Semi-Optimized nginx Configuration for snac2

snac2-nginx.conf

proxy_cache_path /var/cache/nginx/snac_cache levels=1:2 keys_zone=snac:10m max_size=1g inactive=1440m use_temp_path=off;

upstream backend {
    server localhost:8001 fail_timeout=0;
}

server
{
  server_name YOUR-DOMAIN;
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

  location / {
    proxy_pass http://backend;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $remote_addr;
  }
  location /.well-known/webfinger {
    proxy_pass http://backend;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $remote_addr;
  }
  location /api/v1/ {
    proxy_pass http://backend;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $remote_addr;
  }
  location /api/v2/ {
    proxy_pass http://backend;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $remote_addr;
  }
  location /oauth
  {
    proxy_pass http://backend;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $remote_addr;
  }
  location /.well-known/nodeinfo {
    proxy_pass http://backend;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $remote_addr;
  }
  location /.well-known/host-meta {
    proxy_pass http://backend;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $remote_addr;
  }
  location ~ ^/.+/(s|x|y)/ {
    proxy_cache snac;
    proxy_pass http://backend;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_cache_valid 200 1d;
    proxy_cache_valid 404 1h;
    proxy_ignore_headers "Cache-Control" "Expires";
    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
    proxy_cache_lock on;
    add_header X-Proxy-Cache $upstream_cache_status;
  }

  listen 443 ssl http2;
  ssl_certificate /etc/letsencrypt/live/YOUR-DOMAIN/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/YOUR-DOMAIN/privkey.pem; # managed by Certbot
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 10m;
  ssl_session_tickets on;
  ssl_buffer_size 4k;

  access_log /var/log/nginx/snac2.access.log combined;

  gzip on;
  gzip_disable "msie6";
  gzip_vary on;
  gzip_proxied any;
  gzip_comp_level 6;
  gzip_buffers 16 8k;
  gzip_http_version 1.1;
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml image/x-icon;

  client_max_body_size 100m;

}

server
{
  if ($host = YOUR-DOMAIN) {
    return 301 https://$host$request_uri;
  }

  listen 80;
  listen [::]:80;
  server_name YOUR-DOMAIN;
    return 404;
}