Skip to content

Commit db65f0e

Browse files
ammntammnt
committed
added: configuration file for enabling QUIC and HTTP3
1 parent 3e32ed1 commit db65f0e

File tree

1 file changed

+171
-0
lines changed

1 file changed

+171
-0
lines changed

‎nginx_http3.conf

+171
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
# This is an example of a configuration file for enabling QUIC and HTTP3. Further configuration is required.
2+
worker_processes auto;
3+
worker_rlimit_nofile 65536;
4+
pid /tmp/nginx.pid;
5+
lock_file /tmp/nginx.lock;
6+
pcre_jit on;
7+
8+
events {
9+
worker_connections 8192;
10+
multi_accept on;
11+
accept_mutex on;
12+
use epoll;
13+
}
14+
15+
http {
16+
sendfile on;
17+
aio threads;
18+
tcp_nopush on;
19+
tcp_nodelay on;
20+
reset_timedout_connection on;
21+
send_timeout 2;
22+
client_body_timeout 60;
23+
client_body_buffer_size 10M;
24+
client_max_body_size 10M;
25+
keepalive_timeout 60;
26+
server_tokens off;
27+
types_hash_max_size 4096;
28+
http2 on;
29+
http3 on;
30+
ssl_early_data on;
31+
ssl_session_cache shared:SSL:60m;
32+
ssl_session_tickets off;
33+
ssl_session_timeout 1440m;
34+
ssl_buffer_size 4k;
35+
ssl_protocols TLSv1.3 TLSv1.2;
36+
ssl_ecdh_curve X25519:secp521r1:secp384r1;
37+
ssl_ciphers TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDH+AESGCM+AES256:ECDH+CHACHA20;
38+
ssl_conf_command Options ServerPreference,PrioritizeChaCha;
39+
ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDH+AESGCM+AES256:ECDH+CHACHA20;
40+
ssl_prefer_server_ciphers on;
41+
ssl_certificate /etc/nginx/ssl/fullchain.pem;
42+
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
43+
ssl_trusted_certificate /etc/nginx/ssl/fullchain.pem;
44+
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
45+
ssl_stapling on;
46+
ssl_stapling_verify on;
47+
ssl_ocsp on;
48+
ssl_ocsp_cache shared:ocspSSL:60m;
49+
ssl_verify_depth 2;
50+
resolver_timeout 300s;
51+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
52+
add_header X-Content-Type-Options nosniff;
53+
add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always;
54+
add_header Content-Security-Policy upgrade-insecure-requests always;
55+
add_header Alt-Svc 'h3=":443"; quic=":443"; ma=86400; persist=1' always;
56+
add_header QUIC-Status $http3;
57+
quic_retry on;
58+
quic_gso on;
59+
log_format simple '$ssl_server_name $scheme $ssl_alpn_protocol $status $ssl_protocol $server_protocol $ssl_curve $ssl_cipher';
60+
log_format main escape=json '{"@timestamp": "$time_iso8601","ssl_server_name": "$ssl_server_name","scheme": "$scheme","ssl_alpn_protocol": "$ssl_alpn_protocol","status": "$status","ssl_protocol": "$ssl_protocol","server_protocol": "$server_protocol","ssl_curve": "$ssl_curve","ssl_cipher": "$ssl_cipher"}';
61+
log_format debug escape=json '{'
62+
'"@timestamp": "$time_iso8601", '
63+
'"msec": "$msec", '
64+
'"connection": "$connection", '
65+
'"connection_requests": "$connection_requests", '
66+
'"pid": "$pid", '
67+
'"request_id": "$request_id", '
68+
'"request_length": "$request_length", '
69+
'"remote_addr": "$remote_addr", '
70+
'"remote_user": "$remote_user", '
71+
'"remote_port": "$remote_port", '
72+
'"time_local": "$time_local", '
73+
'"request": "$request", '
74+
'"request_uri": "$request_uri", '
75+
'"args": "$args", '
76+
'"status": "$status", '
77+
'"body_bytes_sent": "$body_bytes_sent", '
78+
'"bytes_sent": "$bytes_sent", '
79+
'"http_referer": "$http_referer", '
80+
'"http_user_agent": "$http_user_agent", '
81+
'"http_x_forwarded_for": "$http_x_forwarded_for", '
82+
'"http_host": "$http_host", '
83+
'"host": "$host", '
84+
'"ssl_server_name": "$ssl_server_name", '
85+
'"ssl_alpn_protocol": "$ssl_alpn_protocol", '
86+
'"server_name": "$server_name", '
87+
'"request_time": "$request_time", '
88+
'"upstream": "$upstream_addr", '
89+
'"upstream_connect_time": "$upstream_connect_time", '
90+
'"upstream_header_time": "$upstream_header_time", '
91+
'"upstream_response_time": "$upstream_response_time", '
92+
'"upstream_response_length": "$upstream_response_length", '
93+
'"upstream_cache_status": "$upstream_cache_status", '
94+
'"ssl_protocol": "$ssl_protocol", '
95+
'"ssl_cipher": "$ssl_cipher", '
96+
'"ssl_curve": "$ssl_curve", '
97+
'"scheme": "$scheme", '
98+
'"request_method": "$request_method", '
99+
'"server_protocol": "$server_protocol", '
100+
'"pipe": "$pipe", '
101+
'"gzip_ratio": "$gzip_ratio", '
102+
'"http_cf_ray": "$http_cf_ray", '
103+
'"http_x_forwarded_proto": "$http_x_forwarded_proto" '
104+
'}';
105+
access_log /dev/stdout simple;
106+
error_log stderr warn;
107+
gzip on;
108+
gzip_vary on;
109+
gzip_proxied any;
110+
gzip_comp_level 6;
111+
gzip_buffers 16 8k;
112+
gzip_http_version 1.1;
113+
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
114+
115+
brotli on;
116+
brotli_comp_level 6;
117+
brotli_static on;
118+
brotli_types application/atom+xml application/javascript application/json application/vnd.api+json application/rss+xml
119+
application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype
120+
application/x-font-ttf application/x-javascript application/xhtml+xml application/xml
121+
font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon
122+
image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml;
123+
124+
default_type application/octet-stream;
125+
include /etc/nginx/mime.types;
126+
client_body_temp_path /tmp/client_temp;
127+
proxy_temp_path /tmp/proxy_temp_path;
128+
fastcgi_temp_path /tmp/fastcgi_temp;
129+
130+
proxy_buffering on;
131+
proxy_buffer_size 16k;
132+
proxy_busy_buffers_size 24k;
133+
proxy_buffers 384 4k;
134+
proxy_max_temp_file_size 0;
135+
136+
server {
137+
listen 8080 default_server fastopen=256;
138+
listen [::]:8080 default_server fastopen=256;
139+
listen 8443 default_server quic reuseport;
140+
listen [::]:8443 default_server quic reuseport;
141+
listen 8443 default_server ssl fastopen=256;
142+
listen [::]:8443 default_server ssl fastopen=256;
143+
server_name test.example.com;
144+
145+
if ($scheme = http) {
146+
return 308 https://test.example.com$request_uri;
147+
}
148+
if ($host = 'www.test.example.com') {
149+
rewrite ^/(.*)$ https://test.example.com/$1 permanent;
150+
}
151+
if ($host != 'test.example.com') {
152+
return 308 https://test.example.com$request_uri;
153+
}
154+
if ($request_method !~ ^(GET|POST|PUT)$) {
155+
return '405';
156+
}
157+
158+
location / {
159+
root /var/www/html;
160+
index index.html index.htm;
161+
162+
limit_except GET POST PUT {
163+
deny all;
164+
}
165+
}
166+
167+
location /robots.txt {
168+
return 200 "User-agent: *\nDisallow: /\n";
169+
}
170+
}
171+
}

0 commit comments

Comments
 (0)