default.conf

# you must set worker processes based on your CPU cores, nginx does not benefit from setting more than that
worker_processes 1;

# number of file descriptors used for nginx
# the limit for the maximum FDs on the server is usually set by the OS.
# if you don't set FD's then OS settings will be used which is by default 2000
worker_rlimit_nofile 4096;

# only log critical errors
error_log /var/log/nginx/error.log crit;

events {
    multi_accept on;

    # determines how much clients will be served per worker
    # max clients = worker_connections * worker_processes
    # max clients is also limited by the number of socket connections available on the system (~64k)
    worker_connections 10000;
}

http {
    # cache informations about FDs, frequently accessed files
    # can boost performance, but you need to test those values
    open_file_cache max=200000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;

    client_body_buffer_size 64K;
    client_header_buffer_size 10k;
    client_max_body_size 8m;
    large_client_header_buffers 4 8k;

    # copies data between one FD and other from within the kernel
    # faster than read() + write()
    sendfile on;

    # send headers in one piece, it is better than sending them one by one
    tcp_nopush on;

    # don't buffer data sent, good for small data bursts in real time
    tcp_nodelay on;

    # allow the server to close connection on non responding client, this will free up memory
    reset_timedout_connection on;

    # request timed out -- default 60
    client_body_timeout 600;
    client_header_timeout 600;

    # if client stop responding, free up memory -- default 60
    send_timeout 600;

    # server will close connection after this time -- default 75
    keepalive_timeout 600;

    upstream api {
        least_conn;

        server api1:3000;
        server api2:3000;

        keepalive 64;
        keepalive_requests 2000;
    }

    server {
        listen 9999 http2 backlog=3000;

        # to boost I/O on HDD we can disable access logs
        access_log off;

        #Removing Old and Insecure Cipher Suites if available and add the following.
        ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;

        location / {
            # HTTP 1.1 support
            proxy_http_version 1.1;
            proxy_buffering off;
            proxy_set_header Host $http_host;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            # Mitigate httpoxy attack (see README for details)
            proxy_set_header Proxy "";

            proxy_pass http://api;
        }
    }
}