nginx.conf

#jinja2:lstrip_blocks: True
# Defines user and group credentials used by worker processes. If group is
# omitted, a group whose name equals that of user is used.
{% if ansible_os_family == 'Debian' %}
user    www-data;
{% else %}
user    nginx;
{% endif %}

# Defines the number of worker processes.    Setting it to the number of
# available CPU cores should be a good start. The value `auto` will try to
# autodetect that.
worker_processes auto;

# Configures logging to `/var/log/...`. Log level `error` is used by default.
error_log /var/log/nginx/error.log;

# Defines a file that will store the process ID of the main process. This needs
# to match the Systemd unit file.
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
{% if ansible_os_family == 'Debian' %}
include /etc/nginx/modules-enabled/*.conf;
{% else %}
include /usr/share/nginx/modules/*.conf;
{% endif %}

events {
  # Sets the maximum number of simultaneous connections that can be opened by
  # a worker process.
  worker_connections 1024;
}

http {
  # Include mime types for different file extensions.
  include /etc/nginx/mime.types;

  # Disable access log.
  #access_log /var/log/nginx/access.log;
  access_log off;

  # Defines the default MIME type of a response.
  default_type application/octet-stream;

  # Sendfile copies data between one file descriptor and other from within the
  # kernel. This is more efficient than read() and write() since they require
  # transferring data to and from the user space.
  sendfile on;

  # Todo: Write explanation
  # https://t37.net/nginx-optimization-understanding-sendfile-tcp_nodelay-and-tcp_nopush.html
  tcp_nopush on;
  tcp_nodelay on;

  # Enable on-the-fly gzip compression for larger plain text files and for
  # proxies applications.
  gzip on;
  gzip_comp_level 2;
  gzip_min_length 1000;
  gzip_proxied expired no-cache no-store private auth;
  gzip_types
      application/javascript
      application/json
      application/x-javascript
      application/xml
      image/svg+xml
      text/css
      text/javascript
      text/js
      text/plain
      text/xml;

  # Do not send the nginx version number in error pages and Server header
  server_tokens off;

  server {
    # Enforce HTTPS by redirecting requests
    listen 80;
    listen [::]:80;
    server_name _;

    # Serve certbot ACME requests
    location /.well-known/ {
      root /var/lib/nginx/;
    }

    # Enforce encrypted connections for everything else
    location / {
      return 301 https://{{ inventory_hostname }}$request_uri;
    }
  }

  server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name _;

    ssl_certificate_key /etc/nginx/tls/certificate.key;
    ssl_certificate     /etc/nginx/tls/certificate.crt;

    # Additional TLS related Nginx options
    include /etc/nginx/tls/tls.conf;

    {{ nginx_proxy | indent(4)}}
  }
}