nginx.conf editor

nginx443front: running

user nginx;
worker_processes auto;

error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;

events {
    worker_connections 8192;
    multi_accept on;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

#log_format main '[$time_local] $remote_addr "$request" $status "$http_referer" "$http_user_agent"';
    #access_log /var/log/nginx/access-http.log main;

map $http_upgrade $connection_upgrade {
        default upgrade;
        ""      close;
    }

server {
        listen      80 default_server;
        listen      [::]:80 default_server;
        return 301 https://$host$request_uri;
    }

server {
        listen      80;
        listen      [::]:80;
        server_name web.telegram.org, oplata.sbermobile.ru;

location / {
            proxy_pass               http://remnanode:10000;
            proxy_http_version       1.1;
            proxy_set_header         Upgrade $http_upgrade;
            proxy_set_header         Connection $connection_upgrade;
            proxy_set_header         Host $host;
            proxy_set_header         X-Real-IP $remote_addr;
            proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header         X-Forwarded-Proto $scheme;
            proxy_buffering          off;
            proxy_request_buffering  off;
            proxy_read_timeout       1h;
        }
    }

server {
        listen                127.0.0.1:8443 ssl default_server;
        ssl_reject_handshake  on;
        ssl_protocols         TLSv1.2 TLSv1.3;
        ssl_session_timeout   1h;
        ssl_session_cache     shared:SSL:10m;
    }

server {
        listen                     127.0.0.1:8443 ssl;
        http2 on;
        server_name                ws.de2.smygo.ru;

ssl_certificate            /certs/live/ws.de2.smygo.ru/fullchain.pem;
        ssl_certificate_key        /certs/live/ws.de2.smygo.ru/privkey.pem;
        ssl_protocols              TLSv1.2 TLSv1.3;
        ssl_ciphers                TLS13_AES_128_GCM_SHA256:TLS13_AES_256_GCM_SHA384:TLS13_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
        ssl_prefer_server_ciphers  on;

#ssl_stapling               on;
        #ssl_stapling_verify        on;
        resolver                   1.1.1.1 valid=60s;
        resolver_timeout           2s;

location / {
            proxy_pass               http://remnanode:10000;
            proxy_http_version       1.1;
            proxy_set_header         Upgrade $http_upgrade;
            proxy_set_header         Connection $connection_upgrade;
            proxy_set_header         Host $host;
            proxy_set_header         X-Real-IP $remote_addr;
            proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header         X-Forwarded-Proto $scheme;
            proxy_buffering          off;
            proxy_request_buffering  off;
            proxy_read_timeout       1h;
        }
    }

server {
        listen                     127.0.0.1:8443 ssl;
        http2 on;
        server_name                nginx.de2.smygo.ru;

ssl_certificate            /certs/live/nginx.de2.smygo.ru/fullchain.pem;
        ssl_certificate_key        /certs/live/nginx.de2.smygo.ru/privkey.pem;
        ssl_protocols              TLSv1.2 TLSv1.3;
        ssl_ciphers                TLS13_AES_128_GCM_SHA256:TLS13_AES_256_GCM_SHA384:TLS13_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
        ssl_prefer_server_ciphers  on;

#ssl_stapling               on;
        #ssl_stapling_verify        on;
        resolver                   1.1.1.1 valid=60s;
        resolver_timeout           2s;

location / {
            proxy_pass               http://nginx-conf-ui;
            proxy_http_version       1.1;
            proxy_set_header         Upgrade $http_upgrade;
            proxy_set_header         Connection $connection_upgrade;
            proxy_set_header         Host $host;
            proxy_set_header         X-Real-IP $remote_addr;
            proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header         X-Forwarded-Proto $scheme;
            proxy_buffering          off;
            proxy_request_buffering  off;
            proxy_read_timeout       1h;
        }
    }

}

stream {
    #log_format stream_main '[$time_local] $remote_addr $proxy_protocol_addr -> $upstream_addr';
    #access_log /var/log/nginx/access-stream.log stream_main;

map $ssl_preread_server_name $backend_443 {
        ws.de2.smygo.ru       internal_https;
        nginx.de2.smygo.ru    internal_https;
        default               xray_reality;
    }

upstream xray_reality {
        server remnanode:443;
    }

upstream internal_https {
        server 127.0.0.1:8443;
    }

server {
        listen                443 reuseport;
        listen                [::]:443 reuseport;
        proxy_pass             $backend_443;
        ssl_preread            on;
        proxy_connect_timeout   3s;
        proxy_timeout           1h;
    }

}