user nginx;
worker_processes auto;

error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
    use                epoll;
    multi_accept       on;
}

http {
    log_format main '[$time_local] $proxy_protocol_addr "$http_referer" "$http_user_agent"';
    access_log /var/log/nginx/access.log main;

    server_tokens   off;

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ""      close;
    }

    map $proxy_protocol_addr $proxy_forwarded_elem {
        ~^[0-9.]+$        "for=$proxy_protocol_addr";
        ~^[0-9A-Fa-f:.]+$ "for=\"[$proxy_protocol_addr]\"";
        default           "for=unknown";
    }

    map $http_forwarded $proxy_add_forwarded {
        "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
        default "$proxy_forwarded_elem";
    }

    server {
        listen 80;
        listen [::]:80;
        return 301 https://$host$request_uri;
    }

    server {
        listen                  127.0.0.1:8001 ssl default_server;

        ssl_reject_handshake    on;

        ssl_protocols           TLSv1.3;

        ssl_session_timeout     1h;
        ssl_session_cache       shared:SSL:10m;
    }

    server {
        listen                     127.0.0.1:8001 ssl proxy_protocol;
        http2                      on; 

        set_real_ip_from           127.0.0.1;
        real_ip_header             proxy_protocol;

        server_name                subdomain.domain.com; # Твой домен

        ssl_certificate            /root/cert/subdomain.domain.com/fullchain.pem; # Сертификат
        ssl_certificate_key        /root/cert/subdomain.domain.com/privkey.pem; # Приватный ключ

        ssl_protocols              TLSv1.3;
        ssl_ciphers                TLS13_AES_128_GCM_SHA256:TLS13_AES_256_GCM_SHA384:TLS13_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
        ssl_prefer_server_ciphers  on;

        ssl_stapling               on;
        ssl_stapling_verify        on;
        resolver                   1.1.1.1 valid=60s;
        resolver_timeout           2s;

        location / {
            sub_filter                            $proxy_host $host;
            sub_filter_once                       off;

	    #deny                                  all; # Если хочешь иметь 403 Forbidden при заходе на сайт, откоменчиваешь эту строку и закоменчиваешь две снизу
	    set $website                          www.lovelive-anime.jp; # Сюда можно добавить любую ссылку, контент с этого сайта будет отображаться при заходе на твой сайт
	    proxy_pass                            https://$website;
            resolver                              1.1.1.1;

            proxy_set_header Host                 $proxy_host;

            proxy_http_version                    1.1;
            proxy_cache_bypass                    $http_upgrade;

            proxy_ssl_server_name                 on;

            proxy_set_header Upgrade              $http_upgrade;
            proxy_set_header Connection           $connection_upgrade;
            proxy_set_header X-Real-IP            $proxy_protocol_addr;
            proxy_set_header Forwarded            $proxy_add_forwarded;
            proxy_set_header X-Forwarded-For      $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto    $scheme;
            proxy_set_header X-Forwarded-Host     $host;
            proxy_set_header X-Forwarded-Port     $server_port;

            proxy_connect_timeout                 60s;
            proxy_send_timeout                    60s;
            proxy_read_timeout                    60s;
        }
    }
}

server {

        root /var/www/html;
        index index.html index.htm index.nginx-debian.html;

        server_name mydomain.com www.mydomain.com;

        location / {
                auth_basic "Video Area";
                auth_basic_user_file /etc/htpasswd;
        }


    #listen 443 ssl; # managed by Certbot
    listen 127.0.0.1:1234 ssl http2;
    listen [::1]:1234 ssl http2;
    ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

        server_name mydomain.com;
    listen 80;
    return 404; # managed by Certbot

}

user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;
load_module
events {
    worker_connections 768;
    # multi_accept on;
}

stream {
    map $ssl_preread_server_name $name {
        blog.example.com backend_blog;
        dev.example.com backend_dev;
        default backend_discard;
    }
    #just www
    upstream backend_blog {
        server 127.0.0.1:8001;
    }
    #xray reality vless
    upstream backend_dev {
        server 127.0.0.1:8003;
    }
    #reject wrong sni
    upstream backend_discard {
        server 127.0.0.1:8011;
    }

    server {
        listen 443;
        proxy_pass $name;
        ssl_preread on;

        proxy_protocol on;
    }
}


http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    log_format main '[$time_local] $proxy_protocol_addr "$http_referer" "$http_user_agent"';
    access_log /var/log/nginx/access.log main;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        "" close;
    }

    map $proxy_protocol_addr $proxy_forwarded_elem {
        ~^[0-9.]+$ "for=$proxy_protocol_addr";
        ~^[0-9A-Fa-f:.]+$ "for=\"[$proxy_protocol_addr]\"";
        default "for=unknown";
    }

    map $http_forwarded $proxy_add_forwarded {
        "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
        default "$proxy_forwarded_elem";
    }
    #redirect on ssl
    server {
        if ($host = blog.example.com) {
            return 301 https://$host$request_uri;
        }
        if ($host = dev.example.com) {
            return 301 https://$host$request_uri;
        }

        listen 80 default_server;
        return 404;
    }
    #reject wrong sni
    server {
        listen 127.0.0.1:8011 ssl proxy_protocol;

        ssl_reject_handshake on;

        ssl_protocols TLSv1.2 TLSv1.3;
    }


    include /etc/letsencrypt/options-ssl-nginx.conf;
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

server {
    listen 127.0.0.1:8004 ssl proxy_protocol;

    ssl_certificate /etc/letsencrypt/live/dev.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dev.example.com/privkey.pem;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE>

    root /var/www/html/dev.example.com;
    index index.html;

    client_header_timeout 5m;
    keepalive_timeout 5m;

    location / {
        try_files $uri $uri/ =404;
    }
}

{
    "log": {
        "loglevel": "warning",
        "access": "/var/log/xray/access.log",
        "error": "/var/log/xray/error.log"
    },
    "dns": {
        "servers": [
            "https+local://1.1.1.1/dns-query",
            "localhost"
        ]
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "ip": [
                    "geoip:private"
                ],
                "outboundTag": "discard"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:category-ads-all"
                ],
                "outboundTag": "discard"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "127.0.0.1",
            "port": 8003,
            "protocol": "vless",
            "tag": "in-vless-1",
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ]
            },
            "settings": {
                "clients": [
                    {
                        "id": "1be50faf-751e-4e7e-ba15-5c3afbcaa2de",
                        "level": 0,
                        "email": "love@localhost.local"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "raw",
                "security": "reality",
                "realitySettings": {
                    "target": "127.0.0.1:8004",
                    "xver": 1,
                    "serverNames": [
                        "dev.example.com"
                    ],
                    "privateKey": "тут есть серт",
                    "shortIds": [
                        "тут они есть и корректно используются"
                    ]
                }
            },
            "tcpSettings": {
                "acceptProxyProtocol": true
            }
        }
    ],
    "outbounds": [
        {
            "tag": "russia",
            "protocol": "freedom"
        },
        {
            "tag": "discard",
            "protocol": "blackhole"
        }
    ]
}

user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;
load_module
events {
    worker_connections 768;
    # multi_accept on;
}

stream {
    map $ssl_preread_server_name $name {
        blog.example.com backend_blog;
        dev.example.com backend_dev;
        default backend_discard;
    }
    #just www
    upstream backend_blog {
        server 127.0.0.1:8001;
    }
    #xray reality vless
    upstream backend_dev {
        server 127.0.0.1:8003;

    }
    }
    #reject wrong sni
    upstream backend_discard {
        server 127.0.0.1:8011;
    }

    server {
        listen 443;
        listen [::]:443;
        proxy_pass $name;
        ssl_preread on;
        proxy_protocol on;
    }
}


http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    log_format main '[$time_local] $proxy_protocol_addr "$http_referer" "$http_user_agent"';
    access_log /var/log/nginx/access.log main;

    #redirect on ssl
    server {
        if ($host = blog.example.com) {
            return 301 https://$host$request_uri;
        }
        if ($host = dev.example.com) {
            return 301 https://$host$request_uri;
        }
        if ($host = ipam.example.com) {
            return 301 https://$host$request_uri;
        }

        listen 80 default_server;
        listen [::]:80 default_server;
        return 404;
    }
    #reject wrong sni
    server {
        listen 127.0.0.1:8011 ssl proxy_protocol;

        ssl_reject_handshake on;

        ssl_protocols TLSv1.2 TLSv1.3;
    }


    include /etc/letsencrypt/options-ssl-nginx.conf;
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

server {
    listen 127.0.0.1:8004 proxy_protocol;
    listen 127.0.0.1:8005 http2 proxy_protocol;
    server_name dev.example.com;

    access_log /var/log/nginx/dev.example.com.access.log;
    error_log /var/log/nginx/dev.example.com.error.log;

    root /var/www/html/dev.example.com;
    index index.html;

    client_header_timeout 5m;
    keepalive_timeout 5m;

    location / {
        try_files $uri $uri/ =404;
    }
    location /random_string/ {
        try_files $uri /random_string/$uri
        add_header Cache-Control 'must-revalidate';
        add_header Content-Type text/plain;
    }
}

{
    "log": {
        "loglevel": "warning",
        "access": "/var/log/xray/access.log",
        "error": "/var/log/xray/error.log"
    },
    "dns": {
        "servers": [
            "https+local://1.1.1.1/dns-query",
            "localhost"
        ]
    },
    "inbounds": [
        {
            "listen": "127.0.0.1",
            "port": 8003,
            "protocol": "vless",
            "tag": "in-vless-1",
            "sniffing": {
                "enabled": true,
                "routeOnly": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ]
            },
            "settings": {
                "clients": [
                    {
                        "id": "user",
                        "flow": "xtls-rprx-vision",
                        "level": 0
                    }
                ],
                "decryption": "none",
                "fallbacks": [
                    {
                        "dest": 8004,
                        "xver": 1
                    },
                    {
                        "alpn": "h2",
                        "dest": 8005,
                        "xver": 1
                    }
                ]
            },
            "streamSettings": {
                "network": "raw",
                "rawSettings": {
                    "acceptProxyProtocol": true
                },
                "security": "tls",
                "tlsSettings": {
                    "serverNames": "dev.example.com",
                    "rejectUnknownSni": true,
                    "allowInsecure": false,
                    "alpn": [
                        "h2",
                        "http/1.1"
                    ],
                    "minVersion": "1.2",
                    "maxVersion": "1.3",
                    "certificates": [
                        {
                            "certificateFile": "/etc/letsencrypt/live/dev.example.com/fullchain.pem",
                            "keyFile": "/etc/letsencrypt/live/dev.example.com/privkey.pem"
                        }
                    ]
                }
            }
        }
    ],
    "outbounds": [
        {
            "tag": "vless-reality-1",
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "dev2.example.com",
                        "port": 443,
                        "users": [
                            {
                                "id": "dev1",
                                "flow": "xtls-rprx-vision",
                                "encryption": "none"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "raw",
                "rawSettings": {},
                "security": "reality",
                "realitySettings": {
                    "fingerprint": "firefox",
                    "publicKey": "key",
                    "serverName": "dev2.example.com",
                    "shortId": "id"
                }
            }
        },
        {
            "tag": "russia",
            "protocol": "freedom"
        },
        {
            "tag": "discard",
            "protocol": "blackhole"
        }
    ],
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "ip": [
                    "geoip:private"
                ],
                "outboundTag": "discard"
            },
            {
                "domain": [
                    "geosite:category-ads-all"
                ],
                "outboundTag": "discard"
            },
            {
                "protocol": [
                    "bittorrent"
                ],
                "outboundTag": "discard"
            },
            {
                "ip": [
                    "geoip:ru"
                ],
                "outboundTag": "russia"
            },
            {
                "domain": [
                    ".ru",
                    "geosite:apple",
                    "youtube.com",
                    "youtu.be",
                    "yt.be",
                    "googlevideo.com",
                    "ytimg.com",
                    "ggpht.com",
                    "gvt1.com",
                    "youtube-nocookie.com",
                    "youtube-ui.l.google.com",
                    "youtubeembeddedplayer.googleapis.com",
                    "youtube.googleapis.com",
                    "youtubei.googleapis.com",
                    "yt-video-upload.l.google.com",
                    "wide-youtube.l.google.com"
                ],
                "outboundTag": "russia"
            }

        ]
    }
}