nginx.conf

user  nginx nginx;
worker_processes  1;

error_log /opt/nginx/logs/error.log;
pid	/var/run/nginx.pid;

load_module modules/ngx_http_modsecurity_module.so;

events {
    worker_connections  1024;
    accept_mutex off; # "on" if nginx worker_processes > 1
    use epoll;
}



http {
    server_tokens   off;
    include       mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
                      
    error_log /opt/nginx/logs/http_error.log error;
    access_log  /opt/nginx/logs/http_access.log  main;


    sendfile        on;
    tcp_nopush on; 
    tcp_nodelay off;

    client_body_timeout 5;
    client_header_timeout 5;
    keepalive_timeout  7;
    send_timeout 6;

    gzip on;
    gzip_http_version 1.1;
    gzip_vary on;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_disable "MSIE [1-6]\.(?!.*SV1)";
    gzip_types  text/plain application/xhtml+xml text/xml 
                application/xml application/xml+rss
                application/json 
                text/css application/x-javascript 
                application/javascript 
                text/javascript;

    upstream uwsgicluster{
        server unix:///srv/nearby/uwsgi/uwsgi.sock;
    }

    # Deny IPs
    include /opt/nginx/www/blockips.inc;

    # rate limit requests 
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
    limit_req_zone $binary_remote_addr zone=upload_req:30m rate=20r/m;
    limit_conn_zone $binary_remote_addr zone=upload_conn:30m;
    limit_req_zone $binary_remote_addr zone=password_reset_req:30m rate=20r/m;
    limit_req_zone $binary_remote_addr zone=captcha_req:30m rate=3r/m;
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/m;

    # Maps ip address to $limit variable if request is of type POST
    map $request_method $limit {
        default         "";
        POST            $binary_remote_addr;
    }

    # Creates 10mb zone in memory for storing binary ips
    limit_req_zone $limit zone=post_zone:10m rate=2r/m;

    include /opt/nginx/www/*.conf;
}