mempool/production/nginx.conf

user nobody;
pid /var/run/nginx.pid;

worker_processes auto;
worker_rlimit_nofile 100000;

events {
	worker_connections 9000;
	multi_accept on;
}

http {
	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;

	server_tokens off;
	server_name_in_redirect off;

	include /usr/local/etc/nginx/mime.types;
	default_type application/octet-stream;

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	# reset timed out connections freeing ram
	reset_timedout_connection on;
	# maximum time between packets the client can pause when sending nginx any data
	client_body_timeout 10s;
	# maximum time the client has to send the entire header to nginx
	client_header_timeout 10s;
	# timeout which a single keep-alive client connection will stay open
	keepalive_timeout 69s;
	# maximum time between packets nginx is allowed to pause when sending the client data
	send_timeout 10s;

	# number of requests per connection, does not affect SPDY
	keepalive_requests 100;

	# enable gzip compression
	gzip on;
	gzip_vary on;
	gzip_comp_level 6;
	gzip_min_length 1000;
	gzip_proxied expired no-cache no-store private auth;
	# text/html is always compressed by gzip module
	gzip_types application/javascript application/json application/ld+json application/manifest+json application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard;

	# limit request body size
	client_max_body_size 10m;

	# proxy cache
	proxy_cache off;
	proxy_cache_path /var/cache/nginx keys_zone=cache:20m levels=1:2 inactive=600s max_size=500m;
	types_hash_max_size 2048;

	# exempt localhost from rate limit
	geo $limited_ip {
		default		1;
		127.0.0.1	0;
		103.99.170.201  0;
		103.99.170.202  0;
		2401:b140:1::92:201 0;
		2401:b140:1::92:202 0;
	}
	map $limited_ip $limited_ip_key {
		1 $binary_remote_addr;
		0 '';
	}

	# rate limit requests
	limit_req_zone $limited_ip_key zone=api:5m rate=200r/m;
	limit_req_zone $limited_ip_key zone=electrs:5m rate=2000r/m;
	limit_req_status 429;

	# rate limit connections
	limit_conn_zone $limited_ip_key zone=websocket:10m;
	limit_conn_status 429;

	map $http_accept_language $header_lang {
		default en-US;
		~*^en-US en-US;
		~*^en en-US;
	        ~*^ar ar;
	        ~*^cs cs;
	        ~*^de de;
	        ~*^es es;
	        ~*^fa fa;
	        ~*^fr fr;
	        ~*^ko ko;
	        ~*^it it;
	        ~*^ka ka;
	        ~*^hu hu;
	        ~*^nl nl;
	        ~*^ja ja;
	        ~*^nb nb;
	        ~*^pt pt;
	        ~*^sl sl;
	        ~*^fi fi;
	        ~*^sv sv;
	        ~*^tr tr;
	        ~*^uk uk;
	        ~*^vi vi;
	        ~*^zh zh;
	}

	map $cookie_lang $lang {
		default $header_lang;
		~*^en-US en-US;
		~*^en en-US;
	        ~*^ar ar;
	        ~*^cs cs;
	        ~*^de de;
	        ~*^es es;
	        ~*^fa fa;
	        ~*^fr fr;
	        ~*^ko ko;
	        ~*^it it;
	        ~*^ka ka;
	        ~*^hu hu;
	        ~*^nl nl;
	        ~*^ja ja;
	        ~*^nb nb;
	        ~*^pt pt;
	        ~*^sl sl;
	        ~*^fi fi;
	        ~*^sv sv;
	        ~*^tr tr;
	        ~*^uk uk;
	        ~*^vi vi;
	        ~*^zh zh;
	}

	upstream electrs-mainnet {
		server [2401:b140:1::100:220]:3000 fail_timeout=0s max_fails=0;
		server [2401:b140:1::100:210]:3000 backup;
	}
	server {
		listen 127.0.0.1:2000;
		access_log /dev/null;
		location / {
			proxy_pass http://electrs-mainnet;
		}
	}
	
	upstream electrs-liquid {
		server [2401:b140:1::100:220]:3001 fail_timeout=0s max_fails=0;
		server [2401:b140:1::100:210]:3001 backup;
	}
	server {
		listen 127.0.0.1:2001;
		access_log /dev/null;
		location / {
			proxy_pass http://electrs-liquid;
		}
	}

	upstream electrs-testnet {
		server [2401:b140:1::100:220]:3002 fail_timeout=0s max_fails=0;
		server [2401:b140:1::100:210]:3002 backup;
	}
	server {
		listen 127.0.0.1:2002;
		access_log /dev/null;
		location / {
			proxy_pass http://electrs-testnet;
		}
	}

	server {
		listen 80;
		server_name mempool.space mempool.ninja node100.bitcoin.wiz.biz;
		return 301 https://$host$request_uri;
	}

	server {
		listen 443 ssl http2;
		listen [::]:443 ssl http2;
		server_name node100.bitcoin.wiz.biz;
		ssl_certificate /usr/local/etc/letsencrypt/live/node100.bitcoin.wiz.biz/fullchain.pem;
		ssl_certificate_key /usr/local/etc/letsencrypt/live/node100.bitcoin.wiz.biz/privkey.pem;
		include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
		ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;

		include /usr/local/etc/nginx/nginx-mempool.conf;
	}

	server {
		listen 443 ssl http2;
		listen [::]:443 ssl http2;
		server_name mempool.ninja;
		ssl_certificate /usr/local/etc/letsencrypt/live/mempool.ninja/fullchain.pem;
		ssl_certificate_key /usr/local/etc/letsencrypt/live/mempool.ninja/privkey.pem;
		include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
		ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;

		include /usr/local/etc/nginx/nginx-mempool.conf;
	}

	server {
		listen 127.0.0.1:80;
		listen 443 ssl default http2 backlog=1024;
		listen [::]:443 ssl default http2 backlog=1024;
		server_name mempool.space;
		ssl_certificate /usr/local/etc/letsencrypt/live/mempool.space/fullchain.pem;
		ssl_certificate_key /usr/local/etc/letsencrypt/live/mempool.space/privkey.pem;
		include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
		ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;

		include /usr/local/etc/nginx/nginx-mempool.conf;
	}
}