log_format  main  '$remote_addr - [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_host" "$host" '
                  '"$server_protocol"';

access_log syslog:server=unix:/dev/log,tag=nginx_error,nohostname main if=$loggable;

fastcgi_cache_key "$scheme$request_method$host$request_uri";

fastcgi_cache_path /var/cache/nginx/ levels=1:2 keys_zone=allcache:60m max_size=256m inactive=24h use_temp_path=off;

    aio threads;

    sendfile on;
#    sendfile_max_chunk 512k;

    tcp_nopush on;
    tcp_nodelay on;
    #keepalive_timeout 75 20;
    keepalive_timeout 45;
    keepalive_requests 3000;
    reset_timedout_connection on;
    
    server_tokens          off;
    server_name_in_redirect off;
    more_clear_headers 'Server';

    charset                UTF-8;

    # client_body_timeout 60;
    # client_header_timeout 60;
    # send_timeout 60;
    # https://struchkov.dev/blog/ru/nginx-optimization/
    client_body_timeout 35;
    client_header_timeout 12;
    send_timeout 30;

    # кэш имён файлов для disable_symlinks
    open_file_cache          max=1000 inactive=20s;
    open_file_cache_valid    45s;
    open_file_cache_min_uses 2;
    open_file_cache_errors   on;

    server_names_hash_bucket_size 1024;
    server_names_hash_max_size 4096;
    variables_hash_max_size 4096;
    variables_hash_bucket_size 4096;

    map_hash_bucket_size 256;
    map_hash_max_size 16384;

#    log_not_found          off;
    types_hash_max_size    2048;
    types_hash_bucket_size 64;
    client_max_body_size   8M;
    client_body_buffer_size 1m;
    client_header_buffer_size 2k;
    large_client_header_buffers 4 8k;
    # client_body_buffer_size 10k;
    # client_header_buffer_size 1k;
    # large_client_header_buffers 4 4k;
    autoindex off;
    underscores_in_headers on;

    ####NEW SSL

    ssl_session_cache shared:le_nginx_SSL:10m;
    ssl_session_timeout 1d;
    ssl_buffer_size 4k;
    ssl_ecdh_curve secp521r1:secp384r1:prime256v1;
    ssl_session_tickets off;
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_prefer_server_ciphers off;

    #resolver 127.0.0.1 [::1]:53 valid=600s; nginx кэширует ответы, используя значение TTL из ответа. Необязательный параметр valid позволяет это переопределить
    resolver 127.0.0.1;
    #resolver_timeout 60s;
    ssl_stapling on;
    ssl_stapling_verify on;

    brotli on;
    brotli_comp_level 6;
    brotli_static on;
    brotli_types text/plain text/css text/javascript application/javascript application/json image/svg+xml application/xml;

    gzip off;

    http2  on;
    http3  on;
    quic_gso on;
    quic_retry on;
    ssl_early_data on;

    more_set_headers  'X-Content-Type-Options: nosniff';
    more_set_headers 'Alt-Svc: h3=":443"; ma=86400, h2=":443"; ma=86400';


    limit_req_zone $binary_remote_addr zone=login:50m rate=100r/s;
    limit_req_zone $binary_remote_addr zone=main:50m rate=100r/s;
    limit_req_zone $binary_remote_addr zone=flood:50m rate=100r/s;


    limit_conn_zone $binary_remote_addr zone=addr:50m;
    limit_conn_log_level warn;
    limit_conn addr 200;

server {
    listen 80;
    listen [::]:80;
    return 444;
}

server {
    listen 443 quic reuseport;
    listen [::]:443 quic reuseport;
    listen 443 ssl reuseport;
    listen [::]:443 ssl reuseport;
    ssl_reject_handshake on;
    return 444;
}