worker_processes 4;
worker_priority -1;
worker_rlimit_nofile 8192;
worker_cpu_affinity 0001 0010 0100 1000;

user      www-data;
pid       /var/run/nginx.pid;
error_log /var/log/nginx/error.log;

events {
    multi_accept on;
    worker_connections 4096;
}

http {
    map_hash_bucket_size 128;
    include /etc/nginx/mime.types;
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

### global ###
server_tokens           off;
server_name_in_redirect off;
ignore_invalid_headers  on;
if_modified_since       before;
root                    /etc/nginx/content/;
ssi                     on;
ssi_silent_errors       on; # testing=off
add_header X-Frame-Options SAMEORIGIN;
add_header Strict-Transport-Security max-age=16000000;

### tcp ###
tcp_nodelay             off;
tcp_nopush              on;
sendfile                on;
keepalive_requests      100;

### timeouts ###
resolver_timeout        6;
client_header_timeout   30;
client_body_timeout     60;
send_timeout            60;
keepalive_timeout       65 20;

### buffers ###
client_header_buffer_size   1k;
client_body_buffer_size     128k;
large_client_header_buffers 4 4k;
client_max_body_size        10m;
client_body_temp_path       /var/spool/nginx/client/;
output_buffers              1 32k;
postpone_output             1460;

### errors ###
recursive_error_pages   off;
error_page              400 402 403 405 406 410 411 413 416 /40x.html;
error_page              500 501 502 503 504 /50x.html;
error_page              404 =410 /40x.html;
error_page              443 =200 /test.png;
open_log_file_cache     max=1024 inactive=30s min_uses=3 valid=5m;

### acl ###
allow                   10.0.0.0/8;
allow                   172.16.0.0/12;
allow                   192.168.0.0/16;
deny                    all;

### ssl ###
ssl                     on;
#ssl_stapling           on; # selfsigned=off
#ssl_stapling_verify    on; # selfsigned=off
ssl_prefer_server_ciphers on;
ssl_protocols           TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers             HIGH:!RC4:!3DES:!aDSS:!aNULL:!kPSK:!kSRP:!MD5:@STRENGTH:+SHA1:+kRSA;
ssl_session_cache       shared:TLSSL:16m;
ssl_session_timeout     10m;
ssl_certificate         sslcert/de/<company>/wildcard.crt;
ssl_certificate_key     sslcert/de/<company>/wildcard.key;

### compression ###
gzip                    on;
gzip_disable            "msie6";
gzip_vary               on;
gzip_min_length         128;
gzip_buffers            128 32k;
gzip_comp_level         6;
gzip_proxied            any;
gzip_types              text/plain text/css text/x-component
                        text/xml application/xml application/xhtml+xml application/json
                        image/x-icon image/bmp image/svg+xml application/atom+xml
                        text/javascript application/javascript application/x-javascript
                        application/pdf application/postscript
                        application/rtf application/msword
                        application/vnd.ms-powerpoint application/vnd.ms-excel
                        application/vnd.ms-fontobject application/vnd.wap.wml
                        application/x-font-ttf application/x-font-opentype;

### proxy-global ###
#resolver               <dns-proxy>; # we use "pdnsd" here
proxy_intercept_errors  on; # testing=off
proxy_ignore_client_abort off;
proxy_redirect          http:// $scheme://;

### proxy-header ###
proxy_hide_header       Server;
proxy_hide_header       X-Powered-By;
proxy_hide_header       X-AspNet-Version;
proxy_set_header        Accept-Encoding   ""; # no backend compression
proxy_set_header        Host              $http_host;
proxy_set_header        X-Forwarded-By    $server_addr:$server_port;
proxy_set_header        X-Forwarded-For   $remote_addr;
proxy_set_header        X-Forwarded-Class $classification; # our internal custom header
proxy_set_header        X-Forwarded-Proto $scheme;
map $scheme $msiis      { http off; https on; } # compatibility
proxy_set_header        Front-End-Https   $msiis;

### proxy-timeouts ###
proxy_connect_timeout   6;
proxy_send_timeout      60;
proxy_read_timeout      60;

### proxy-buffers ###
proxy_buffering         on;
proxy_buffer_size       8k;
proxy_buffers           256 8k;
proxy_busy_buffers_size    64k;
proxy_temp_file_write_size 64k;
proxy_temp_path         /var/spool/nginx/temp/;

log_format apache
    '$remote_addr - $remote_user [$time_local] '
    '"$request" $status $body_bytes_sent '
    '"$http_referer" "$http_user_agent" '
    '"$http_cookie"';
log_format full
    '$remote_addr $remote_user [$time_local] '
    '"$host"->$proxy_host->$upstream_addr '
    '"$request" $status($upstream_status) '
    '$bytes_sent/$gzip_ratio($sent_http_content_type) '
    '$request_time($upstream_response_time)';
log_format perf
    '$request_time($upstream_response_time) '
    '$bytes_sent/$gzip_ratio($sent_http_content_type) '
    '$status "$upstream_addr$uri"';
log_format gzip
    '$bytes_sent/$gzip_ratio($sent_http_content_type) '
    '[$http_accept_encoding]"$http_user_agent"';

log_format redirect
    '$time_local $redir_match $redir_action $redir_url';

#access_log off;
 access_log /var/log/nginx/access.log      apache;
#access_log /var/log/nginx/access-full.log full;
#access_log /var/log/nginx/access-perf.log perf;
#access_log /var/log/nginx/access-gzip.log gzip;

upstream <backend-id-1>  {
  server <server-ip-1.1>:<internal-port>;
  server <server-ip-1.2>:<internal-port> backup;
}
upstream <backend-id-2>  {
  server <server-ip-2.1>:<internal-port>;
  server <server-ip-2.2>:<internal-port> backup;
}
...
upstream <backend-id-n>  {
  server <server-ip-n.1>:<internal-port>;
  server <server-ip-n.2>:<internal-port> backup;
}

#UP# upstream <backend-id-n>  {
#UP#   server <server-ip-n.1>:<internal-port>;
#UP#   server <server-ip-n.2>:<internal-port> backup;
#UP# }

location /<app-path>/ { proxy_pass http://<backend-id>; }

location / {
    if (-f $request_filename) { break; }
    proxy_pass http://<backend-id>;
}

location /<app-path>/ {
    client_max_body_size 100m;
    proxy_pass http://<backend-id>; }

location /<app-path>/ {
    send_timeout 3600;
    proxy_read_timeout 3600;
    proxy_pass http://<backend-id>;
}

location /<app-path>/ {
    proxy_intercept_errors off;
    proxy_pass http://<backend-id>;
}

server {
    ssl_certificate     sslcert/<dns-domain>/<subdomain>.crt;
    ssl_certificate_key sslcert/<dns-dmoain>/<subdomain>.key;
    listen              <ip>:443; allow all;
    server_name         <ip> <dns>;
    set $classification "<customer>.<channel>.<segment>";
    rewrite ^/+$        /<app-path>/ redirect;
    include             mapping/<segment>/<app-path>
}

map $redir_match $redir_target { hostnames;
#[<context>.]<hostname> #(static|refresh|redirect)@<scheme>://<target>/<context>/;
my-app-1.old-url.com    redirect@https://new-url.com/my-app-1/;
.old-url.com            redirect@https://new-url.com/default-app/;

if ($redir_target ~* ^(.*)@(.*)) { set $redir_action $1; set $redir_url $2; }
if ($redir_action = "static")    { rewrite ^ /301-static.html      last; }
if ($redir_action = "refresh")   { rewrite ^ /301-refresh.html     last; }
if ($redir_action = "redirect")  { rewrite ^ $redir_url permanent; break;
    access_log /var/log/nginx/redirector.log redirect;}

server {
    allow       all;
    listen      80 default; ssl off;
    listen      443 default ssl;
    server_name <dns-name>;

    include     mapping/security.ext;

    location /  {
        # deliver local files
        if (-f $request_filename) { break; }
        # redirector
        set $redir_host $http_host;
        if ($http_host ~* ^www\.(.*)) { set $redir_host    $1; }
        if ($uri ~* ^/([^/]+))        { set $redir_context $1.; }
        set $redir_match $redir_context$redir_host;
        include mapping/redir.action;
        # global https enforcement
        if ($scheme = "http") {
            rewrite ^ https://$http_host$request_uri permanent; }
    }

    location /status {
        stub_status     on;
        allow           <monitoring system>;
        deny            all;
    }
}

location /<login-app>/ {
    if ( $arg_<return-url> ~* ^https?(://|%3A%2F%2F)([^/%]+)(/|%2F)([^/%]*) ) {
         set $redir_match $4.$2; }
    include mapping/redirector.action;
    proxy_pass http://<backend-id>;
}