#
# ssl on;
#
# files
#
ssl_certificate /etc/nginx/certs/example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/example.com/privkey.pem;
ssl_trusted_certificate /etc/nginx/certs/example.com/chain.pem;
ssl_dhparam /etc/nginx/certs/example.com/dhparam.pem;
#
# ssl params
#
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256";
ssl_ecdh_curve prime256v1:secp384r1:secp521r1:X25519;
ssl_early_data on;
#
# ssl session cache
#
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets on;
#
# ocsp
#
ssl_stapling off;
ssl_stapling_verify off;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 10s;
#
# csp
#
# add_header Content-Security-Policy-Report-Only "";
# add_header X-Content-Security-Policy-Report-Only "";
# add_header X-WebKit-CSP-Report-Only "";
#
# headers
#
# add_header Public-Key-Pins 'pin-sha256=""; pin-sha256=""; pin-sha256=""; pin-sha256=""; pin-sha256=""; pin-sha256=""; max-age=31536000;';
# add_header Frame-Options SAMEORIGIN;
# add_header X-Frame-Options SAMEORIGIN;
# add_header X-Content-Type-Options nosniff;
# add_header X-XSS-Protection "1; mode=block";
add_header Strict-Transport-Security "max-age=15552000;"; # 180 days
#
# other
#
ssl_buffer_size 4k;
keepalive_timeout 70;
keepalive_requests 150;
#
# http2
# https://nginx.org/ru/docs/http/ngx_http_v2_module.html
#
http2 on;
http2_body_preread_size 64k;
http2_chunk_size 8k;
# http2_idle_timeout 3m; -> keepalive_timeout use, obsolete 1.19.7
# http2_max_concurrent_pushes 10; -> obsolete 1.25.1
http2_max_concurrent_streams 128;
# http2_max_field_size 4k; -> large_client_header_buffers use, obsolete 1.19.7
# http2_max_header_size 16k; -> large_client_header_buffers use, obsolete 1.19.7
# http2_max_requests 1000; -> keepalive_requests use, obsolete 1.19.7
# http2_push off; -> obsolete 1.25.1
# http2_push_preload off; -> obsolete 1.25.1
# http2_recv_buffer_size 256k; -> only on http available
# http2_recv_timeout 30s; -> client_header_timeout use, obsolete 1.19.7
#
# http3
# https://nginx.org/ru/docs/http/ngx_http_v3_module.html
#
# http3 on;
# http3_hq off;
# http3_max_concurrent_streams 128;
# http3_stream_buffer_size 64k;
# quic_active_connection_id_limit 2;
# quic_bpf off;
# quic_gso off;
# quic_host_key file;
# quic_retry off;
#