Справочник по конфигурации Nginx

worker_processes auto;

events {
    worker_connections 1024;
}

include /etc/nginx/mime.types;
default_type application/octet-stream;

sendfile on;
tcp_nopush on;
tcp_nodelay on;

keepalive_timeout 65;

client_max_body_size 100M;

server_tokens off;

server {
    listen 80;
    server_name example.com;
    root /var/www/html;
    index index.html;
}

server_name example.com www.example.com;

server_name *.example.com;

listen 80 default_server;

listen [::]:80;

root /var/www/html;
# или использовать alias
alias /var/www/files/;

location = /path {
    # точное совпадение
}

location /api/ {
    # префиксное совпадение
}

location ~ \.php$ {
    # регулярное совпадение (регистрозависимое)
}

location ~* \.\(jpg|jpeg|png|gif\)$ {
    # регулярное совпадение (независимое от регистра)
}

location ^~ /images/ { # Приоритетное сопоставление префикса }

location / { try_files $uri $uri/ /index.html; }

location /internal/ { internal; }

location /api/ { proxy_pass http://backend:3000/; }

proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme;

location /ws/ { proxy_pass http://backend:3000/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; }

upstream backend { server 127.0.0.1:3000; server 127.0.0.1:3001; keepalive 32; }

upstream backend { least_conn; # или ip_hash; server 127.0.0.1:3000; server 127.0.0.1:3001; }

proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s;

proxy_buffering on; proxy_buffer_size 4k; proxy_buffers 8 4k;

server { listen 443 ssl http2; ssl_certificate /path/to/cert.pem; ssl_certificate_key /path/to/key.pem; }

ssl_protocols TLSv1.2 TLSv1.3;

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256; ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d;

server { listen 80; server_name example.com; return 301 https://$server_name$request_uri; }

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s;

location ~* \. (css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ { expires 30d; add_header Cache-Control "public, immutable"; }

location /api/ { add_header Cache-Control "no-store, no-cache, must-revalidate"; }

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=1g; location / { proxy_cache my_cache; proxy_cache_valid 200 1d; }

etag on;

if_modified_since before;

gzip on; gzip_vary on; gzip_min_length 1024; gzip_comp_level 6;

gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml;

gzip_proxied any;

gzip_static on;

add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,Content-Type";

add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'";

limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;

location /api/ {
    limit_req zone=one burst=20 nodelay;
}

location ~ /\. {
    deny all;
}

location /admin/ {
    allow 192.168.1.0/24;
    deny all;
}

access_log /var/log/nginx/access.log;

error_log /var/log/nginx/error.log warn;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" "$http_x_forwarded_for"';

log_format json escape=json '{"time":"$time_iso8601","ip":"$remote_addr","method":"$request_method","uri":"$uri","status":$status}';

access_log off;

map $status $loggable {
    ~^[23] 0;
    default 1;
}
access_log /var/log/nginx/access.log combined if=$loggable;

open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;

events {
    multi_accept on;
    use epoll;
}

fastcgi_cache_path /var/cache/nginx/fastcgi levels=1:2 keys_zone=fastcgi:10m;

location ~ \.php$ {
    fastcgi_cache fastcgi;
    fastcgi_cache_valid 200 1h;
}

limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 100;

client_body_timeout 12;
client_header_timeout 12;
send_timeout 10;