nginx.conf

user  www-data;
worker_processes  auto;
error_log  /var/log/nginx/error.log;

events {
    use epoll;
    worker_connections  4096;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    log_format main
      '{"@timestamp":"$time_iso8601",'
        '"host":"$hostname",'
        '"server_ip":"$server_addr",'
        '"client_ip":"$remote_addr",'
        '"xff":"$http_x_forwarded_for",'
        '"domain":"$host",'
        '"url_path":"$uri",'
        '"referer":"$http_referer",'
        '"args":"$args",'
        '"upstreamtime":"$upstream_response_time",'
        '"responsetime":"$request_time",'
        '"request_method":"$request_method",'
        '"status":"$status",'
        '"size":"$body_bytes_sent",'
        '"request_length":"$request_length",'
        '"protocol":"$server_protocol",'
        '"upstreamhost":"$upstream_addr",'
        '"file_dir":"$request_filename",'
        '"http_user_agent":"$http_user_agent"'
      '}';
    access_log  /var/log/nginx/access.log  main;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    client_max_body_size 50M;
    client_body_buffer_size 50m;
    server_tokens off;

    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    # gzip
    gzip  on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain  application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png application/vnd.ms-fontobject font/ttf font/opentype font/x-woff image/svg+xml application/json;

    # header
    add_header Strict-Transport-Security "max-age=604800; includeSubDomains;preload" always;
    add_header X-Frame-Options DENY;

    # waf
    lua_package_path "/usr/local/openresty/nginx/conf/waf/?.lua;;";
    lua_shared_dict limit 50m;
    init_by_lua_file  /usr/local/openresty/nginx/conf/waf/init.lua;
    access_by_lua_file /usr/local/openresty/nginx/conf/waf/waf.lua;

    include /usr/local/openresty/nginx/conf/deamon.conf;
    include /usr/local/openresty/nginx/conf/server_upstream.conf;
}