Brotli支持

项目地址：https://github.com/google/ngx_brotli

brotli要比gzip压缩比高得多，压缩时间也要稍长些。

brotli只有部分浏览器支持。

在http块中配置

brotli_static on;
brotli on;  
brotli_comp_level 6;  
brotli_buffers 32 4k;  
brotli_min_length 20;  
brotli_types text/plain
    text/javascript
    text/css
    text/xml
    text/x-component
    text/x-json
    application/javascript
    application/x-javascript
    application/xml
    application/json
    application/xhtml+xml
    application/rss+xml
    application/atom+xml
    application/x-font-ttf
    application/vnd.ms-fontobject
    application/x-web-app-manifest+json
    image/svg+xml
    image/x-icon
    font/opentype
    text/html;

systemd脚本

在没有编译安装的时候没有启动脚本，自己创建一个[参考NginxWiki]

保存在：/lib/systemd/system/nginx.service

[Unit]
Description=The NGINX HTTP and reverse proxy server
After=syslog.target network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/usr/sbin/nginx -s reload
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target

pagespeed模块

https://github.com/apache/incubator-pagespeed-ngx

Header

server_tokens off;

add_header X-XSS-Protection "1; mode=block";

add_header X-Frame-Options "SAMEORIGIN";

SSL

安全

ssl_prefer_server_ciphers on;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

ssl_ecdh_curve secp384r1;

缓存

ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;
ssl_session_tickets off;

算法

ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';

OCSP Stapling

resolver 8.8.8.8 8.8.4.4;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/chain.crt;

dhparam

openssl dhparam -out dhparam.pem 2048

ssl_dhparam /etc/nginx/ssl/dhparam.pem;

HSTS

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

防盗链

强制ssl

WEBP

Event块

events {
  use epoll;
  multi_accept on;
}

Http块

http {     sendfile on;     tcp_nopush on;     tcp_nodelay on; }