user nginx;
pid /var/run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 65535;

events {
        multi_accept on;
        worker_connections 65535;
}

http {
        charset utf-8;
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        server_tokens off;
        log_not_found off;
        types_hash_max_size 2048;
        types_hash_bucket_size 64;
        client_max_body_size 16M;

        # MIME
        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        # logging
        access_log off;
        error_log /dev/null crit;

        # SSL
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:10m;
        ssl_session_tickets off;

        # Diffie-Hellman parameter for DHE ciphersuites
        ssl_dhparam            /etc/nginx/ssl/dhparam.pem;

        # Mozilla Intermediate configuration
        ssl_protocols          TLSv1.2 TLSv1.3;
        ssl_ciphers            ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

        # OCSP Stapling
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver               223.5.5.5 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
        resolver_timeout       2s;

        # load configs
        include                /etc/nginx/sites-available/*;
}