nginx.conf

include /etc/nginx/conf/error_logging.conf;

pid /run/nginx.pid;

# Includes files with directives to load dynamic modules.
include /etc/nginx/modules/*.conf;

http {
    include /etc/nginx/naxsi_core.rules;
    include /etc/nginx/conf/naxsi/*.rules;

    resolver 127.0.0.1:5462 ipv6=off;

    include /etc/nginx/conf/nginx_rate_limits*.conf;
    include mime.types;
    default_type application/octet-stream;

    # Proxy Caching (Optional)
    include /etc/nginx/conf/nginx_cache_http.conf;

    # Big Buffers (Optional)
    include /etc/nginx/conf/nginx_big_buffers.conf;

    # Compression

    # Enable Gzip compressed.
    gzip on;

    # Compression level (1-9).
    # 5 is a perfect compromise between size and cpu usage, offering about
    # 75% reduction for most ascii files (almost identical to level 9).
    gzip_comp_level    5;

    # Don't compress anything that's already small and unlikely to shrink much
    # if at all (the default is 20 bytes, which is bad as that usually leads to
    # larger files after gzipping).
    gzip_min_length    256;

    # Compress data even for clients that are connecting to us via proxies,
    # identified by the "Via" header (required for CloudFront).
    gzip_proxied       any;

    # Tell proxies to cache both the gzipped and regular version of a resource
    # whenever the client's Accept-Encoding capabilities header varies;
    # Avoids the issue where a non-gzip capable client (which is extremely rare
    # today) would display gibberish if their proxy gave them the gzipped version.
    gzip_vary          on;

    # Compress all output labeled with one of the following MIME-types.
    gzip_types
      application/atom+xml
      application/javascript
      application/json
      application/ld+json
      application/manifest+json
      application/rss+xml
      application/vnd.geo+json
      application/vnd.ms-fontobject
      application/x-font-ttf
      application/x-web-app-manifest+json
      application/xhtml+xml
      application/xml
      font/opentype
      image/bmp
      image/svg+xml
      image/x-icon
      text/cache-manifest
      text/css
      text/plain
      text/vcard
      text/vnd.rim.location.xloc
      text/vtt
      text/x-component
      text/x-cross-domain-policy;
    # text/html is always compressed by HttpGzipModule

    log_format key-value 'server="$host" dest_port="$server_port" dest_ip="$server_addr" src="$remote_addr" '
                    'src_ip="$realip_remote_addr" time_local="$time_local" protocol="$server_protocol" status="$status" '
                    'bytes_out="$bytes_sent" bytes_in="$upstream_bytes_received" http_referer="$_http_referer" '
                    'http_user_agent="$http_user_agent" nginx_version="$nginx_version" '
                    'http_x_forwarded_for="$http_x_forwarded_for" http_x_header="$http_x_header" '
                    'uri_query="$_query_string" uri_path="$uri" http_method="$request_method" '
                    'response_time="$upstream_response_time" request_time="$request_time" '
                    'category="$sent_http_content_type" https="$https" x_request_id="$uuid"';

    map $request_uri $loggable {
      ~^/nginx_status/  0;
      default 1;
    }

    access_log /dev/stdout key-value if=$loggable;

    include /etc/nginx/conf/upload_size*.conf;
    include /etc/nginx/conf/nginx_http_extras*.conf;

    # config to not allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    add_header X-Frame-Options SAMEORIGIN;

    # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
    # to disable content-type sniffing on some browsers.
    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
    add_header X-Content-Type-Options nosniff;

    # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
    # It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
    # this particular website if it was disabled by the user.
    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
    add_header X-XSS-Protection "1; mode=block";

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

  # Accept underscores in headers as NAXSI does this
  underscores_in_headers on;

  server {
        # Optionally listen to proxy protocol:
        include  /etc/nginx/conf/nginx_listen.conf;

        # These should be volume added:
        include /etc/nginx/conf/server_certs.conf;

        # Set the correct host name from the request header...
        server_name $host;
        # Dont publish the version we are running
        server_tokens off;

        if ($ssl_protocol = "") {
          rewrite ^ https://$host$request_uri? permanent;
        }

        # Will set $country_code variables:
        set $country_code '??';

        include /etc/nginx/conf/nginx_server_extras*.conf ;

        location /nginx-proxy/ {
            alias /etc/nginx/html/;
            ssi on;
            error_page 404 /nginx-proxy/404.shtml;
            allow all;
        }
        location /ping {
            return 200;
        }

        location /RequestDenied {
            return 418; # Return a 418 (Teapot) status
        }

        include /etc/nginx/conf/locations/*.conf ;
    }

    server {
        listen 10088;
        location /nginx_status {
            stub_status on;
            access_log   off;
            allow 127.0.0.1;
            allow 172.17.0.1;
            deny all;
        }
    }
}
events {
}