{"id":21032712,"url":"https://github.com/quiteafancyemerald/fast-production-nginx-template","last_synced_at":"2025-04-12T13:21:47.172Z","repository":{"id":223821160,"uuid":"761639767","full_name":"QuiteAFancyEmerald/Fast-Production-NGINX-Template","owner":"QuiteAFancyEmerald","description":"This repository offers a quick and easy-to-clone setup for a high-performance production reverse proxy using NGINX, complete with essential connection management and DDoS mitigation features.","archived":false,"fork":false,"pushed_at":"2024-09-22T23:25:30.000Z","size":35,"stargazers_count":2,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-26T08:02:42.603Z","etag":null,"topics":["nginx","nginx-configuration","nginx-proxy","nginx-reverse-proxy","nginx-server"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/QuiteAFancyEmerald.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-02-22T07:56:51.000Z","updated_at":"2024-12-21T09:14:04.000Z","dependencies_parsed_at":"2024-11-19T12:45:00.388Z","dependency_job_id":"968f5afd-ef91-4ca6-a8bc-56460023331e","html_url":"https://github.com/QuiteAFancyEmerald/Fast-Production-NGINX-Template","commit_stats":null,"previous_names":["quiteafancyemerald/fast-production-nginx-template"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/QuiteAFancyEmerald%2FFast-Production-NGINX-Template","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/QuiteAFancyEmerald%2FFast-Production-NGINX-Template/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/QuiteAFancyEmerald%2FFast-Production-NGINX-Template/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/QuiteAFancyEmerald%2FFast-Production-NGINX-Template/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/QuiteAFancyEmerald","download_url":"https://codeload.github.com/QuiteAFancyEmerald/Fast-Production-NGINX-Template/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248571848,"owners_count":21126524,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["nginx","nginx-configuration","nginx-proxy","nginx-reverse-proxy","nginx-server"],"created_at":"2024-11-19T12:44:53.339Z","updated_at":"2025-04-12T13:21:47.149Z","avatar_url":"https://github.com/QuiteAFancyEmerald.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Fast-Production-NGINX-Template\n\nAn easy to clone fast production reverse-proxy setup using NGINX with basic connection management and DDOS mitigation.\n\n### Overview\n\nThis configuration optimizes performance, security, and user experience by implementing best practices for Nginx. It includes rate limiting, gzip compression, SSL configuration, and error handling to ensure robust service delivery.\n\n* [Configuration Sections](#configuration-sectionstion)\n* [Worker Processes and Limits](#worker-processes-and-limits)\n* [HTTP Settings](#http-settings)\n* [Rate Limit Useragents Setup](#rate-limit-useragents-setup)\n* [Load Balancing Setup](#load-balancing-setup)\n* [Advanced Reverse Proxy Configuration](#advanced-reverse-proxy-configuration)\n* [Simple Reverse Proxy Configuration](#simple-reverse-proxy-configuration)\n* [Security Measures](##security-measures)\n\n## Configuration Sections\n\n#### Common Errors\n\n`can't find user name www`\n\n```\nuseradd -s /bin/false www\n```\n\n### Worker Processes and Limits\n\n```nginx\n# (One worker per CPU core)\nworker_processes 8;\nworker_processes auto;\n\n# This directive controls the limit on the number of open files (file descriptors) for Nginx worker processes.\n# Low Traffic: For light usage (e.g., small websites or development environments), a value of 1,024 to 2,048 might be sufficient.\n# Moderate Traffic: For moderate traffic sites (e.g., small to medium-sized applications), consider setting it to 5,000 to 10,000.\n# High Traffic: For high-traffic sites (e.g., e-commerce platforms, content-heavy sites), values of 20,000 to 100,000 or more can be beneficial, depending on the server's resources.\n\nworker_rlimit_nofile 20000;\n\nevents {\n    ##### Performance Setting; can be reduced if you run into CPU issues or timeouts #####\n    #### max_connections = worker_processes * worker_connections\n    #### worker_processes is the number of worker processes Nginx uses, and worker_connections is the limit per worker.\n    #### So, if you have 4 worker processes and each has 10,000 connections, your server can handle up to 40,000 simultaneous connections.\n    #### Make sure your system's resources (CPU, memory, file descriptors) are capable of handling the number of connections you configure.\n\n    worker_connections 10000;\n}\n```\n\n### HTTP Settings\n\n```nginx\nhttp {\n    include /etc/nginx/mime.types;\n    default_type application/octet-stream;\n\n    #### Larger bucket sizes use more memory, so it’s a balance between memory usage and performance.\n    map_hash_bucket_size 128;\n\n    ##### If you are hosting any web proxy sites this is a quick way to block any malware/adult sites\n    resolver 1.1.1.3;\n\n\n    # Logging is very lame\n    access_log off;\n    error_log off;\n    sendfile on;\n\n    include /etc/nginx/conf.d/*.conf;\n    include /etc/nginx/conf.d/blocklist.conf;\n\n    ####################################\n    #### Rate Limit/DDOS Protection ####\n    ####################################\n\n    limit_req_zone $binary_remote_addr zone=limitreq:20m rate=30r/s;\n    limit_req zone=limitreq burst=500 nodelay;\n    limit_req_status 444;\n    limit_conn_zone $binary_remote_addr zone=limitconn:20m;\n    limit_conn limitconn 10;\n\n    # Optimize the amount of data that is being sent at once. Prevent Nginx from sending a partial frame. As a result it will increases the\n    # throughput, since TCP frames will be filled up before being sent out.\n    # You also need to activate the `sendfile` option.\n    tcp_nopush on;\n\n    # By default, the TCP stack implements a mechanism to delay sending the\n    # data up to 200ms. To force a socket to send the data in its buffer\n    # immediately we can turn this option on.\n    tcp_nodelay on;\n\n    reset_timedout_connection on;\n\n    gzip on;\n\n    # Gzip compression level (1-9).\n    # 5 is a perfect compromise between size and CPU usage, offering about\n    # 75% reduction for most ASCII files (almost identical to level 9).\n    gzip_comp_level 5;\n\n    # Don't compress a small file that is unlikely to shrink much. The small\n    # file is also usually ended up in larger file sizes after gzipping.\n    gzip_min_length 256;\n\n    # Compress data even for a proxied connection.\n    gzip_proxied any;\n\n    # Cache both the regular and the gzipped versions of a resource whenever\n    # client's Accept-Encoding capabilities header varies.\n    gzip_vary on;\n\n    # Compress all of the following mime-types, `text/html` is always\n    # compressed.\n    gzip_types\n    application/atom+xml\n    application/javascript\n    application/json\n    application/ld+json\n    application/manifest+json\n    application/rss+xml\n    application/vnd.geo+json\n    application/vnd.ms-fontobject\n    application/x-font-ttf\n    application/x-web-app-manifest+json\n    application/xhtml+xml\n    application/xml\n    font/opentype\n    image/bmp\n    image/svg+xml\n    image/x-icon\n    text/cache-manifest\n    text/css\n    text/plain\n    text/vcard\n    text/vnd.rim.location.xloc\n    text/vtt\n    text/x-component\n    text/x-cross-domain-policy;\n\n    # Number of requests client can make over keep-alive -- for testing environments\n    # keepalive_requests 100000;\n\n    # Handle Websocket headers\n    map $http_upgrade $connection_upgrade {\n        default Upgrade;\n        '' close;\n    }\n\n    ##### Extras = Use this for organized multi-site setups  #####\n    #include /etc/nginx/sites-enabled/*.conf;\n    #include /etc/nginx/conf.d/*.conf;\n}\n```\n\n### Rate Limit Useragents Setup\n\n```nginx\nhttp {\n    ##### Rate Limit Bots #####\n    # Blacklist user agents\n    # The following is a default list that simply blocks all bots. credit to https://stackoverflow.com/a/24820722\n    map $http_user_agent $blacklist_useragent {\n        default 0;\n        ~*(google|bing|yandex|msnbot) 1;\n        ~*(AltaVista|Googlebot|Slurp|BlackWidow|Bot|ChinaClaw|Custo|DISCo|Download|Demon|eCatch|EirGrabber|EmailSiphon|EmailWolf|SuperHTTP|Surfbot|WebWhacker) 1;\n        ~*(Express|WebPictures|ExtractorPro|EyeNetIE|FlashGet|GetRight|GetWeb!|Go!Zilla|Go-Ahead-Got-It|GrabNet|Grafula|HMView|Go!Zilla|Go-Ahead-Got-It) 1;\n        ~*(rafula|HMView|HTTrack|Stripper|Sucker|Indy|InterGET|Ninja|JetCar|Spider|larbin|LeechFTP|Downloader|tool|Navroad|NearSite|NetAnts|tAkeOut|WWWOFFLE) 1;\n        ~*(GrabNet|NetSpider|Vampire|NetZIP|Octopus|Offline|PageGrabber|Foto|pavuk|pcBrowser|RealDownload|ReGet|SiteSnagger|SmartDownload|SuperBot|WebSpider) 1;\n        ~*(Teleport|VoidEYE|Collector|WebAuto|WebCopier|WebFetch|WebGo|WebLeacher|WebReaper|WebSauger|eXtractor|Quester|WebStripper|WebZIP|Wget|Widow|Zeus) 1;\n        ~*(Twengabot|htmlparser|libwww|Python|perl|urllib|scan|Curl|email|PycURL|Pyth|PyQ|WebCollector|WebCopy|webcraw) 1;\n    }\n\n    ##### Rate Limit Bots (Less aggressive for SEO) #####\n    map $http_user_agent $limit_bots {\n        default 0;\n        ~*(yandex|msnbot) 1;\n        #~*(google|bing|yandex|msnbot) 1;\n        ~*(Surfbot|SuperHTTP|AltaVista|WebWhacker) 1;\n        #~*(Googlebot|Surfbot|SuperHTTP|AltaVista|WebWhacker) 1;\n        #~*(AltaVista|Googlebot|Slurp|BlackWidow|Bot|ChinaClaw|Custo|DISCo|Download|Demon|eCatch|EirGrabber|EmailSiphon|EmailWolf|SuperHTTP|Surfbot|WebWhacker) 1;\n        ~*(Express|WebPictures|ExtractorPro|EyeNetIE|FlashGet|GetRight|GetWeb!|Go!Zilla|Go-Ahead-Got-It|GrabNet|Grafula|HMView|Go!Zilla|Go-Ahead-Got-It) 1;\n        ~*(rafula|HMView|HTTrack|Stripper|Sucker|Indy|InterGET|Ninja|JetCar|Spider|larbin|LeechFTP|Downloader|tool|Navroad|NearSite|NetAnts|tAkeOut|WWWOFFLE) 1;\n        ~*(GrabNet|NetSpider|Vampire|NetZIP|Octopus|Offline|PageGrabber|Foto|pavuk|pcBrowser|RealDownload|ReGet|SiteSnagger|SmartDownload|SuperBot|WebSpider) 1;\n        ~*(Teleport|VoidEYE|Collector|WebAuto|WebCopier|WebFetch|WebGo|WebLeacher|WebReaper|WebSauger|eXtractor|Quester|WebStripper|WebZIP|Wget|Widow|Zeus) 1;\n        ~*(Twengabot|htmlparser|libwww|Python|perl|urllib|scan|Curl|email|PycURL|Pyth|PyQ|WebCollector|WebCopy|webcraw) 1;\n    }\n}\n```\n\n### Load Balancing Setup\n\n```nginx\nupstream example {\n    server 127.0.0.1:8078 weight=1;\n}\n\nupstream example2 {\n    server 127.0.0.1:8080 weight=2;\n}\n```\n\n### Advanced Reverse Proxy Configuration\n\n```nginx\nserver {\n    listen 80;\n    server_name example.com www.example.com;\n    return 301 https://$host$request_uri;\n}\n\n#### HTTPS Server ####\nserver {\n    listen 443 ssl http2;\n    server_name example.com www.example.com;\n\n    ### SSL Settings ###\n    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;\n\n    ### Additional Fingerprinting Features ###\n    ssl_protocols TLSv1.2 TLSv1.3;\n    ssl_ciphers \"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS\";\n    ssl_prefer_server_ciphers on;\n    ssl_dhparam /etc/nginx/ssl/dhparams.pem;\n\n    ### Hide nginx version number from HTTP response headers ###\n    server_tokens off;\n\n    location / {\n        ### You can directly put localhost:port here as well however it is better to use the upstream to utilize load balancing features\n        proxy_pass https://example;\n        ###\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection $connection_upgrade;\n        proxy_set_header Host $host;\n        proxy_cache_bypass $http_upgrade;\n        # fix \"upstream sent too big header/body\"\n        proxy_buffer_size 16k;\n        # proxy_buffer_size + 8k\n        proxy_busy_buffers_size 24k;\n        # numOfBuffers * bufferSize \u003e= proxy_buffer_size\n        proxy_buffers 4 16k;\n        # client can only upload files less than 100M\n        client_max_body_size 100M;\n        proxy_read_timeout 120s;\n\n        ## Headers for security and fingerprinting boosts; helps with SEO and site security\n        # add_header X-Robots-Tag \"googlebot: all\";\n        # add_header X-Robots-Tag \"bingbot: all\";\n\n        # Prevent indexing by all bots\n        add_header X-Robots-Tag \"none\" always;\n\n        # Prevent MIME-type sniffing (protects against MIME-type confusion attacks)\n        add_header X-Content-Type-Options \"nosniff\" always;\n\n        # Strong Content Security Policy (CSP) - This limits resource loading and prevents inline scripts\n        add_header Content-Security-Policy \"default-src 'self'; connect-src 'self'; font-src 'self' https://fonts.googleapis.com; frame-src 'none'; img-src 'self' data:; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline';\" always;\n\n        # Enable HTTP Strict Transport Security (HSTS) for 1 year with subdomains and preload\n        add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" always;\n\n        # Referrer Policy (minimizes information shared with third parties)\n        add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\n\n        # Feature Policy (controls specific browser features)\n        add_header Permissions-Policy \"geolocation=(), microphone=(), camera=()\" always;\n\n\n        # Fake Against Attacks\n        if ($request_method !~ ^(GET|HEAD|POST)$) {\n            return 444;\n        }\n\n        # Rate limit Webcrawers\n        if ($limit_bots = 1) {\n            return 401;\n            break;\n        }\n\n        # Rate limit Referers\n        # https://github.com/fail2ban/fail2ban\n\n        # Cookie based authentication for preventing bots\n        #set $proxied 0;\n\n        #if ($http_cookie ~* 'access=yes') {\n        #    set $proxied 1;\n        #}\n        #if ($proxied = 0) {\n        #    return 404;\n        #}\n    }\n\n    ### Error Pages ###\n    error_page 500 502 503 504 521 =400 @proxy_down;\n    location @proxy_down {\n        add_header Content-Type text/html;\n        default_type text/html;\n        return 400 '';\n    }\n\n    error_page 401 403 @proxy_authbot;\n    location @proxy_authbot {\n        add_header Content-Type text/html;\n        default_type text/html;\n        return 400 '';\n    }\n\n    error_page 404 @proxy_pagenotfound;\n    location @proxy_pagenotfound {\n        add_header Content-Type text/html;\n        default_type text/html;\n        return 400 '';\n    }\n\n    ### Deny Access ###\n    location ~ /\\.ht {\n        # deny access to .htaccess files, if Apache's document root\n        # concurs with nginx's one\n        deny all;\n    }\n\n}\n```\n\n### Simple Reverse Proxy Configuration\n\n```nginx\nserver {\n    listen 80;\n    server_name example.com www.example.com;\n    return 301 https://$host$request_uri;\n}\n\nserver {\n    listen 443 ssl http2;\n    server_name example.com www.example.com;\n\n    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;\n\n    location / {\n        proxy_pass https://example;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection $connection_upgrade;\n        proxy_set_header Host $host;\n        proxy_cache_bypass $http_upgrade;\n        client_max_body_size 100M;\n        proxy_read_timeout 120s;\n\n        # Security Headers\n        add_header X-Robots-Tag \"none\" always;\n        add_header X-Content-Type-Options \"nosniff\" always;\n        add_header Content-Security-Policy \"default-src 'self';\" always;\n        add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" always;\n    }\n\n    # Error Handling\n    error_page 500 502 503 504 =400 @proxy_down;\n}\n```\n\n### Security Measures\n\n- Rate limiting is applied to mitigate DDoS attacks.\n- User agent blacklisting to limit web crawlers.\n- Strong Content Security Policy (CSP) to enhance security.\n\nFor further customization or troubleshooting, please refer to the \u003ca href=\"https://nginx.org/en/docs/\"\u003eNginx documentation\u003c/a\u003e.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fquiteafancyemerald%2Ffast-production-nginx-template","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fquiteafancyemerald%2Ffast-production-nginx-template","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fquiteafancyemerald%2Ffast-production-nginx-template/lists"}