Nginx-Konfigurations-Quick-Reference

worker_processes auto;

events {
    worker_connections 1024;
}

include /etc/nginx/mime.types;
default_type application/octet-stream;

sendfile on;
tcp_nopush on;
tcp_nodelay on;

keepalive_timeout 65;

client_max_body_size 100M;

server_tokens off;

server {
    listen 80;
    server_name example.com;
    root /var/www/html;
    index index.html;
}

server_name example.com www.example.com;

server_name *.example.com;

listen 80 default_server;

listen [::]:80;

root /var/www/html;
# Oder mit alias
alias /var/www/files/;

location = /path {
    # Genauer Abgleich
}

location /api/ {
    # Präfixabgleich
}

location ~ \.php$ {
    # Regulärer Ausdruck (Groß-/Kleinschreibung beachtet)
}

location ~* \.\(jpg|jpeg|png|gif)$ {
    # Regulärer Ausdruck (Groß-/Kleinschreibung nicht beachtet)
}

location ^~ /images/ {\n    # Prioritätspräfixübereinstimmung\n}

location / {\n    try_files $uri $uri/ /index.html;\n}

location /internal/ {\n    internal;\n}

location /api/ {\n    proxy_pass http://backend:3000/;\n}

proxy_set_header Host $host;\nproxy_set_header X-Real-IP $remote_addr;\nproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\nproxy_set_header X-Forwarded-Proto $scheme;

location /ws/ {\n    proxy_pass http://backend:3000/;\n    proxy_http_version 1.1;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection "upgrade";\n}

upstream backend {\n    server 127.0.0.1:3000;\n    server 127.0.0.1:3001;\n    keepalive 32;\n}

upstream backend {\n    least_conn;  # oder ip_hash;\n    server 127.0.0.1:3000;\n    server 127.0.0.1:3001;\n}

proxy_connect_timeout 60s;\nproxy_send_timeout 60s;\nproxy_read_timeout 60s;

proxy_buffering on;\nproxy_buffer_size 4k;\nproxy_buffers 8 4k;

server {\n    listen 443 ssl http2;\n    ssl_certificate /path/to/cert.pem;\n    ssl_certificate_key /path/to/key.pem;\n}

ssl_protocols TLSv1.2 TLSv1.3;

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;\nssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;\nssl_session_timeout 1d;

server {\n    listen 80;\n    server_name example.com;\n    return 301 https://$server_name$request_uri;\n}

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

ssl_stapling on;\nssl_stapling_verify on;\nresolver 8.8.8.8 8.8.4.4 valid=300s;

location ~* \.\(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2\)$ {\n    expires 30d;\n    add_header Cache-Control "public, immutable";\n}

location /api/ {\n    add_header Cache-Control "no-store, no-cache, must-revalidate";\n}

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=1g;\n\nlocation / {\n    proxy_cache my_cache;\n    proxy_cache_valid 200 1d;\n}

etag on;

if_modified_since before;

gzip on;\ngzip_vary on;\ngzip_min_length 1024;\ngzip_comp_level 6;\n

gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml;

gzip_proxied any;

gzip_static on;

add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,Content-Type";

add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'";

limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;

location /api/ {
    limit_req zone=one burst=20 nodelay;
}

location ~ /\.{
    deny all;
}

location /admin/ {
    allow 192.168.1.0/24;
    deny all;
}

access_log /var/log/nginx/access.log;

error_log /var/log/nginx/error.log warn;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" "$http_x_forwarded_for"';

log_format json escape=json '{"time":"$time_iso8601","ip":"$remote_addr","method":"$request_method","uri":"$uri","status":$status}';

access_log off;

map $status $loggable {
    ~^[23] 0;
    default 1;
}
access_log /var/log/nginx/access.log combined if=$loggable;

open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;

events {
    multi_accept on;
    use epoll;
}

fastcgi_cache_path /var/cache/nginx/fastcgi levels=1:2 keys_zone=fastcgi:10m;

location ~ \.php$ {
    fastcgi_cache fastcgi;
    fastcgi_cache_valid 200 1h;
}

limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 100;

client_body_timeout 12;
client_header_timeout 12;
send_timeout 10;