raw.fastgit.org.conf

upstream rawgithub {
    server raw.githubusercontent.com:443;
    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name raw.fastgit.org;
    root /www/wwwroot/fg;

    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /var/www/cert/fg.pem;

    ssl_certificate /var/www/cert/fg.pem;
    ssl_certificate_key /var/www/cert/fg.key;

    # Run following command & set permission before configuring
    # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /var/lib/nginx/dhparam.pem
    ssl_dhparam /var/lib/nginx/dhparam.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;

    error_page 497  https://$host$request_uri;

    include /etc/nginx/snippets/anti-floc.conf;

    # SSL
    location ~ \.well-known {
        allow all;
    }

    # Fuck Search Engine
    location /robots.txt {
        allow all;
    }
    
    location / {
        valid_referers none blocked *.fastgit.xyz *.fastgit.org raw.githubusercontent.com github.com;
        if ($invalid_referer){
            return 403;
        }
        proxy_hide_header content-security-policy;
        proxy_hide_header Strict-Transport-Security;
        proxy_hide_header set-cookie;
        proxy_hide_header x-pjax-url;

        proxy_set_header Host raw.githubusercontent.com;
        # proxy_set_header Connection "";

        add_header X-FastGit-Node "dogyun-de-1";

        proxy_http_version 1.1;
        proxy_connect_timeout 5s;
        proxy_read_timeout 5s;

        proxy_pass https://rawgithub;
    }
    
    #location ~ .*\.(jpg|jpeg|gif|png|js|css)$
    #{
    #    valid_referers none blocked *.fastgit.org raw.githubusercontent.com github.com;
    #    if ($invalid_referer){
    #       return 403;
    #    }
    #    proxy_hide_header content-security-policy;
    #    proxy_hide_header Strict-Transport-Security;
    #    proxy_hide_header set-cookie;
    #    proxy_hide_header x-pjax-url;
    #
    #    proxy_set_header Host raw.githubusercontent.com;
    #    proxy_set_header Accept-Encoding "";
    #    #proxy_set_header Connection "";
    #
    #    add_header x-fastgit-node "dogyun-de-1";
    #
    #    proxy_http_version 1.1;
    #    proxy_connect_timeout 5s;
    #    proxy_read_timeout 5s;
    #
    #    proxy_pass https://rawgithub;
    #}

    # Block search engine
    # if ($http_user_agent ~* "qihoobot|Baiduspider|Googlebot|Googlebot-Mobile|Googlebot-Image|Mediapartners-Google|Adsbot-Google|Feedfetcher-Google|Yahoo! Slurp|Yahoo! Slurp China|YoudaoBot|Sosospider|Sogou spider|Sogou web spider|MSNBot|ia_archiver|Tomato Bot")
    # {
    #     return 403;
    # }

    access_log  /www/wwwlogs/raw.fastgit.org.log;
    error_log  /www/wwwlogs/raw.fastgit.org.error.log;
}