nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections 768;
}

http {
    gzip on;  # https://community.qualys.com/blogs/securitylabs/2013/09/10/is-beast-still-a-threat
    gzip_types text/html application/json image/svg+xml text/javascript text/xml text/plain application/javascript application/xml;
    gzip_min_length 2000;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    types_hash_max_size 2048;

    client_max_body_size 4000M;

    # don't leak nginx version, it might be vulnerable and found in a scan.
    server_tokens off;

    include /etc/nginx/snippets/mime.types;
    default_type application/octet-stream;

    # advice from https://cipherli.st/
    ssl_prefer_server_ciphers on;
    ssl_protocols  TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    # note ssl_ecdh_curve is disabled for GRPC support OOTB. This is considered
    # OK as it does not affect the ssllabs report (A+)
    #ssl_ecdh_curve secp384r1;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver_timeout 5s;

    ssl_dhparam dhparams.pem;

    # log using systemd journald like everything else. Journald is great at rotation, storage, performance etc.
    error_log syslog:server=unix:/dev/log;
    access_log syslog:server=unix:/dev/log;

    # long timeouts for long-running connections that don't do anything for a
    # while.
    proxy_read_timeout 25h;
    proxy_send_timeout 25h;
    grpc_read_timeout 25h;
    grpc_send_timeout 25h;
    send_timeout 300;

    # a recent addition to nginx, should be greater than the above so they're effective
    keepalive_timeout 26h;

    # useful default zones
    # ... general rate limit to mitigate DoS attacks (not DDoS)
    limit_req_zone $binary_remote_addr zone=default:10m rate=10r/s;
    # ... to mitigate brute force login attempts
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
    # ... to mitigate generating too mant expensive things at once (eg PDFs)
    limit_req_zone $binary_remote_addr zone=expensive:10m rate=30r/m;

    # conservative rate limit for all requests. Note conservative burst setting
    # and nodelay. Not enabled.
    #limit_req zone=default burst=100 nodelay;

    # default of 503 is not appropriate
    limit_req_status 429;

    # used for auth_request
    proxy_cache_path auth_cache/ keys_zone=auth_cache:10m;

    # note that setting any header further in the hierarchy will prevent all of
    # these from being sent.
    include snippets/security_headers;


    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        location / {
            return 301 https://$host$request_uri;
        }
    }

    # see proxy_params for websocket proxying
    # configuration advice from https://nginx.org/en/docs/http/websocket.html
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    include /etc/nginx/conf.d/*.conf;
}

# NOTE sudo htpasswd -c /etc/nginx/htpasswd naggie # apache2-utils or ansible htpasswd module