nginx.conf

user nginx;

pid /var/run/nginx.pid;
error_log /var/log/nginx/error.log warn;

# As a thumb rule: One per CPU. If you are serving a large amount
# of static files, which requires blocking disk reads, you may want
# to increase this from the number of cpu_cores available on your
# system.
#
# The maximum number of connections for Nginx is calculated by:
# max_clients = worker_processes * worker_connections
worker_processes 1;

# Maximum file descriptors that can be opened per process
# This should be > worker_connections
worker_rlimit_nofile 8192;

# When you need > 8000 * cpu_cores connections, you start optimizing
# your OS, and this is probably the point at where you hire people
# who are smarter than you, this is *a lot* of requests.
events {
    worker_connections  8000;
    use epoll;
}

http {
    ##
    # Basic Settings
    ##
    sendfile            on;
    tcp_nopush          on;  # off may be better for long-polling
    tcp_nodelay         off;  # on may be better for long-polling
    types_hash_max_size 2048;
    server_tokens       off;
    server_names_hash_bucket_size 64;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # Timeouts
    ##
    client_body_timeout   10;
    client_header_timeout 10;
    keepalive_timeout     15;
    send_timeout          2;

    ##
    # Buffers
    ##
    client_body_buffer_size         8K;
    client_header_buffer_size       1k;
    client_max_body_size            100m;
    large_client_header_buffers 2   1k;

    ##
    # Cache
    ##
    add_header Cache-Control private always;
    add_header Cache-Control no-cache always;
    add_header Cache-Control no-store always;
    add_header Cache-Control must-revalidate always;
    add_header Pragma no-cache always;

    ##
    # SSL
    ##
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;

    ssl_prefer_server_ciphers on;

    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout  10m;

    ##
    # uWSGI
    ##
    include     /etc/nginx/uwsgi_params;
    uwsgi_param Host $http_host;
    uwsgi_param X-Forwarded-Proto $scheme;
    uwsgi_param X-Forwarded-For $proxy_add_x_forwarded_for;
    uwsgi_param X-Real-IP $remote_addr;

    ##
    # Proxy
    ##
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    ##
    # Logging Settings
    ##
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    log_format  timed '$remote_addr - $remote_user [$time_local]  $status '
                      '"$request" $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" '
                      '$request_time $upstream_response_time $pipe';
    access_log /var/log/nginx/access.log main;

    ##
    # Gzip Settings
    ##
    gzip on;
    gzip_disable "msie6";

    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 4;
    gzip_buffers 16 8k;
    gzip_min_length 512;
    gzip_http_version 1.1;

    gzip_types text/css text/javascript application/x-javascript text/xml text/plain text/x-component application/javascript application/json application/xml application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;

    ##
    # If HTTPS, then set a variable so it can be passed along.
    ##

    map $scheme $server_https {
        default off;
        https on;
    }

    ###
    # Throttling
    ##
    # We limit on IP (single machine)
    limit_req_zone  $binary_remote_addr  zone=one:10m   rate=5r/s;

    ##
    # Virtual Host Configs
    ##
    include /etc/nginx/conf.d/*.conf;
}

include /etc/nginx/server.d/*.conf;