New server: Install & configuration of services (Part III)

user www-data;
worker_processes auto;
worker_cpu_affinity auto;
# Change the default thread pool settings
thread_pool default threads=16 max_queue=65536;
# number of file descriptors used for nginx
# the limit for the maximum FDs on the server is usually set by the OS.
worker_rlimit_nofile 65535;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	# Determines how much clients will be served per worker
	# max clients = worker_connections * worker_processes
	worker_connections 65535;
	# Optimized to serve many clients with each thread, for linux only
	use epoll;
	# Accept as many connections as possible
	multi_accept on;
}

http {
	##
	# Basic Settings
	##

	# Copies data between one FD and other from within the kernel
	# faster than read() + write()
	sendfile on;
	# Use the default thread pool for asynchronous file I/O
	aio threads;
	# Only use AIO is used for when larger than or equal to this size
	directio 6m;
	# Send headers in one piece, it is better than sending them one by one
	tcp_nopush on;
	# Don't buffer data sent, good for small data bursts in real time
	tcp_nodelay on;
	# For security reasons don't send Nginx version in error messages or response headers
	server_tokens off;
	# Disable logging if a file can't be found
	log_not_found off;
	# Server will close connection after this time
	keepalive_timeout 65;
	# Max size of types hash tables (processing static sets of data. eg. server names, map directives or mime types)
	types_hash_max_size 2048;
	# Max allowed size of the client request body
	client_max_body_size 1G;
	# If the request body size is more than the buffer size, then the entire (or partial)
	# request body is written into a temporary file
	client_body_buffer_size 512k;
	# Request timed out
	client_body_timeout 300s;
	# Allow the server to close connection on non responding client, this will free up memory
	reset_timedout_connection on;

	# Do not turn off request buffering (proxy_buffering), directly pass it to the server without caching
        # See also: https://www.nginx.com/blog/avoiding-top-10-nginx-configuration-mistakes/#proxy_buffering-off
	# Buffer the response from the backend server, which contains the headers.
	proxy_buffer_size 32k;
	# Buffer size of the response to the client while the seponse is not yet fully read
	# proxy_buffer_size + 2x 4k buffers
	proxy_busy_buffers_size 32k;
	# xk = 128 times 16k buffering response (16k for the headers, 496k for the body response)
	proxy_buffers 128 16k;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##
	# Intermediate config
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
	ssl_prefer_server_ciphers off;
	ssl_session_cache shared:SSL:10m;
	ssl_session_timeout 10m;
	ssl_session_tickets off;

	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_ecdh_curve secp521r1:secp384r1:secp256k1;

	resolver 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s ipv6=off;
	resolver_timeout 4s;

  ##
  # Rate limiting
  ##
	# Whitelist of rate limit
	geo $limit {
	    default 1;
      127.0.0.1 0;
	    192.168.1.0/24 0;
	}
	map $limit $limit_key {
	    0 "";
	    1 $binary_remote_addr;
	}
	# Two stage rate limit (10 MB zone): 2 requests/sec limit (=second stage)
	limit_req_zone $limit_key zone=ip:10m rate=2r/s;
  # First stage (burst) can be found in the individual virtual server configs

	##
	# Logging Settings
	##
	# Discard 2xx or 3xx responses from logging
        # Fail2Ban rate limit filter still works, because it checks on Nginx error log
	map $status $loggable {
	    ~^[23] 0;
	    default 1;
	}
	log_format timed_combined '$remote_addr - $remote_user [$time_local]  '
		'"$request" $status $body_bytes_sent '
		'"$http_referer" "$http_user_agent" "$host" $request_time';

	access_log /var/log/nginx/access.log timed_combined if=$loggable;
	# Show warn, error, crit, alert and emerg messages
	error_log /var/log/nginx/error.log warn;

	##
	# Gzip Settings
	# Reduce the data that needs to be sent over network
	##
	gzip            on;
	gzip_disable    msie6;

	gzip_vary       on;
	gzip_comp_level 3;
	gzip_min_length 256;
	gzip_buffers    16 8k;
	gzip_proxied    any;
	gzip_types
		text/css
		text/plain
		text/javascript
		text/cache-manifest
		text/vcard
		text/vnd.rim.location.xloc
		text/vtt
		text/x-component
		text/x-cross-domain-policy
		application/javascript
		application/json
		application/x-javascript
		application/ld+json
		application/xml
		application/xml+rss
		application/xhtml+xml
		application/x-font-ttf
		application/x-font-opentype
		application/vnd.ms-fontobject
		application/manifest+json
		application/rss+xml
		application/atom_xml
		application/vnd.geo+json
		application/x-web-app-manifest+json
		image/svg+xml
		image/x-icon
		image/bmp
		font/opentype;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}

# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
set $path_info $fastcgi_path_info;

# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;

include fastcgi.conf;

## fastcgi settings
# Set PHP handler
fastcgi_pass unix:/run/php/php8.1-fpm.sock;
fastcgi_index index.php;
# Increase timeout
fastcgi_read_timeout 600;
fastcgi_intercept_errors on;
# Disable buffering (for uploading files)
fastcgi_request_buffering off;

# Increase memory size of the buffer segments (used for the payload of the response)
# 32 x 16k
fastcgi_buffers 32 16K;
# Increase memory buffer for HTTP response header
fastcgi_buffer_size 32k;

# fastcgi params
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
fastcgi_param HTTPS on;
fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
fastcgi_param front_controller_active true;     # Enable pretty urls

# Increase security (using the Diffie-Hellman Group file)
ssl_dhparam /etc/nginx/dhparam.pem;

# Don't leak powered-by
fastcgi_hide_header X-Powered-By;

# Security headers
# Don't allow the browser to render the page inside an frame or iframe and avoid clickjacking
add_header X-Frame-Options "SAMEORIGIN" always;
# Enable the Cross-site scripting (XSS) filter built into most recent web browsers.
add_header X-XSS-Protection "1; mode=block" always;
# When serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
# to disable content-type sniffing on some browsers.
add_header X-Content-Type-Options "nosniff" always;
# Referrer Policy will allow a site to control the value of the referer header in links away from their pages.
add_header Referrer-Policy "no-referrer" always;
# Disable the option to open a file directly on download
add_header X-Download-Options "noopen" always;
# Don't allow cross domain of Flash & PDF documents
add_header X-Permitted-Cross-Domain-Policies "none" always;
#  Feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# Restore IP behind proxy
real_ip_header X-Real-IP; ## X-Real-IP or X-Forwarded-For or proxy_protocol
real_ip_recursive off;    ## If you enable 'on'

location = /robots.txt {
    allow all;
    log_not_found off;
    access_log    off;
}

location = /favicon.ico {
    log_not_found off;
    access_log off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires    18d;
    add_header Access-Control-Allow-Origin "*";
    add_header Cache-Control "public, no-transform";
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    expires    18d;
    add_header Access-Control-Allow-Origin "*";
    add_header Cache-Control "public, no-transform";
    access_log off;
}

# Do not allow any hidden files or folders (including .htaccess or .env files and .git folder)
# Return 444, do not spent even resources
location ~ /\. {
  deny all;
  return 404;
  access_log off;
}

server {
    listen 80;
    server_name yourhomesite.com;
    # Redirect to HTTPS
    if ($host = yourhomesite.com) {
      return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    server_name yourhomesite.com;

    root /var/www/html;
    index index.html index.php;

    # Allow up to burst 80 requests, first 50 are processed without delay.
    # After 50 excessive requests we enforce our 2 r/s zone limit. After 80 excessive requests (burst) we reject the requests.
    limit_req zone=ip burst=80 delay=50;

    ssl_certificate /etc/letsencrypt/live/yourhomesite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourhomesite.com/privkey.pem;
    include snippets/security.conf;

    location / {
        add_header 'Access-Control-Allow-Origin' '*';
        try_files $uri $uri/ =404;
    }
    location ~ \.php(?:$|/) {
        include snippets/fastcgi-php.conf;
    }

    include snippets/general.conf;
}

pm = dynamic
pm.max_children = 120
pm.start_servers = 20
pm.min_spare_servers = 10
pm.max_spare_servers = 60
clear_env = no
# Uncommenting all env lines in www.conf

# Enable the dashboard webpage, seen above
set httpd port 2812 and
    use address localhost
    allow admin:secret_password

# Check CPU & memory usage
check system $HOST
   if loadavg (1min) per core > 2 for 5 cycles then alert
   if loadavg (5min) per core > 1.5 for 10 cycles then alert
   if cpu usage > 90% for 10 cycles then alert
   if cpu usage (wait) > 20% then alert
   if memory usage > 75% then alert
   if swap usage > 17% then alert

check filesystem rootfs with path /
  if space usage > 80% then alert
  group server

check filesystem Data with path /media/Data
  if space usage > 80% then alert
  group server

check filesystem Data_extra with path /media/Data_extra
  if space usage > 80% then alert
  group server

# Check RAID healthy
check program Data-raid with path "/sbin/mdadm --misc --detail --test /dev/md/Data"
  if status != 0 then alert

check program Data-extra-raid with path "/sbin/mdadm --misc --detail --test /dev/md/Data_extra"
  if status != 0 then alert

# Some services as an example
check process Nginx with pidfile /run/nginx.pid
   group www-data
   start program = "/bin/systemctl start nginx"
   stop program  = "/bin/systemctl stop nginx"
   if failed host 127.0.0.1 port 443 protocol https for 3 cycles then restart
   if 3 restarts within 5 cycles then unmonitor

check process sshd with pidfile /var/run/sshd.pid
   start program "/bin/systemctl start ssh"
   stop program "/bin/systemctl stop ssh"
   if failed port 22 protocol ssh then restart
   if 3 restarts within 5 cycles then unmonitor

# Ping test
check host google.com with address google.com
  if failed ping then alert

# Check network
check network public with interface enp45s0
   start program  = "/usr/sbin/ip link set dev enp45s0 up"
   stop program  = "/usr/sbin/ip link set dev enp45s0 down"
   if failed link then restart
   if failed link then alert
   if changed link then alert
   if saturation > 90% then alert
   if download > 40 MB/s then alert
   if total upload > 3 GB in last 2 hours then alert
   if total upload > 10 GB in last day then alert

deb https://deb.torproject.org/torproject.org focal main
deb-src https://deb.torproject.org/torproject.org focal main

max_connections = 300
shared_buffers = 8GB
work_mem = 2MB
maintenance_work_mem = 1GB
effective_io_concurrency = 200
dynamic_shared_memory_type = posix
max_worker_processes = 16
max_parallel_workers_per_gather = 4
max_parallel_maintenance_workers = 4
max_parallel_workers = 16
wal_buffers = 16MB
max_wal_size = 8GB
min_wal_size = 1GB
# Decrease to 1.1 when on SSD
random_page_cost = 1.1
# effective_cache_size = 0.5 * RAM
effective_cache_size = 16GB

# Only accept connections via socket file
port 0
unixsocket /var/run/redis/redis-server.sock
unixsocketperm 775
daemonize yes
pidfile /var/run/redis/redis-server.pid