Configure timeouts & some improvements

CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 1.19.5-7
+
+* Set `aio` to `threads`.
+* Set `aio_write` to `on`.
+* Set `tcp_nodelay` to `on`.
+* Reduce `client_body_buffer_size` to `16k` (same as default).
+* Reduce `client_body_timeout` to `60s` (same as default).
+* Reduce `client_header_timeout` to `60s` (same as default).
+* Reduce `keepalive_timeout` to `75s` (same as default).
+* Reduce `proxy_connect_timeout` to `5s`.
+* Reduce `proxy_read_timeout` to `60s` (same as default).
+* Set `Proxy` header to `""` to mitigate httpoxy vulnerability.
+* Set `daemon` to `off`.
+* Set `multi_accept` to `on`.
+* Set `use` to `epoll`.
+* Reduce `worker_shutdown_timeout` to `240s`.
+* Disable keep-alive on healthcheck server.
+
 ## 1.19.5-6
 
 * Set `client_body_buffer_size` to `128k`.

config/http.conf

@@ -2,17 +2,21 @@ http {
   include /etc/nginx/mime.types;
   include /etc/nginx/log.conf;
 
+  aio       threads;
+  aio_write on;
+
   server_tokens           off;
   sendfile                on;
   tcp_nopush              on;
+  tcp_nodelay             on;
 
   client_max_body_size    500m;
-  client_body_buffer_size 128k;
-  client_body_timeout     300s;
-  client_header_timeout   605s;
-  keepalive_timeout       605s;
-  proxy_connect_timeout   60s;
-  proxy_read_timeout      600s;
+  client_body_buffer_size 16k;
+  client_body_timeout     60s;
+  client_header_timeout   60s;
+  keepalive_timeout       75s;
+  proxy_connect_timeout   5s;
+  proxy_read_timeout      60s;
   proxy_send_timeout      60s;
   send_timeout            60s;
 
@@ -48,6 +52,9 @@ http {
   proxy_set_header    Connection          "";
   proxy_set_header    Host                $host;
 
+  # Mitigate httpoxy vulnerability
+  proxy_set_header    Proxy               "";
+
   proxy_set_header    X-Real-IP           $remote_addr;
   proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
   proxy_set_header    X-Forwarded-Proto   $proxy_x_forwarded_proto;
@@ -59,11 +66,13 @@ http {
   include /etc/nginx/app.conf;
 
   server {
-      listen 18081 default_server;
+    listen 18081 default_server;
+
+    access_log off;
+    keepalive_timeout 0;
 
-      location /healthz {
-          access_log off;
-          return 200;
-      }
+    location /healthz {
+      return 200;
+    }
   }
 }

config/main.conf

@@ -1,7 +1,11 @@
+daemon off;
+
 worker_processes        auto;
 worker_rlimit_nofile    8192;
-worker_shutdown_timeout 630s;
+worker_shutdown_timeout 240s;
 
 events {
-    worker_connections 8000;
+  multi_accept       on;
+  worker_connections 8000;
+  use                epoll;
 }