From ea577f6eec0aa26dd9429b4f0fa458e87164af89 Mon Sep 17 00:00:00 2001
From: Kenny Yang <45874689+shakenny@users.noreply.github.com>
Date: Tue, 21 May 2024 17:31:58 +0800
Subject: [PATCH] Add files via upload

---
 default.conf       | 18 ++++++++++
 default_server.crt | 23 ++++++++++++
 default_server.key | 28 +++++++++++++++
 nginx.conf         | 88 ++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 157 insertions(+)
 create mode 100644 default.conf
 create mode 100644 default_server.crt
 create mode 100644 default_server.key
 create mode 100644 nginx.conf

diff --git a/default.conf b/default.conf
new file mode 100644
index 0000000..327ff59
--- /dev/null
+++ b/default.conf
@@ -0,0 +1,18 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    return 444;
+}
+
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    server_name _;
+
+    ssl_certificate /etc/nginx/certs/default_server.crt;
+    ssl_certificate_key /etc/nginx/certs/default_server.key;
+
+    return 444;
+}
+
diff --git a/default_server.crt b/default_server.crt
new file mode 100644
index 0000000..a6bdf73
--- /dev/null
+++ b/default_server.crt
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDzzCCAregAwIBAgIUNkd2QJ/vbSlgDFK2ZHzazYhHx1swDQYJKoZIhvcNAQEL
+BQAwdzELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVN0YXRlMQ0wCwYDVQQHDARDaXR5
+MRUwEwYDVQQKDAxPcmdhbml6YXRpb24xHDAaBgNVBAsME09yZ2FuaXphdGlvbmFs
+IFVuaXQxFDASBgNVBAMMC0NvbW1vbiBOYW1lMB4XDTI0MDMxNDA2NTE0MloXDTM5
+MDMxMTA2NTE0MlowdzELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVN0YXRlMQ0wCwYD
+VQQHDARDaXR5MRUwEwYDVQQKDAxPcmdhbml6YXRpb24xHDAaBgNVBAsME09yZ2Fu
+aXphdGlvbmFsIFVuaXQxFDASBgNVBAMMC0NvbW1vbiBOYW1lMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwcjsaRU9v8j0FcJY8QCnftU8w8PJs/P1MI+H
+c9zq8l74lcRfnl2LYu/yk/qIr1tPyU5NdrcwrcDXapgjqLCyhi+ZiKWJj/kNZqkt
+pCN/BZIapUAqziRVt3SNOa1UeqOlV1ccuTIhM8fX+XASjrvNolGDiHtRF1lSr2EW
+HnjkBHJ3U6yraQjWUzTtM+ZM8TBpPcwxQzdpK34SOtCndyCDx75vfTeQ4H+uy8vA
+8x+NmKxzQz4vC9JM0+H7DPFXhet8mxUIhjDVwSLzbkD5u+F5RenC+eMYP0PDML4E
+maA5tyjvbw+gimLduUxqU6gy+Hx8x7jZP3fTW3gveHNbLy7JdwIDAQABo1MwUTAd
+BgNVHQ4EFgQUrVJScje0dM+UbcF/xGtAem+gQ1YwHwYDVR0jBBgwFoAUrVJScje0
+dM+UbcF/xGtAem+gQ1YwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
+AQEAbQ7+X3vRPufac8PiJQiFtYczJRtDeGx1Ytqrz7kAeS05eELrTovAiTI+CxUM
+VBe6bxUZo0nkYDXN8JQqEwTwaYn4Cd7oIWoNMZ9bCa+PfQE3eEgCBNV+D+gpXtvm
+BpEysYk8P9ffrg1AkHHHTgQfLeMr60BXT/PxucV+P/xfm6kyn0bP3ggIdNVIGj+d
+3PlzWdatRySuRBL2udohHH2bRyBLo0FqHWeeJRpbc4x1c0p45/7n84GM7VKpI/y9
+VOWz3DVl8AQkOTQb/t8R5Kv9dPB8aXNyQNKUc5U8mQmg4/VLRadr8wUOqgcNOJhD
+5Fxp3NplbwfEUjHc5k1zQCWRyw==
+-----END CERTIFICATE-----
diff --git a/default_server.key b/default_server.key
new file mode 100644
index 0000000..ff8d66f
--- /dev/null
+++ b/default_server.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDByOxpFT2/yPQV
+wljxAKd+1TzDw8mz8/Uwj4dz3OryXviVxF+eXYti7/KT+oivW0/JTk12tzCtwNdq
+mCOosLKGL5mIpYmP+Q1mqS2kI38FkhqlQCrOJFW3dI05rVR6o6VXVxy5MiEzx9f5
+cBKOu82iUYOIe1EXWVKvYRYeeOQEcndTrKtpCNZTNO0z5kzxMGk9zDFDN2krfhI6
+0Kd3IIPHvm99N5Dgf67Ly8DzH42YrHNDPi8L0kzT4fsM8VeF63ybFQiGMNXBIvNu
+QPm74XlF6cL54xg/Q8MwvgSZoDm3KO9vD6CKYt25TGpTqDL4fHzHuNk/d9NbeC94
+c1svLsl3AgMBAAECgf8E39IunTUrmtUUAQY1xxbxrzqVdtCdfe0CwJaEHkoRoj0y
+c/ZJlQN2KD0ctXqLU0FmAS8QtDmGtld+CfP3yA97zOGfTqg73bIIIqm3xCtTIIAn
+7vj1T5vfvtx0RBRAiB5YDiXVuXL+wUe6w0k36UNC4MEiwm2ySTWV9BrYegWVHmi2
+TnCTSaoDe1h0glJXa2zfl+AAI7EGWFcyYljOpGBO3UwdZ2JmLoE+OgoypFKumPGr
+nnYX/hfpYxga2PxJpTM3imHn3C063AnUcqif3YUvQV38D0I3YrNOXDYuwf8GahNE
+El5Jbm+GuMvmiT9gKolGvNS5211FC/B2Ft7c1vECgYEA4HFb0YwoJsbURemoibWc
+nD+DHSXcNQjlNdFOZrydX52Y13SOoHt2QtUArWr4yZQLRrG2/XkNyY9QkWu5Om/R
+2s8YH35rN3EaAoKbKbSMX4qkzIQJRe4ocjclHGRG34WF99HIBibkB/z1B6/e3dPk
+oWTJO/NpOCCNHZSIHJ82jMMCgYEA3QgOX/Fc6TKyqcwdgMlPZldmnSOtTngCD7dS
+q1UlrJShSgjR/UhUP0W3U4tiCELaUxk/xmqpxR9Pr+ycnw/dkPtMQxD5fu3ZRpNf
+1THs/cejTwvzxQxK+jBohH5956cPWkWgJEMDbtv/LdwxhTtxE4/j/upkLaL/Bqje
+vbab1T0CgYEA2KNSdy8LynH8jwb8UP/ljMOZMNdMeDx/0bSYMn44gQRDdSPiT3Ec
+M2IZ50nrndayE6iR8pOYBUe6AsOx5H/uVX+zzyJdJwSakHW0g0rse4P9khKYSNGa
+ZLRps7/u0O224/+vTJDZZgR6FtNhEUjn1AjOXHmUxEJXM4gc4VOkebUCgYEAjDyp
+SixMY9T70ImmCmkvjGJVw8u4ELpJrIkG1Zf/gEEJGH0CJq52bXKhP0uHFnC8Ls8t
+TImuT1hvadI5CR662Fro5wBlHChym7mzqwOzNs0si2Gs98+13olKNw4+efTf48mb
+MoamLfc9L26uqLavJtc7tCgpCV+KaUJJmJq8wo0CgYEA0zT49t+gbCsPmkne81vU
+rnVEqzFltpHvNrT7zIVM6M7bPx8wU2767CIzhJBZpYoMO+btYvJjoj8Tll17SqoF
+QLhV7KSqSVb9QuT4skAq7S880enrfnOMAQqx+iKyxNUrVKiRLJqu8aOARRlQzi+v
+LZwwjaHgzyg/mUr+3Yhm5+U=
+-----END PRIVATE KEY-----
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..4d905bf
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,88 @@
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+worker_rlimit_nofile 65535;
+
+events {
+    multi_accept on;
+    worker_connections 2048;
+}
+
+
+http {
+    server_tokens off;
+
+    http2 on;
+    http3 on;
+
+    ssl_prefer_server_ciphers on;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_cache shared:SSL:30m;
+    ssl_session_timeout 1h;
+
+    ssl_session_tickets off;
+    ssl_buffer_size 32k;
+
+    ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE";
+    
+    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';";
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-XSS-Protection "1; mode=block";
+    add_header X-Content-Type-Options nosniff;
+    add_header Referrer-Policy "no-referrer-when-downgrade";
+    add_header Permissions-Policy "geolocation=(), microphone=()";    
+
+    server_names_hash_max_size 1024;
+    server_names_hash_bucket_size 128;
+    types_hash_max_size 2048;
+    types_hash_bucket_size 128;
+    variables_hash_max_size 1024;
+    variables_hash_bucket_size 128;
+
+    open_file_cache max=1024 inactive=20s;
+    open_file_cache_valid 60s;
+    open_file_cache_min_uses 2;
+    open_file_cache_errors off;
+
+    limit_req_zone $binary_remote_addr zone=example_zone:30m rate=25r/s;
+    limit_req zone=example_zone burst=50 nodelay;
+    limit_rate 5m;
+
+    fastcgi_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:20m max_size=512m inactive=30m;
+    proxy_buffering on;
+    proxy_buffers 16 8k;
+
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+
+    tcp_nopush     on;
+    tcp_nodelay    on;
+
+    keepalive_timeout  65;
+
+    # expires 1h;
+    gzip on;
+    gzip_static on;
+    gzip_buffers 16 8k;
+    client_body_buffer_size 128k;
+
+    output_buffers 4 32k;
+    
+    proxy_connect_timeout 60s;
+    proxy_send_timeout 60s;
+    proxy_read_timeout 60s;
+
+    include /etc/nginx/conf.d/*.conf;
+}