nginx.conf

#user  nobody;
worker_processes 8; # Number of cpu threads * 2
worker_rlimit_nofile 200000;

#pid        logs/nginx.pid;


events {
    worker_connections  50000;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

# Performance
    sendfile                  on;
    tcp_nopush             on;
    tcp_nodelay            on;
    lingering_close on;
    aio    threads;
    aio_write on;
    directio 4m;
    client_body_timeout 3s;
    client_header_timeout 3s; 
    log_not_found          off;
    reset_timedout_connection on;
    proxy_buffer_size 4k;
    send_timeout 3s;    
    log_subrequest off;

# Proxy 
    proxy_connect_timeout              5s;
    proxy_send_timeout                 5s;
    proxy_read_timeout                 5s;
    proxy_buffering on; 
    proxy_cache_methods GET HEAD POST;
    proxy_cache_path /var/cache/nginx keys_zone=my_cache:60m max_size=3g inactive=24h use_temp_path=off;
    proxy_set_header X-Forwarded-For   "";
    proxy_set_header X-Forwarded-Proto "";
    proxy_set_header X-Forwarded-Host  "";
    proxy_set_header X-Forwarded-Port  "";
    proxy_set_header Connection        "";
    proxy_set_header X-Real-IP        $remote_addr;

# Limits
    limit_conn_zone $realip_remote_addr zone=addr:50m;
    limit_conn addr 8;    
    limit_conn_status 429;
    limit_req_zone $realip_remote_addr zone=limitreqsbyaddr:50m rate=6r/s;
    limit_req_status 429;
    limit_req zone=limitreqsbyaddr nodelay;

# Cache
    open_file_cache max=100000 inactive=10m;
    open_file_cache_valid 1h;
    open_file_cache_min_uses 1;
    open_file_cache_errors on;
    expires 1d;
    add_header Pragma "public";
    add_header Cache-Control "public";

# Dont expose nginx version
    server_tokens          off;

# Other
    real_ip_recursive on;
    access_log off;
    ignore_invalid_headers on;
    underscores_in_headers off;

    ssl_buffer_size 18k;
#    http2_chunk_size 8k;
#    http2_idle_timeout 1m;
    ssl_early_data on;

# Security headers
add_header X-XSS-Protection        "1; mode=block" always;
add_header X-Content-Type-Options  "nosniff" always;
add_header Referrer-Policy         "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
add_header Permissions-Policy      "interest-cohort=()" always;
add_header X-Frame-Options         "SAMEORIGIN";   
add_header X-Cache                 $upstream_cache_status;
#add_header Response-Time         $upstream_response_time;
#add_header Status                $upstream_status;


    resolver               1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout       5s;


    #keepalive_timeout  0;
    keepalive_timeout  60;

    gzip  on;
    gzip_comp_level 6;
    gzip_vary on;
    gzip_proxied any;



    server {
        listen       80;
        server_name  YOUR DOMAIN HERE;
     #   listen              443 ssl http2;
   # listen              [::]:443 ssl http2;

# SSL
      #  ssl_certificate /etc/ssl/pem-file-if-you-use-ssl.pem;
      #  ssl_certificate_key /etc/ssl/ssl-key-if-you-use-ssl.key;
      #  ssl_session_cache   shared:SSL:80m;
      #  ssl_session_timeout 28h;
      #  ssl_session_tickets  on;
       
    proxy_cache my_cache;
        #charset koi8-r;

        #access_log  logs/host.access.log  main;

# Uncomment this if you dont have apache2 on 8080 port
   #     location / {
  #         root   html;
 #          index  index.html index.htm;
#    }

location / {
     proxy_pass http://localhost:8080;
     real_ip_header    CF-Connecting-IP;
    # proxy_cache_key $scheme://$host$uri$is_args$query_string;
     proxy_cache_key $scheme://$host$uri$is_args;
     proxy_cache_valid 200 1h;
     proxy_cache_valid 404 400 403 5m;
     proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504 http_429;
     proxy_cache_lock on;
     proxy_cache_background_update on;
     proxy_cache_revalidate on;
     proxy_cache_min_uses 2;
     proxy_cache_valid 200 206 1h;
    }

# 7d cache for fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires    7d;
}

location /index.html {
expires 1h;
}

location ~* "(eval\()" {
    deny all;
}

location ~* "(base64_encode)(.*)(\()" {
    deny all;
}

location ~* "\.(old|orig|original|php#|php~|php_bak|save|swo|aspx?|tpl|sh|bash|bak?|cfg|cgi|dll|exe|git|hg|ini|jsp|log|mdb|out|sql|svn|swp|tar|rdf)$" {
    deny all;
}

location ~ /\.(?!well-known\/) {
    deny all;
}

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}






    # HTTPS server
    # I'm too lazy to edit all stuff below
    # Edit it if you need
    # And don't do that if no
#    server {
 #       listen       443 ssl;
  #      server_name  wtf.bioyuki.ml;
#
 #       ssl_certificate      /etc/ssl/pem-file-if-you-use-ssl.pem;
  #      ssl_certificate_key  /etc/ssl/ssl-key-if-you-use-ssl.key;
   #     ssl_protocols        TLSv1.2 TLSv1.3
    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

   #     ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}
}