nginx.conf

load_module "/usr/local/libexec/nginx/ngx_stream_module.so";

user  nobody;
worker_processes  1;

#pid        logs/nginx.pid;

error_log /var/log/nginx/nginx_error.log debug;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    proxy_headers_hash_max_size 1024;
    proxy_headers_hash_bucket_size 128;
    server_names_hash_bucket_size 128;


    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    server {
        listen       443 ssl http2;
        server_name  YOURDOMAIN;

        send_timeout 100m;

	access_log /var/log/nginx/plex_access.log;
	error_log /var/log/nginx/plex_error.log debug;

        ssl_certificate      /usr/local/etc/nginx/certs/cert.pem;
        ssl_certificate_key  /usr/local/etc/nginx/certs/cert.key;

        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
        ssl_prefer_server_ciphers on;
        ssl_dhparam /usr/local/etc/nginx/certs/dhparam.pem;
        # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
        add_header Strict-Transport-Security max-age=15768000;

        # OCSP Stapling ---
        # fetch OCSP records from URL in ssl_certificate and cache them
        ssl_stapling on;
        ssl_stapling_verify on;
        ## verify chain of trust of OCSP response using Root CA and Intermediate certs
        ssl_trusted_certificate /usr/local/etc/nginx/certs/cert.pem;

        resolver 192.168.1.1;

        server_tokens off;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Content-Type-Options nosniff;

	#Plex has A LOT of javascript, xml and html. This helps a lot, but if it causes playback issues with devices turn it off. (Haven't encountered any yet)
	gzip on;
	gzip_vary on;
	gzip_min_length 1000;
	gzip_proxied any;
	gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml;
	gzip_disable "MSIE [1-6]\.";

	#Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones.
	#Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more
	client_max_body_size 100M;
	
	proxy_pass_request_headers      on;

	#Forward real ip and host to Plex
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto $scheme;
        # Plex headers
        proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier;
        proxy_set_header X-Plex-Device $http_x_plex_device;
        proxy_set_header X-Plex-Device-Name $http_x_plex_device_name;
        proxy_set_header X-Plex-Platform $http_x_plex_platform;
        proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version;
        proxy_set_header X-Plex-Product $http_x_plex_product;
        proxy_set_header X-Plex-Token $http_x_plex_token;
        proxy_set_header X-Plex-Version $http_x_plex_version;
        proxy_set_header X-Plex-Nocache $http_x_plex_nocache;
        proxy_set_header X-Plex-Provides $http_x_plex_provides;
        proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor;
        proxy_set_header X-Plex-Model $http_x_plex_model;

        # TLS speciffic
        proxy_set_header X-Forwarded-Proto   $scheme;
        proxy_set_header X-Forwarded-Ssl     on;

        #proxy_set_header        Host                      $server_addr;
        #proxy_set_header        Referer                   $server_addr;
        #proxy_set_header        Origin                    $server_addr;

	#Websockets
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "upgrade";

        #Disables compression between Plex and Nginx, required if using sub_filter below.
	#May also improve loading time by a very marginal amount, as nginx will compress anyway.
        #proxy_set_header Accept-Encoding "";

	#Buffering off send to the client as soon as the data is received from Plex.
	proxy_redirect off;
	proxy_buffering off;

        location / {
            proxy_pass https://PLEXIP:32400/;
        }
    }
} #http

stream {
    map_hash_bucket_size 128;
    error_log /var/log/nginx/stream_error.log ;

    log_format proxy '$remote_addr [$time_local] '
                 '$protocol $status $bytes_sent $bytes_received '
                 '$session_time "$upstream_addr" '
                 '"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';

    upstream plex-direct {
        server PLEXIP:32400;
    }
    upstream plex-reverse {
        server YOURDOMAIN:443;
    }

    map $ssl_preread_server_name $upstream {
        YOURDOMAIN plex-reverse;
        *.plex.direct plex-direct;
        default plex-direct;
    }

    server {
        listen 32400;

	access_log /var/log/nginx/stream-plex_access.log proxy;
        ssl_preread on;
        proxy_pass $upstream;
    }
}