Может быть подскажите в чем может быть проблема, уже много чего перепробовал и ничего не помогает, возможно у меня с конфигурацией nginx проблема.
Иногда вываливаются ошибки вида
recv() failed (104: Connection reset by peer) while reading response header from upstream, client:....
И
connect() failed (110: Connection timed out) while connecting to upstream, client:...
Так же за день висит 3 ошибки
2048 worker_connections are not enough while connecting to upstream, client:...
Увеличив worker_connections не избавляет от первых двух ошибок, я думаю что в моем конфиге что то нагорожено мной.
nginx.confuser nginx;
worker_processes auto;
worker_rlimit_nofile 10000;
pid /var/run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
error_log /var/log/nginx/error.log crit;
events {
multi_accept on;
worker_connections 4096;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
#access_log /var/log/nginx/access.log main;
access_log off;
server_tokens off;
client_body_buffer_size 20K;
client_header_buffer_size 4k;
client_max_body_size 30M;
client_body_timeout 10s;
client_header_timeout 5s;
types_hash_max_size 2048;
large_client_header_buffers 2 12k;
proxy_buffering off;
proxy_buffer_size 16k;
proxy_busy_buffers_size 24k;
proxy_buffers 64 4k;
proxy_read_timeout 300s;
proxy_connect_timeout 300s;
proxy_send_timeout 300s;
keepalive_timeout 30;
keepalive_requests 1000;
reset_timedout_connection on;
send_timeout 10;
sendfile on;
tcp_nodelay on;
tcp_nopush on;
open_file_cache max=200000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
gzip on;
gzip_min_length 10240;
gzip_proxied expired no-cache no-store private auth;
gzip_comp_level 5;
gzip_disable "msie6";
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
#ssl_protocols TLSv1.2;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on; # у меня стояло off
ssl_stapling on;
ssl_stapling_verify on;
# Каким сайтам разрешаем открыть в iframe
map $http_referer $frame_options {
default "DENY";
"~site.ru" "ALLOW";
"~vk.com" "ALLOW";
#"~yourdomain.com" "ALLOW";
"~webvisor.com" "ALLOW";
"~metri[ck]a\.yandex\.(com|ru|by|com\.tr)" "ALLOW";
}
# Ищем совпадение в user_agent ботов для последующего из блокирования
map $http_user_agent $limit_bots {
default 0;
~*(Barkrowler|FriendlyCrawler|DotBot|BLEXBot|AhrefsBot|MegaIndex|SemrushBot|LinkPad|Amazonbot|Amazon|Bytespider) 1;
}
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
add_header X-Frame-Options $frame_options;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block;";
add_header Content-Security-Policy "default-src 'none'; connect-src 'self' *.site.ru site.ru *.google-analytics.com *.gstatic.com yastatic.net *.adfox.ru *.yandex.ru yandex.ru yandex.com *.yandex.net; font-src 'self' data: *.site.ru site.ru fonts.googleapis.com *.gstatic.com yastatic.net; form-action 'self' *.site.ru site.ru; frame-src 'self' *.site.ru site.ru yandexadexchange.net *.yandexadexchange.net yastatic.net *.yandex.ru *.adfox.ru yoomoney.ru; img-src 'self' data: blob: *.site.ru site.ru *.vk.com vk.com *.userapi.com *.google-analytics.com *.gstatic.com *.yandex.net *.adfox.ru *.yandex.ru yandex.ru yandex.com; media-src 'self' data: yastatic.net *.yandex.net *.yandex.ru *.adfox.ru yandex.ru yandex.com; object-src 'self' *.site.ru site.ru; script-src 'unsafe-inline' 'unsafe-eval' *.site.ru site.ru *.google-analytics.com *.gstatic.com *.googletagmanager.com yastatic.net *.yandex.ru *.adfox.ru yandex.ru yandex.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' *.site.ru site.ru fonts.googleapis.com yastatic.net *.adfox.ru;";
resolver 8.8.8.8;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
/conf.d/cache.conf
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=static_cache:16M inactive=60d max_size=1000M;
proxy_cache_min_uses 1;
/conf.d/limit.conf
limit_req_zone $binary_remote_addr zone=one:10m rate=200r/s;
/site-available/site.confupstream site.ru {
server IP:9000;
}
server {
server_name site.ru;
listen 443 ssl;
http2 on;
error_log /var/log/nginx/site.log warn;
#ssl on;
include ssl/site.conf;
include acme.conf;
#include conf.d/csp.conf
set $root /var/www/site/.next;
set $build $root/.next;
location @proxy {
limit_req zone=one burst=200 nodelay;
limit_req_log_level warn;
limit_req_status 429;
proxy_pass http://127.0.0.1:9000;
proxy_set_header Host $host;
proxy_http_version 1.1;
proxy_read_timeout 300s;
proxy_connect_timeout 300s;
proxy_send_timeout 300s;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect http://127.0.0.1:9000/ https://site.ru/;
}
location / {
root $root;
if ($limit_bots = 1) {
return 403;
}
try_files $uri $uri/index.html @proxy;
}
location /_next/static {
alias $root/static;
expires 1y;
try_files $uri $uri/ =404;
}
}
###### Redirects Domains #######
server {
server_name site.ru www.site.ru;
listen 80;
listen [::]:80;
include acme.conf;
return 301 https://site.ru$request_uri;
}
server {
server_name www.site.ru;
listen 443 ssl;
http2 on;
#ssl on;
include ssl/site.conf;
include acme.conf;
return 301 https://site.ru$request_uri;
}
server {
server_name m.site.ru;
listen 443 ssl;
http2 on;
#ssl on;
include ssl/site.conf;
include acme.conf;
return 301 https://site.ru$request_uri;
}
server {
server_name m.site.ru;
listen 80;
listen [::]:80;
include acme.conf;
return 301 https://site.ru$request_uri;
}
server {
server_name IP;
listen 80;
listen [::]:80;
include acme.conf;
return 301 https://site.ru$request_uri;
}
