нгинкс
# cat astra.conf
# Disable nginx tokens
server_tokens off;
# Cache settings
proxy_cache_path "/ramcache" use_temp_path=off keys_zone=all:1m inactive=10s max_size=8g;
proxy_cache_min_uses 1;
#proxy_ignore_headers Cache-Control;
# HSTS (15768000 seconds = 6 months)
add_header Strict-Transport-Security max-age=15768000;
add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
# Allow only GET, POST, HEAD
add_header Allow "GET, POST, HEAD" always;
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen
0.0.0.0:8000;
server_name
server.com;
access_log off;
open_file_cache max=1000 inactive=20s;
open_file_cache_valid 10s;
open_file_cache_errors off;
keepalive_timeout 300s;
keepalive_requests 1000000;
resolver
8.8.8.8 ipv6=off;
resolver_timeout 5s;
if ( $http_user_agent ~* (nmap|nikto|wikto|sf|sqlmap|bsqlbf|w3af|acunetix|havij|appscan) ) {
return 403;
}
if ( $request_method !~ ^(GET|POST|HEAD)$ ) {
return 405;
}
location / {
proxy_cache off;
proxy_pass
http://127.0.0.1:7000;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
include /etc/nginx/conf.d/proxy_params.conf;
}
location ~* \.(m3u8)$ {
proxy_cache off;
expires -1;
proxy_pass
http://127.0.0.1:7000;
include /etc/nginx/conf.d/proxy_params.conf;
}
location ~* \.(ts|trp)$ {
proxy_pass
http://127.0.0.1:7000;
proxy_cache_methods GET;
proxy_cache all;
proxy_cache_key $request_uri;
proxy_cache_valid 200 10s;
proxy_cache_lock on;
proxy_cache_lock_timeout 10s;
proxy_cache_lock_age 10s;
add_header X-Cache-Status $upstream_cache_status;
proxy_pass_header X-Accel-Expires;
}
location ~ /\. {
access_log off;
log_not_found off;
deny all;
}
location ~ ~$ {
access_log off;
log_not_found off;
deny all;
}
location ~* (nginx-status|nginx_status)$ {
stub_status on;
access_log off;
allow
127.0.0.1;
deny all;
}
}