;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
multi_accept on;
|
|
}
|
|
|
|
http {
|
|
# Basic Settings
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
types_hash_max_size 2048;
|
|
server_tokens off;
|
|
|
|
# MIME
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# Zero-logs configuration
|
|
# This completely disables all access logs
|
|
access_log off;
|
|
# Minimal error logs - critical only
|
|
error_log /dev/null crit;
|
|
|
|
# SSL Settings
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_tickets off;
|
|
|
|
# Headers to confuse fingerprinting
|
|
# Microsoft-IIS/8.5 server header to throw off analysis
|
|
add_header Server "Microsoft-IIS/8.5";
|
|
server_name_in_redirect off;
|
|
|
|
# OPSEC: Hide proxy headers
|
|
proxy_hide_header X-Powered-By;
|
|
proxy_hide_header X-AspNet-Version;
|
|
proxy_hide_header X-Runtime;
|
|
|
|
# IP Rotation and proxying
|
|
real_ip_header X-Forwarded-For;
|
|
set_real_ip_from 127.0.0.1;
|
|
|
|
# Gzip Settings
|
|
gzip off; # Disabled to avoid BREACH attack
|
|
|
|
# Virtual Host Configs
|
|
include /etc/nginx/conf.d/*.conf;
|
|
include /etc/nginx/sites-enabled/*;
|
|
}
|