log_format  main  '$remote_addr - [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_host" "$host" '
                  '"$server_protocol"';


fastcgi_cache_key "$scheme$request_method$host$request_uri";
fastcgi_ignore_headers Cache-Control Expires Set-Cookie;

    access_log syslog:server=unix:/dev/log,tag=nginx_error,nohostname main if=$loggable;

    aio threads;

    sendfile on;

    tcp_nopush on;
    tcp_nodelay on;
    #keepalive_timeout 75 20;
    keepalive_timeout 45;
    keepalive_requests 1000;
    reset_timedout_connection on;
    
    server_tokens          off;
    server_name_in_redirect off;
    more_clear_headers 'Server';

    charset                UTF-8;

    client_body_timeout 35;
    client_header_timeout 12;
    send_timeout 30;

    server_names_hash_bucket_size 1024;
    server_names_hash_max_size 4096;
    variables_hash_max_size 4096;
    variables_hash_bucket_size 4096;

    map_hash_bucket_size 256;
    map_hash_max_size 16384;

    types_hash_max_size    2048;
    types_hash_bucket_size 64;
    client_max_body_size   8M;
    client_body_buffer_size 1m;
    client_header_buffer_size 2k;
    large_client_header_buffers 4 8k;
    autoindex off;
    underscores_in_headers on;

    ####NEW SSL

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_buffer_size 4k;
    #ssl_ecdh_curve secp521r1:secp384r1:prime256v1;
    ssl_session_tickets off;
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256';
    ssl_ecdh_curve secp256r1;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;


    #### COMMON CERT

    ssl_certificate /etc/letsencrypt/live/mitrofanov.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mitrofanov.ru/privkey.pem;
    #ssl_trusted_certificate /etc/letsencrypt/live/mitrofanov.ru/chain.pem;


    resolver 127.0.2.1:53 valid=600s;
    resolver_timeout 60s;
    #ssl_stapling on;
    #ssl_stapling_verify on;

    brotli on;
    brotli_comp_level 6;
    brotli_static on;
    brotli_types text/plain text/css text/javascript application/javascript application/json image/svg+xml application/xml;

    gzip off;

    http2  on;
    http3  on;
    quic_gso on;
    quic_retry on;
    ssl_early_data on;

    more_set_headers  'X-Content-Type-Options: nosniff';
    more_set_headers 'Alt-Svc: h3=":443"; ma=86400, h2=":443"; ma=86400';

    limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
    limit_req_log_level info ;
    limit_req_status 429;
    
    limit_conn_zone  $binary_remote_addr  zone=concurrent:10m;
    limit_conn  concurrent  200;
    limit_conn_status 429;
    limit_conn_log_level warn;

include /www/nginx/map.conf;
include /www/nginx/map_bad_referer.conf;
include /www/nginx/map_bad_user_agent.conf;


server {
    listen 80;
    listen [::]:80;
    listen 443 quic reuseport;
    listen [::]:443 quic reuseport;
    listen 443 ssl reuseport;
    listen [::]:443 ssl reuseport;
    ssl_reject_handshake on;
#    server_name _;
    return 444;
}

#server {
#    listen 80;
#    listen [::]:80;
#    server_name mitrofanov.ru *.mitrofanov.ru;
#    server_name mitrofanov.ru;
#    access_log off;
#    return 308 https://mitrofanov.ru$request_uri;  
#}