user  nobody;
worker_processes auto;
timer_resolution  100ms;
error_log  /dev/fd/2  notice;
pid        run/nginx.pid;

events {
    worker_connections  4096;
    multi_accept on;
    use epoll;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '$request_length $request_time $upstream_response_time '
                    '"$http_referer" "$http_user_agent" $http_x_forwarded_for';

    server_tokens off;
    ignore_invalid_headers   on;
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    etag off;
    client_body_timeout   30;
    client_header_timeout 30;
    large_client_header_buffers 4 8k;
    send_timeout 30;
    keepalive_timeout  30 30;

    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_certificate     /tmp/cert.pem;
    ssl_certificate_key /tmp/cert.key;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;
    ssl_dhparam /tmp/dhparams.pem;
    ssl_ecdh_curve secp384r1;

    geoip2 /tmp/GeoLite2-Country.mmdb {
        auto_reload 24h;

        $geoip_country_iso_code country iso_code;
        $geoip_country_name country names en;
    }

    # geoip2 /usr/local/nginx/conf/maxminddb/GeoLite2-City.mmdb {
    #     auto_reload 24h;

    #     $geoip_postal_code postal code;
    #     $geoip_latitude location  latitude;
    #     $geoip_longitude location longitude;
    #     $geoip_city city names en;
    # }

    limit_req_zone $binary_remote_addr zone=limited4:10m rate=4r/s;
    limit_req_status 429;

    #######################################################
    #                     default vhost                   #
    #######################################################
    server {
        listen 80 default_server;
        listen 443 http2 ssl;
        server_name     _ "";
        access_log /dev/fd/1;

        location = /ip {
            limit_req zone=limited4 burst=5 nodelay;
            if ($http_user_agent ~* (?:curl|wget|libwww-perl|python|ansible-httpget|HTTPie|WindowsPowerShell|http_request|^$)) {
                return 200 "$remote_addr\n";
            }
        }

        location = /nginx_status {
            stub_status on;
        }

        location = /phpfpm_status {
            include /usr/local/nginx/conf/fastcgi_params;
            fastcgi_pass   php:9000;
            fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        }
    }
}