app.conf

# https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/
# https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/

###SET_UPSTREAM
###END_SET_UPSTREAM

server {
    set $phpfpm_server ${APP_PHPFPM_DOCKER_SERVICE}:9000;
    set $host_path $APP_PATH_SRC/public;

    # Certification location
    include snippets/ssl-certificates.conf;

    # Strong TLS + TLS Best Practices
    include snippets/ssl.conf;

    # # NOTE: To use the HTTP challenge port 80 on NGINX must be open
    # listen 80;
    # include servers/shared/letsencrypt.conf;

    # server listen (HTTPS)
    listen 443 ssl http2;

    http2_push_preload on;
    http2_max_concurrent_pushes 25;

    server_name .yourdomain.tld;

    root $host_path;

    # Redirect www to non-www
    include snippets/www-to-non-www.conf;

    more_clear_headers Content-Security-Policy Feature-Policy;

    ###BEGIN_GEOIP2

    more_set_headers 'X-City: $geoip2_data_city_name';
    more_set_headers 'X-Country: $geoip2_data_country_name';

    if ($allowed_country = no) {
        return 403;
    }

    ###END_GEOIP2

    location / {
        try_files $uri $uri/ /index.php$is_args$query_string;

        #### Simple DDoS Defense / LIMITS
        #### Control Simultaneous Connections
        limit_conn conn_limit_per_ip 100;
        limit_req zone=req_limit_per_ip burst=2000 delay=1000;

        # Sets the status code to return in response to rejected requests
        limit_conn_status 460;
        limit_req_status 429;
    }

    # Several logs can be specified on the same level
    error_log /var/log/nginx/app.error.log warn;
    error_log /var/log/nginx/error.stderr.log warn;

    # Sets the path, format, and configuration for a buffered log write
    # # access_log /var/log/nginx/access.stdout.log main_json;
    access_log /var/log/nginx/app.main.access.log main_json;
    access_log /var/log/nginx/app.performance.access.log performance;

    include snippets/deny.conf;
    include snippets/php-fpm.conf;
    include snippets/cache-static.conf;
}