Skip to content

Commit e117d20

Browse files
ammntammnt
committed
added: configuration file for enabling QUIC and HTTP3
1 parent f8bae73 commit e117d20

File tree

1 file changed

+167
-0
lines changed

1 file changed

+167
-0
lines changed

‎freenginx_http3.conf

+167
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
# This is an example of a configuration file for enabling QUIC and HTTP3. Further configuration is required.
2+
worker_processes auto;
3+
worker_rlimit_nofile 65536;
4+
pid /tmp/freenginx.pid;
5+
lock_file /tmp/freenginx.lock;
6+
pcre_jit on;
7+
8+
events {
9+
worker_connections 8192;
10+
multi_accept on;
11+
accept_mutex on;
12+
use epoll;
13+
}
14+
15+
http {
16+
sendfile on;
17+
aio threads;
18+
tcp_nopush on;
19+
tcp_nodelay on;
20+
reset_timedout_connection on;
21+
send_timeout 2;
22+
client_body_timeout 60;
23+
client_body_buffer_size 10M;
24+
client_max_body_size 10M;
25+
keepalive_timeout 60;
26+
server_tokens off;
27+
types_hash_max_size 4096;
28+
http2 on;
29+
http3 on;
30+
ssl_early_data on;
31+
ssl_session_cache shared:SSL:60m;
32+
ssl_session_tickets off;
33+
ssl_session_timeout 1440m;
34+
ssl_buffer_size 4k;
35+
ssl_protocols TLSv1.3 TLSv1.2;
36+
ssl_ecdh_curve X25519:secp521r1:secp384r1;
37+
ssl_ciphers TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDH+AESGCM+AES256:ECDH+CHACHA20;
38+
ssl_prefer_server_ciphers on;
39+
ssl_certificate /etc/freenginx/ssl/fullchain.pem;
40+
ssl_certificate_key /etc/freenginx/ssl/privkey.pem;
41+
ssl_trusted_certificate /etc/freenginx/ssl/fullchain.pem;
42+
ssl_dhparam /etc/freenginx/ssl/dhparam.pem;
43+
ssl_stapling_verify on;
44+
ssl_ocsp_cache shared:ocspSSL:60m;
45+
ssl_verify_depth 2;
46+
resolver_timeout 300s;
47+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
48+
add_header X-Content-Type-Options nosniff;
49+
add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always;
50+
add_header Content-Security-Policy upgrade-insecure-requests always;
51+
add_header Alt-Svc 'h3=":443"; quic=":443"; ma=86400; persist=1' always;
52+
add_header QUIC-Status $http3;
53+
quic_retry on;
54+
quic_gso on;
55+
log_format simple '$ssl_server_name $scheme $ssl_alpn_protocol $status $ssl_protocol $server_protocol $ssl_curve $ssl_cipher';
56+
log_format main escape=json '{"@timestamp": "$time_iso8601","ssl_server_name": "$ssl_server_name","scheme": "$scheme","ssl_alpn_protocol": "$ssl_alpn_protocol","status": "$status","ssl_protocol": "$ssl_protocol","server_protocol": "$server_protocol","ssl_curve": "$ssl_curve","ssl_cipher": "$ssl_cipher"}';
57+
log_format debug escape=json '{'
58+
'"@timestamp": "$time_iso8601", '
59+
'"msec": "$msec", '
60+
'"connection": "$connection", '
61+
'"connection_requests": "$connection_requests", '
62+
'"pid": "$pid", '
63+
'"request_id": "$request_id", '
64+
'"request_length": "$request_length", '
65+
'"remote_addr": "$remote_addr", '
66+
'"remote_user": "$remote_user", '
67+
'"remote_port": "$remote_port", '
68+
'"time_local": "$time_local", '
69+
'"request": "$request", '
70+
'"request_uri": "$request_uri", '
71+
'"args": "$args", '
72+
'"status": "$status", '
73+
'"body_bytes_sent": "$body_bytes_sent", '
74+
'"bytes_sent": "$bytes_sent", '
75+
'"http_referer": "$http_referer", '
76+
'"http_user_agent": "$http_user_agent", '
77+
'"http_x_forwarded_for": "$http_x_forwarded_for", '
78+
'"http_host": "$http_host", '
79+
'"host": "$host", '
80+
'"ssl_server_name": "$ssl_server_name", '
81+
'"ssl_alpn_protocol": "$ssl_alpn_protocol", '
82+
'"server_name": "$server_name", '
83+
'"request_time": "$request_time", '
84+
'"upstream": "$upstream_addr", '
85+
'"upstream_connect_time": "$upstream_connect_time", '
86+
'"upstream_header_time": "$upstream_header_time", '
87+
'"upstream_response_time": "$upstream_response_time", '
88+
'"upstream_response_length": "$upstream_response_length", '
89+
'"upstream_cache_status": "$upstream_cache_status", '
90+
'"ssl_protocol": "$ssl_protocol", '
91+
'"ssl_cipher": "$ssl_cipher", '
92+
'"ssl_curve": "$ssl_curve", '
93+
'"scheme": "$scheme", '
94+
'"request_method": "$request_method", '
95+
'"server_protocol": "$server_protocol", '
96+
'"pipe": "$pipe", '
97+
'"gzip_ratio": "$gzip_ratio", '
98+
'"http_cf_ray": "$http_cf_ray", '
99+
'"http_x_forwarded_proto": "$http_x_forwarded_proto" '
100+
'}';
101+
access_log /dev/stdout simple;
102+
error_log stderr warn;
103+
gzip on;
104+
gzip_vary on;
105+
gzip_proxied any;
106+
gzip_comp_level 6;
107+
gzip_buffers 16 8k;
108+
gzip_http_version 1.1;
109+
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
110+
111+
brotli on;
112+
brotli_comp_level 6;
113+
brotli_static on;
114+
brotli_types application/atom+xml application/javascript application/json application/vnd.api+json application/rss+xml
115+
application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype
116+
application/x-font-ttf application/x-javascript application/xhtml+xml application/xml
117+
font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon
118+
image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml;
119+
120+
default_type application/octet-stream;
121+
include /etc/freenginx/mime.types;
122+
client_body_temp_path /tmp/client_temp;
123+
proxy_temp_path /tmp/proxy_temp_path;
124+
fastcgi_temp_path /tmp/fastcgi_temp;
125+
126+
proxy_buffering on;
127+
proxy_buffer_size 16k;
128+
proxy_busy_buffers_size 24k;
129+
proxy_buffers 384 4k;
130+
proxy_max_temp_file_size 0;
131+
132+
server {
133+
listen 8080 default_server fastopen=256;
134+
listen [::]:8080 default_server fastopen=256;
135+
listen 8443 default_server quic reuseport;
136+
listen [::]:8443 default_server quic reuseport;
137+
listen 8443 default_server ssl fastopen=256;
138+
listen [::]:8443 default_server ssl fastopen=256;
139+
server_name test.example.com;
140+
141+
if ($scheme = http) {
142+
return 308 https://test.example.com$request_uri;
143+
}
144+
if ($host = 'www.test.example.com') {
145+
rewrite ^/(.*)$ https://test.example.com/$1 permanent;
146+
}
147+
if ($host != 'test.example.com') {
148+
return 308 https://test.example.com$request_uri;
149+
}
150+
if ($request_method !~ ^(GET|POST|PUT)$) {
151+
return '405';
152+
}
153+
154+
location / {
155+
root /var/www/html;
156+
index index.html index.htm;
157+
158+
limit_except GET POST PUT {
159+
deny all;
160+
}
161+
}
162+
163+
location /robots.txt {
164+
return 200 "User-agent: *\nDisallow: /\n";
165+
}
166+
}
167+
}

0 commit comments

Comments
 (0)