.gitignore

@@ -0,0 +1,6 @@
+# Ignore everything
+*
+
+# But not NGINX
+!nginx
+!nginx/**/*

README.md

@@ -1,11 +0,0 @@
-You can find my server configs in this repo, they are split in different branches.
-
-- [🕋 Selfhost Branch](https://git.zzls.xyz/Fijxu/etc-configs/src/branch/selfhost)
-
-- [🧱 VPS Branch](https://git.zzls.xyz/Fijxu/etc-configs/src/branch/vpsus)
-
-#### Suggestions or Issues?
-
-If you got any suggestions to the nginx configs or something that is not to your liking within the privacy-focused services I provide; Open an issue or a pull request in any config. You can either create an account with your real E-mail or with a throw away one (But probably you will be considered as a bad actor for me if you don't provide any real identity like GitHub, GitLab, Codeberg or anything like that, so make sure to link any of those).
-
-*Contact*: [https://nadeko.net/contact](https://nadeko.net/contact)

nginx/conf.d/ayaya.beauty.conf

@@ -0,0 +1,42 @@
+server {
+  access_log /var/log/nginx/ayaya.beauty.log combined;
+  server_name ~.ayaya.beauty ayaya.beauty;
+  include configs/general.conf;
+  include configs/security.conf;
+
+  location / {
+    proxy_pass http://file-uploader;
+    include configs/proxy.conf;
+    proxy_pass_request_headers      on;
+  }
+
+  client_max_body_size 1024M;
+  # QUIC
+  include configs/http3.conf;
+
+  listen 443 ssl;
+  http2 on;
+
+}
+
+server {
+  access_log /var/log/nginx/ayaya.beauty.log combined;
+  server_name ~.lamartina.gay lamartina.gay;
+  include configs/general.conf;
+  include configs/security.conf;
+
+  location / {
+    proxy_pass http://file-uploader;
+    include configs/proxy.conf;
+    proxy_pass_request_headers      on;
+  }
+
+  client_max_body_size 1024M;
+  # QUIC
+  include configs/http3.conf;
+
+  listen 443 ssl;
+  http2 on;
+  ssl_certificate /etc/letsencrypt/live/lamartina.gay/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/lamartina.gay/privkey.pem;
+}

nginx/conf.d/files.zzls.xyz.conf

@@ -0,0 +1,38 @@
+server {
+  access_log /var/log/nginx/files.zzls.xyz.log combined;
+  server_name files.nadeko.net;
+  include configs/general.conf;
+  include configs/security.conf;
+
+  location / {
+    if ($http_user_agent ~* (google) ) {
+      return 404;
+    }
+
+    root /mnt/blockstorage/files.zzls.xyz;
+    index index.html index.php /_h5ai/public/index.php;
+
+    location ~ [^/]\.php(/|$) {
+      if (!-f $document_root$fastcgi_script_name) {
+        return 404;
+      }
+      fastcgi_pass php-fpm;
+      fastcgi_index index.php;
+      include fastcgi.conf;
+      fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+      fastcgi_param HTTP_PROXY "";
+      fastcgi_param PATH_INFO $fastcgi_path_info;
+    }
+
+    location /_h5ai/private {
+      return 403;
+    }
+
+  }
+
+  # QUIC
+  include configs/http3.conf;
+
+  listen 443 ssl;
+  http2 on;
+}

nginx/conf.d/inv.zzls.xyz.fallback.conf

@@ -0,0 +1,9 @@
+server {
+	listen 80;
+	root /var/www/website/invidious;
+	server_name inv.zzls.xyz;
+	include configs/general.conf;
+	include configs/robotsNone.conf;
+
+	listen 443 ssl;
+}

nginx/conf.d/live.nadeko.net.conf

@@ -0,0 +1,21 @@
+server {
+  access_log /var/log/nginx/live.access.log;
+  error_log /var/log/nginx/live.error.log;
+  server_name live.nadeko.net;
+  include configs/general.conf;
+  include configs/security.conf;
+  include configs/robotsNone.conf;
+
+  location / {
+    proxy_pass http://127.0.0.1:8889;
+    include configs/proxy.conf;
+  }
+
+  # QUIC
+  include configs/http3.conf;
+
+  listen 443 ssl;
+  http2 on;
+
+}
+

nginx/conf.d/lol.zzls.xyz.conf

@@ -0,0 +1,22 @@
+server {
+  access_log /var/log/nginx/lol.zzls.xyz.access.log;
+  server_name lol.nadeko.net;
+  include configs/general.conf;
+  include configs/robotsNone.conf;
+
+  add_header X-Content-Type-Options    "nosniff" always;
+  add_header Referrer-Policy           "same-origin" always;
+  add_header Permissions-Policy        "interest-cohort=()" always;
+  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+
+  location / {
+	  proxy_pass http://127.0.0.1:40010;
+	  include configs/proxy.conf;
+  }
+
+  # QUIC
+  include configs/http3.conf;
+
+  listen 443 ssl;
+  http2 on;
+}

nginx/conf.d/mail.zzls.xyz.conf

@@ -0,0 +1,42 @@
+# mail.nadeko.net
+server {
+  access_log /var/log/nginx/mail.nadeko.net.log combined;
+  error_log /var/log/nginx/mail.nadeko.net.error;
+  server_name mail.nadeko.net;
+  include configs/general.conf;
+  include configs/robotsNone.conf;
+  include configs/security.conf;
+
+  location / {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_pass https://email;
+  }
+
+  location /favicon.ico {
+    alias /var/www/mail/favicon.png;
+  }
+
+  # QUIC
+  include configs/http3.conf;
+
+  listen 443 ssl;
+  http2 on;
+}
+
+# mta-sts.nadeko.net
+server {
+  access_log /var/log/nginx/mta-sts.nadeko.net.log combined;
+  error_log /var/log/nginx/mta-sts.nadeko.net.error;
+  server_name mta-sts.nadeko.net;
+  include configs/general.conf;
+  include configs/robotsNone.conf;
+  include configs/security.conf;
+
+  location ^~ /.well-known/mta-sts.txt {
+    return 200 "version: STSv1\nmode: enforce\nmax_age: 1296000\nmx: mail.nadeko.net\r\n";
+  }
+
+  listen 443 ssl;
+  http2 on;
+}

nginx/conf.d/redirector.conf

@@ -0,0 +1,14 @@
+# https://stackoverflow.com/a/39563133
+server {
+    server_name ~^(?<name>\w+)\.zzls\.xyz$;
+    rewrite ^ https://$name.nadeko.net$request_uri? permanent;
+    listen 443 ssl;
+    listen 80;
+}
+
+# HTTPS Redirector
+server {
+    listen 80;
+
+    return 301 https://$host$request_uri;
+}

nginx/conf.d/twitch.zzls.xyz.conf

@@ -0,0 +1,25 @@
+server {
+	access_log /var/log/nginx/twitch.zzls.xyz.access.log;
+	error_log /var/log/nginx/twitch.zzls.xyz.error.log;
+	server_name twitch.nadeko.net;
+	include configs/general.conf;
+	include configs/security.conf;
+	include configs/robotsNone.conf;
+
+	location / {
+		add_header Content-Type text/plain;
+		return 200 "Twitch Russia Proxy for TTVLOL V1";
+	}
+
+	location ~ ^/(?!$) {
+		proxy_pass http://twitchproxy;
+		include configs/proxy.conf;
+	}
+
+	# QUIC
+	include configs/http3.conf;
+
+	listen 443 ssl;
+	http2 on;
+
+}

nginx/conf.d/znc.nadeko.net.conf

@@ -0,0 +1,18 @@
+server {
+	access_log /var/log/nginx/znc.zzls.xyz.log combined;
+	server_name znc.nadeko.net;
+	include configs/general.conf;
+	include configs/security.conf;
+
+	location / {
+		proxy_pass http://znc;
+		include configs/proxy.conf;
+	}
+
+	# QUIC
+	include configs/http3.conf;
+
+	listen 443 ssl;
+	http2 on;
+
+}

nginx/conf.d/zzls.xyz.conf

@@ -0,0 +1,82 @@
+server {
+	access_log /var/log/nginx/zzls.xyz.log;
+	root /var/www/website;
+	index index.html;
+	server_name zzls.xyz www.zzls.xyz;
+	include configs/general.conf;
+	include configs/security.conf;
+
+	location /.well-known/matrix/client {
+		return 200 '{"m.homeserver": {"base_url": "https://matrix.zzls.xyz"}, "org.matrix.msc3575.proxy": {"url": "https://matrix.zzls.xyz"}}';
+		default_type application/json;
+		add_header Access-Control-Allow-Origin *;
+	}
+
+	location /.well-known/matrix/server {
+		return 200 '{"m.server": "matrix.zzls.xyz:8448"}';
+		default_type application/json;
+		add_header Access-Control-Allow-Origin *;
+	}
+
+	location / {
+		try_files $uri $uri/ =404;
+		expires	1h;
+	}
+
+	location /transparency {
+		autoindex on;
+		autoindex_exact_size off;
+		autoindex_format html;
+		autoindex_localtime on;
+	}
+
+	# QUIC
+	include configs/http3.conf;
+
+	listen 443 ssl;
+	http2 on;
+}
+
+server {
+	access_log /var/log/nginx/nadeko.net.log;
+	root /var/www/website;
+	index index.html;
+	server_name _ www.nadeko.net nadeko.net;
+	include configs/general.conf;
+	include configs/security.conf;
+
+	location /.well-known/matrix/client {
+		return 200 '{"m.homeserver": {"base_url": "https://matrix.nadeko.net"}, "org.matrix.msc3575.proxy": {"url": "https://matrix.nadeko.net"}}';
+		default_type application/json;
+		add_header Access-Control-Allow-Origin *;
+	}
+
+	location /.well-known/matrix/server {
+		return 200 '{"m.server": "matrix.nadeko.net:8448"}';
+		default_type application/json;
+		add_header Access-Control-Allow-Origin *;
+	}
+
+	location /.well-known/matrix/support {
+		return 200 '{"contacts": [{"matrix_id": "@fijxu:nadeko.net","email_address": "fijxu@nadeko.net","role": "m.role.admin"},{"email_address": "fijxu@nadeko.net","role": "m.role.security"}],"support_page": "https://nadeko.net/contact" }';
+	}
+
+	location / {
+		try_files $uri $uri/ =404;
+		expires	1h;
+	}
+
+	location /transparency {
+		autoindex on;
+		autoindex_exact_size off;
+		autoindex_format html;
+		autoindex_localtime on;
+	}
+
+	# QUIC
+	include configs/http3.conf;
+
+	listen 443 ssl default_server;
+	http2 on;
+}
+

nginx/configs/general.conf

@@ -0,0 +1,10 @@
+# gzip
+gzip              on;
+gzip_vary         on;
+gzip_proxied      any;
+gzip_comp_level   6;
+gzip_types        text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
+
+if ($poop) {
+	return 444;
+}

nginx/configs/http3.conf

@@ -0,0 +1,4 @@
+# Disable HTTP/3 for now.
+
+#add_header Alt-Svc: h2=":443"; ma=2592000;
+#listen 443 quic;

nginx/configs/proxy.conf

@@ -0,0 +1,20 @@
+proxy_http_version                 1.1;
+proxy_cache_bypass                 $http_upgrade;
+
+# Proxy SSL
+proxy_ssl_server_name              on;
+
+# Proxy headers
+proxy_set_header Upgrade           $http_upgrade;
+proxy_set_header Connection        $connection_upgrade;
+proxy_set_header X-Real-IP         $remote_addr;
+proxy_set_header Forwarded         $proxy_add_forwarded;
+proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Host  $host;
+proxy_set_header X-Forwarded-Port  $server_port;
+#proxy_set_header Host	$host;
+# Proxy timeouts
+proxy_connect_timeout              60s;
+proxy_send_timeout                 60s;
+proxy_read_timeout                 60s;

nginx/configs/robots.conf

@@ -0,0 +1,26 @@
+location /robots.txt { return 200 "User-agent: AhrefsBot
+Disallow: /
+
+User-agent: dotbot
+Disallow: /
+
+User-agent: SiteAuditBot
+Disallow: /
+
+User-agent: SemrushBot-BA
+Disallow: /
+
+User-agent: SemrushBot-SI
+Disallow: /
+
+User-agent: SemrushBot-SWA
+Disallow: /
+
+User-agent: SemrushBot-CT
+Disallow: /
+
+User-agent: SplitSignalBot
+Disallow: /
+
+User-agent: SemrushBot-COUB
+Disallow: /"; }

nginx/configs/robotsNone.conf

@@ -0,0 +1 @@
+location /robots.txt { return 200 "User-agent: *\nDisallow: /";}

nginx/configs/security.conf

@@ -0,0 +1,6 @@
+# security headers
+add_header X-Content-Type-Options    "nosniff" always;
+add_header Referrer-Policy           "same-origin" always;
+add_header X-Frame-Options           "sameorigin" always;
+add_header Permissions-Policy        "interest-cohort=()" always;
+add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

nginx/configs/ssl.conf

@@ -0,0 +1,5 @@
+# ECDSA
+ssl_certificate /etc/ssl/nadeko.net/fullchain.ec.crt;
+ssl_certificate_key /etc/ssl/nadeko.net/nadeko.net.ec.key;
+
+include configs/sslConfig.conf;

nginx/configs/sslConfig.conf

@@ -0,0 +1,12 @@
+# SSL
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+ssl_prefer_server_ciphers off;
+ssl_session_timeout 1d;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off;
+ssl_early_data on;
+
+# Custom 4096bits Diffie-Hellman parameter for DHE ciphersuites (Not the one bundled with letsencrypt
+# Changed to a custom one for trust purposes
+ssl_dhparam /etc/nginx/dhparam.pem;

nginx/configs/upstreams.conf

@@ -0,0 +1,35 @@
+upstream php-fpm {
+	server unix:/run/php/php8.2-fpm.sock;
+}
+
+upstream justlog {
+	server 127.0.0.1:10001;
+}
+
+upstream justlogspanix {
+	server 127.0.0.1:10002;
+}
+
+upstream email {
+	server 127.0.0.1:30443;
+}
+
+upstream status {
+	server 127.0.0.1:8080;
+}
+
+upstream twitchproxy {
+	server 127.0.0.1:10003;
+}
+
+upstream vigil {
+	server 127.0.0.1:10004;
+}
+
+upstream znc {
+	server 127.0.0.1:10010;
+}
+
+upstream file-uploader {
+server unix:/tmp/file-uploader.sock;
+}

nginx/dhparam.pem

@@ -0,0 +1,13 @@
+-----BEGIN DH PARAMETERS-----
+MIICDAKCAgEAiK/Y67KsiSrOlySdj5iBvVc64vUPIZOBWxQ05ggVhuTWJeZKGjes
+/R6VA43Zh9Yo1U2cQl5semyPNzseEk5cwiK1ZOXz9WJiCmrdOFkB9uIpcL0Gz/r6
+56m4F9ki1/ikJZzKRiBxvt6rQS9K4FMjkMliOFqwqVCt1Bh3EYYXebUjWrkKHb4t
+kraEorQbObFodvKcBVG7dcI4EVZhL6wgznp/xZdHYG65jo1GPC7yTJHiTuvD7Ng9
+EsMssnfpdss3f6SmtWGuAkH7vWht7NJse3oePiTRVRiFuW4i4wO5Omu4CJ8kKlwi
+dmG8/o4eQbYWNqfMsCZFBx04i33SsUFQAPZXUQGGmLeNNFdncA0g3agN457ZQvuS
+buhMpiZUw2sI13UH1D7vZBZSTvc+cleRk2w24wHqcMJ8HAuHQ4WhdrC24w8uD8H8
+hJu78K4FibQ7no1syZEhHR/8AkRPAj/dGMlgJQ/dpI07cll/yMiICkytUydYPwT4
++lXbT+oN1rwA7HSttkMFt+z2Oi3RtH9VaIl3zY5bRCk28+GW2mo8+bL5JGl0qooe
+OQsYn+mbZLdtUYhYaaYktJaLyPyQ6WtrssJas+gSdW/1RmT+WRkARaIC201WS+aS
+guGOj0Lr0My+pW/Jj3wB8Hi6tpm+02KNaQUFubNWgcQZU33Ejj1rnfcCAQICAgFF
+-----END DH PARAMETERS-----

nginx/fastcgi.conf

@@ -0,0 +1,27 @@
+
+fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  REMOTE_USER        $remote_user;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;

nginx/mime.types

@@ -0,0 +1,99 @@
+
+types {
+    text/html                                        html htm shtml;
+    text/css                                         css;
+    text/xml                                         xml;
+    image/gif                                        gif;
+    image/jpeg                                       jpeg jpg;
+    application/javascript                           js;
+    application/atom+xml                             atom;
+    application/rss+xml                              rss;
+
+    text/mathml                                      mml;
+    text/plain                                       txt;
+    text/vnd.sun.j2me.app-descriptor                 jad;
+    text/vnd.wap.wml                                 wml;
+    text/x-component                                 htc;
+
+    image/avif                                       avif;
+    image/png                                        png;
+    image/svg+xml                                    svg svgz;
+    image/tiff                                       tif tiff;
+    image/vnd.wap.wbmp                               wbmp;
+    image/webp                                       webp;
+    image/x-icon                                     ico;
+    image/x-jng                                      jng;
+    image/x-ms-bmp                                   bmp;
+
+    font/woff                                        woff;
+    font/woff2                                       woff2;
+
+    application/java-archive                         jar war ear;
+    application/json                                 json;
+    application/mac-binhex40                         hqx;
+    application/msword                               doc;
+    application/pdf                                  pdf;
+    application/postscript                           ps eps ai;
+    application/rtf                                  rtf;
+    application/vnd.apple.mpegurl                    m3u8;
+    application/vnd.google-earth.kml+xml             kml;
+    application/vnd.google-earth.kmz                 kmz;
+    application/vnd.ms-excel                         xls;
+    application/vnd.ms-fontobject                    eot;
+    application/vnd.ms-powerpoint                    ppt;
+    application/vnd.oasis.opendocument.graphics      odg;
+    application/vnd.oasis.opendocument.presentation  odp;
+    application/vnd.oasis.opendocument.spreadsheet   ods;
+    application/vnd.oasis.opendocument.text          odt;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation
+                                                     pptx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                                                     xlsx;
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                                                     docx;
+    application/vnd.wap.wmlc                         wmlc;
+    application/wasm                                 wasm;
+    application/x-7z-compressed                      7z;
+    application/x-cocoa                              cco;
+    application/x-java-archive-diff                  jardiff;
+    application/x-java-jnlp-file                     jnlp;
+    application/x-makeself                           run;
+    application/x-perl                               pl pm;
+    application/x-pilot                              prc pdb;
+    application/x-rar-compressed                     rar;
+    application/x-redhat-package-manager             rpm;
+    application/x-sea                                sea;
+    application/x-shockwave-flash                    swf;
+    application/x-stuffit                            sit;
+    application/x-tcl                                tcl tk;
+    application/x-x509-ca-cert                       der pem crt;
+    application/x-xpinstall                          xpi;
+    application/xhtml+xml                            xhtml;
+    application/xspf+xml                             xspf;
+    application/zip                                  zip;
+
+    application/octet-stream                         bin exe dll;
+    application/octet-stream                         deb;
+    application/octet-stream                         dmg;
+    application/octet-stream                         iso img;
+    application/octet-stream                         msi msp msm;
+
+    audio/midi                                       mid midi kar;
+    audio/mpeg                                       mp3;
+    audio/ogg                                        ogg;
+    audio/x-m4a                                      m4a;
+    audio/x-realaudio                                ra;
+
+    video/3gpp                                       3gpp 3gp;
+    video/mp2t                                       ts;
+    video/mp4                                        mp4;
+    video/mpeg                                       mpeg mpg;
+    video/quicktime                                  mov;
+    video/webm                                       webm;
+    video/x-flv                                      flv;
+    video/x-m4v                                      m4v;
+    video/x-mng                                      mng;
+    video/x-ms-asf                                   asx asf;
+    video/x-ms-wmv                                   wmv;
+    video/x-msvideo                                  avi;
+}

nginx/nginx.conf

@@ -0,0 +1,59 @@
+user www-data;
+worker_processes auto;
+worker_rlimit_nofile 65535;
+pid /run/nginx.pid;
+
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+	worker_connections 2048;
+	multi_accept off;
+}
+
+http {
+	log_format limited '$remote_addr - $remote_user [$time_local] '
+		'"$request_method /bogus $server_protocol" $status $body_bytes_sent '
+		'"-" "Bogus/66.6"';
+	access_log off;
+	error_log /dev/null;
+
+	# Basic Settings
+	charset utf-8;
+	sendfile on;
+	tcp_nopush on;
+	tcp_nodelay on;
+	server_tokens off;
+	log_not_found off;
+	types_hash_max_size 1024;
+	types_hash_bucket_size 64;
+	server_names_hash_bucket_size 128;
+
+	# MIME
+	include mime.types;
+
+	# SSL
+	include configs/ssl.conf;
+
+	# reset timed out connections freeing ram
+	reset_timedout_connection on;
+	# maximum time between packets the client can pause when sending nginx any data
+	client_body_timeout 10s;
+	# maximum time the client has to send the entire header to nginx
+	client_header_timeout 10s;
+	# timeout which a single keep-alive client connection will stay open
+	keepalive_timeout 60s;
+	# maximum time between packets nginx is allowed to pause when sending the client data
+	send_timeout 10s;
+
+	# PERFORMANCE / ASYNC I/O
+	aio threads=default;
+	aio_write on;
+	directio 2m;
+
+	# Maps
+	include /etc/nginx/snippets/maps.conf;
+	include /etc/nginx/snippets/poop.conf;
+	
+	include /etc/nginx/configs/upstreams.conf;
+	include /etc/nginx/conf.d/*.conf;
+}

nginx/snippets/maps.conf

@@ -0,0 +1,27 @@
+# Connection header for WebSocket reverse proxy
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ""      close;
+    }
+
+    map $remote_addr $proxy_forwarded_elem {
+
+        # IPv4 addresses can be sent as-is
+        ~^[0-9.]+$        "for=$remote_addr";
+
+        # IPv6 addresses need to be bracketed and quoted
+        ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";
+
+        # Unix domain socket names cannot be represented in RFC 7239 syntax
+        default           "for=unknown";
+    }
+
+    map $http_forwarded $proxy_add_forwarded {
+
+        # If the incoming Forwarded header is syntactically valid, append to it
+        "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
+
+        # Otherwise, replace it
+        default "$proxy_forwarded_elem";
+    }

nginx/snippets/poop.conf

@@ -0,0 +1,9 @@
+map $http_user_agent $poop {
+    default			0;
+    ~*my-tiny-bot		1;
+    ~*thesis-research-bot	1;
+    ~*SemrushBot		1;
+    ~*Bytespider		1;
+    ~*PetalBot			1;
+    ~*Amazonbot			1;
+}