nginx.conf

# /etc/nginx/nginx.conf
# su nginx -s /usr/sbin/nginx -- -g 'daemon off;'
# su nginx -s /usr/sbin/nginx

load_module /usr/lib/nginx/modules/ngx_http_js_module.so;
# load_module /usr/lib/nginx/modules/ngx_stream_js_module.so;

# the "user" directive makes sense only if the master process runs with super-user privileges
# user nginx;

worker_processes 1;
# daemon off;
error_log stderr crit;
pid /tmp/nginx.pid;

events {
    worker_connections 1024;
}

http {
    access_log off;
    js_path /etc/nginx/njs/;
    js_import router.js;
    # ssl_certificate /etc/letsencrypt/live/addr.my.id/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/addr.my.id/privkey.pem;
    default_type application/octet-stream;

    proxy_intercept_errors on;
    root /etc/nginx/www/;
    error_page 502 =503 /502.html;

    map $host $domain {
        "~*^www\.(.+)" $1;
        default $host;
    }
    map $http_x_forwarded_proto $request_scheme {
        "~*^(.+)$" $1;
        default $scheme;
    }
    map $http_connection $request_http_connection {
        ~*upgrade "Upgrade";
        ~*close "close";
        default "";
    }
    map $upstream_http_cache_control $response_cache_control {
        "" "public, max-age=120";
        default $upstream_http_cache_control;
    }
    # enable microcache only on reasonable extensions. avoid .zip, .tar.gz, etc.
    map $uri $zone {
        "~*\/(?:[^\/\.]+)?$" microcache;
        "~*\.(?:php|html|json|xml|[^\.]{5,})$" microcache;
        default off;
    }

    keepalive_timeout 30s;
    keepalive_requests 512;
    proxy_connect_timeout 5s;
    proxy_read_timeout 120s;

    # required by proxy_limit_rate, proxy_cache, etc.
    proxy_buffering on;

    # limit download speed
    proxy_limit_rate 1m;

    # disable request body buffering
    client_max_body_size 0;
    proxy_request_buffering off;

    # microcaching
    proxy_cache_path /tmp/nginx levels=1:2 keys_zone=microcache:200m inactive=120s;
    proxy_cache_key $request_method$scheme$http_host$request_uri;

    # enforces caching when no Cache-Control is set by upstream
    proxy_cache_valid 200 301 302 404 120s;

    proxy_hide_header Cache-Control;
    add_header Cache-Control $response_cache_control;
    add_header X-Cache-Status $upstream_cache_status always;

    # typical proxy headers
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $request_scheme;
    proxy_set_header Upgrade-Insecure-Requests "";

    # support WebSocket
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $request_http_connection;

    # mitigate httpoxy vulnerability https://httpoxy.org/
    proxy_set_header Proxy "";

    proxy_redirect off;
    proxy_pass_header Server;
    server_tokens off;

    server {
        listen 80 backlog=100 reuseport;
        # listen 443 ssl backlog=100 reuseport;
        js_set $target_port router.getTargetPort;

        location = /502.html {
            internal;
            return 503 "<p>No application is running on this port ($target_port)?</p>";
        }
        location ~ /\.(?!well-known).* {
            deny all;
            log_not_found off;
        }
        location / {
            sendfile   on;
            tcp_nopush on;
            try_files /$domain/index.html @proxy;
        }
        location @proxy {
            proxy_pass http://127.0.0.1:$target_port;
            proxy_cache $zone;
        }
    }
}