diff --git a/app/bot.php b/app/bot.php
index 4526db4..d746c1d 100644
--- a/app/bot.php
+++ b/app/bot.php
@@ -122,6 +122,9 @@ class Bot
             case preg_match('~^/checkdns$~', $this->input['callback'], $m):
                 $this->checkdns();
                 break;
+            case preg_match('~^/resetnginx$~', $this->input['callback'], $m):
+                $this->resetnginx();
+                break;
             case preg_match('~^/adguardpsswd$~', $this->input['callback'], $m):
                 $this->adguardpsswd();
                 break;
@@ -719,6 +722,27 @@ class Bot
         ];
     }
 
+    public function resetnginx()
+    {
+        $nginx   = file_get_contents('/config/nginx.conf');
+        $default = file_get_contents('/config/nginx_default.conf');
+        file_put_contents('/config/nginx.conf', $default);
+        $u = $this->ssh("nginx -t 2>&1", 'ng');
+        $out[] = $u;
+        $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
+        if (preg_match('~test is successful~', $u)) {
+            $out[] = $this->ssh("nginx -s reload 2>&1", 'ng');
+            $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
+            $conf = $this->getPacConf();
+            unset($conf['domain']);
+            $this->setPacConf($conf);
+        } else {
+            file_put_contents('/config/nginx.conf', $nginx);
+        }
+        sleep(5);
+        $this->menu('config');
+    }
+
     public function adguardpsswd()
     {
         $r = $this->send(
@@ -1687,6 +1711,12 @@ DNS-over-HTTPS with IP:
                 ];
             }
         }
+        $data[] = [
+            [
+                'text'          => 'reset nginx',
+                'callback_data' => "/resetnginx",
+            ],
+        ];
         $data[] = [
             [
                 'text'          => 'import',
diff --git a/config/nginx_default.conf b/config/nginx_default.conf
new file mode 100644
index 0000000..48de78a
--- /dev/null
+++ b/config/nginx_default.conf
@@ -0,0 +1,182 @@
+user  nginx;
+worker_processes  auto;
+
+load_module modules/ngx_stream_js_module.so;
+
+error_log  /logs/nginx_error;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+  include       /etc/nginx/mime.types;
+  default_type  application/octet-stream;
+
+  # Proxy Cache storage - so we can cache the DoH response from the upstream
+  proxy_cache_path /var/cache/nginx/doh_cache levels=1:2 keys_zone=doh_cache:10m;
+
+  server {
+    listen 80 default_server;
+    listen 443 ssl http2 default_server;
+    ssl_certificate /certs/self_public;
+    ssl_certificate_key /certs/self_private;
+
+    access_log /logs/nginx_default_access;
+
+    location / {
+      return 444;
+    }
+    location /adguard/ {
+      access_log /logs/nginx_adguard_access;
+      proxy_pass http://ad:80/;
+      proxy_redirect / /adguard/;
+      proxy_cookie_path / /adguard/;
+    }
+    location /pac {
+      access_log /logs/nginx_pac_access;
+      proxy_pass http://unit;
+    }
+    location /tlgrm {
+      access_log /logs/nginx_tlgrm_access;
+      proxy_pass http://unit;
+    }
+    location /v2ray {
+      access_log /logs/nginx_v2ray_access;
+      proxy_redirect off;
+      proxy_buffering off;
+      proxy_http_version 1.1;
+      proxy_pass http://ss:8388/;
+      proxy_set_header Host $http_host;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+    }
+    location ~\.well-known {
+      access_log /logs/nginx_certbot_access;
+      root /certs/;
+      try_files $uri =404;
+    }
+  }
+
+#~
+
+#~domain
+  # server {
+  #   listen 80;
+  #   server_name ;
+#~domain
+#~ssl
+    # listen 443 ssl http2;
+    # ssl_certificate /certs/cert_public;
+    # ssl_certificate_key /certs/cert_private;
+#~ssl
+
+#~domain
+  #   access_log /logs/nginx_domain_access;
+
+  #   location / {
+  #     return 444;
+  #   }
+  #   location /adguard/ {
+  #     access_log /logs/nginx_adguard_access;
+  #     proxy_pass http://ad:80/;
+  #     proxy_redirect / /adguard/;
+  #     proxy_cookie_path / /adguard/;
+  #   }
+  #   location /pac {
+  #     access_log /logs/nginx_pac_access;
+  #     proxy_pass http://unit;
+  #   }
+  #   location ~\.well-known {
+  #     access_log /logs/nginx_certbot_access;
+  #     root /certs/;
+  #     try_files $uri =404;
+  #   }
+  #   location /v2ray {
+  #     access_log /logs/nginx_v2ray_access;
+  #     proxy_redirect off;
+  #     proxy_buffering off;
+  #     proxy_http_version 1.1;
+  #     proxy_pass http://ss:8388/;
+  #     proxy_set_header Host $http_host;
+  #     proxy_set_header Upgrade $http_upgrade;
+  #     proxy_set_header Connection "upgrade";
+  #   }
+
+  #   # The DoH server block
+  #   location /dns-query {
+  #     access_log /logs/nginx_doh_access;
+  #     # Proxy HTTP/1.1, clear the connection header to enable Keep-Alive
+  #     proxy_http_version 1.1;
+  #     proxy_set_header Connection "";
+
+  #     # Enable Cache, and set the cache_key to include the request_body
+  #     proxy_cache doh_cache;
+  #     proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;
+
+  #     # proxy pass to the dohloop upstream
+  #     proxy_pass http://dohloop;
+  #   }
+  # }
+#~domain
+
+  # This upstream connects to a local Stream service which converts HTTP -> DNS
+  upstream dohloop {
+    zone dohloop 64k;
+    server 127.0.0.1:8053;
+    keepalive_timeout 60s;
+    keepalive_requests 100;
+    keepalive 10;
+  }
+
+}
+
+# DNS Stream Services
+stream {
+  # DNS logging
+  log_format  dns   '$remote_addr [$time_local] $protocol "$dns_qname"';
+  access_log /logs/nginx_dns_access dns;
+
+  # Import the NJS module
+  js_import /etc/nginx/njs.d/dns/dns.js;
+
+  # The $dns_qname variable can be populated by preread calls, and can be used for DNS routing
+  js_set $dns_qname dns.get_qname;
+
+  # DNS upstream pool.
+  upstream dns {
+    zone dns 64k;
+    server ad:53;
+  }
+
+  # DNS(TCP) and DNS over TLS (DoT) Server
+  # Terminate DoT and DNS TCP, and proxy onto standard DNS
+  server {
+    listen 53;
+  #~ssl
+  #   listen 853 ssl;
+  #   ssl_certificate /certs/cert_public;
+  #   ssl_certificate_key /certs/cert_private;
+  #~ssl
+    js_preread dns.preread_dns_request;
+    proxy_pass dns;
+  }
+
+  # DNS(UDP) Server
+  # DNS UDP proxy onto DNS UDP
+  server {
+    listen 53 udp;
+    proxy_responses 1;
+    js_preread dns.preread_dns_request;
+    proxy_pass dns;
+  }
+
+  # DNS over HTTPS (gateway) Service
+  # Upstream can be either DNS(TCP) or DoT. If upstream is DNS, proxy_ssl should be off.
+  server {
+    listen 8053;
+    js_filter dns.filter_doh_request;
+    proxy_pass dns;
+  }
+}
diff --git a/docker-compose.yml b/docker-compose.yml
index 38e0c96..e9d246a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -48,6 +48,7 @@ services:
             - ./config/unit.json:/config/unit.json
             - ./config/AdGuardHome.yaml:/config/AdGuardHome.yaml
             - ./config/nginx.conf:/config/nginx.conf
+            - ./config/nginx_default.conf:/config/nginx_default.conf
             - ./config/ssserver.json:/config/ssserver.json
             - ./config/sslocal.json:/config/sslocal.json
             - ./certs/:/certs/