vpnbot/config/nginx.conf

user  nginx;
worker_processes  auto;

load_module modules/ngx_stream_js_module.so;

error_log  /logs/nginx_error;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;

  # Proxy Cache storage - so we can cache the DoH response from the upstream
  proxy_cache_path /var/cache/nginx/doh_cache levels=1:2 keys_zone=doh_cache:10m;

  server {
    listen 80 default_server;
    listen 443 ssl http2 default_server;
    ssl_certificate /certs/self_public;
    ssl_certificate_key /certs/self_private;

    access_log /logs/nginx_default_access;

    location / {
      return 444;
    }
    location /adguard/ {
      access_log /logs/nginx_adguard_access;
      proxy_pass http://ad:80/;
      proxy_redirect / /adguard/;
      proxy_cookie_path / /adguard/;
    }
    location /pac {
      access_log /logs/nginx_pac_access;
      proxy_pass http://unit;
    }
    location /tlgrm {
      access_log /logs/nginx_tlgrm_access;
      proxy_pass http://unit;
    }
    location /v2ray {
      access_log /logs/nginx_v2ray_access;
      proxy_redirect off;
      proxy_buffering off;
      proxy_http_version 1.1;
      proxy_pass http://ss:8388/;
      proxy_set_header Host $http_host;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
    }
    location ~\.well-known {
      access_log /logs/nginx_certbot_access;
      root /certs/;
      try_files $uri =404;
    }
  }

  #~

  #~domain
  # server {
  #   listen 443 ssl http2;
  #   server_name ;
  #   ssl_certificate /certs/cert_public;
  #   ssl_certificate_key /certs/cert_private;

  #   access_log /logs/nginx_domain_access;

  #   location / {
  #     return 444;
  #   }
  #   location /adguard/ {
  #     access_log /logs/nginx_adguard_access;
  #     proxy_pass http://ad:80/;
  #     proxy_redirect / /adguard/;
  #     proxy_cookie_path / /adguard/;
  #   }
  #   location /pac {
  #     access_log /logs/nginx_pac_access;
  #     proxy_pass http://unit;
  #   }
  #   location ~\.well-known {
  #     access_log /logs/nginx_certbot_access;
  #     root /certs/;
  #     try_files $uri =404;
  #   }
  #   location /v2ray {
  #     access_log /logs/nginx_v2ray_access;
  #     proxy_redirect off;
  #     proxy_buffering off;
  #     proxy_http_version 1.1;
  #     proxy_pass http://ss:8388/;
  #     proxy_set_header Host $http_host;
  #     proxy_set_header Upgrade $http_upgrade;
  #     proxy_set_header Connection "upgrade";
  #   }

  #   # The DoH server block
  #   location /dns-query {
  #     access_log /logs/nginx_doh_access;
  #     # Proxy HTTP/1.1, clear the connection header to enable Keep-Alive
  #     proxy_http_version 1.1;
  #     proxy_set_header Connection "";

  #     # Enable Cache, and set the cache_key to include the request_body
  #     proxy_cache doh_cache;
  #     proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;

  #     # proxy pass to the dohloop upstream
  #     proxy_pass http://dohloop;
  #   }
  # }
  #~domain

  # This upstream connects to a local Stream service which converts HTTP -> DNS
  upstream dohloop {
    zone dohloop 64k;
    server 127.0.0.1:8053;
    keepalive_timeout 60s;
    keepalive_requests 100;
    keepalive 10;
  }

}

# DNS Stream Services
stream {
  # DNS logging
  log_format  dns   '$remote_addr [$time_local] $protocol "$dns_qname"';
  access_log /logs/nginx_dns_access dns;

  # Import the NJS module
  js_import /etc/nginx/njs.d/dns/dns.js;

  # The $dns_qname variable can be populated by preread calls, and can be used for DNS routing
  js_set $dns_qname dns.get_qname;

  # DNS upstream pool.
  upstream dns {
    zone dns 64k;
    server ad:53;
  }

  # DNS(TCP) and DNS over TLS (DoT) Server
  # Terminate DoT and DNS TCP, and proxy onto standard DNS
  #~domain
  # server {
  #   listen 53;
  #   listen 853 ssl;
  #   ssl_certificate /certs/cert_public;
  #   ssl_certificate_key /certs/cert_private;
  #   js_preread dns.preread_dns_request;
  #   proxy_pass dns;
  # }
  #~domain

  # DNS(UDP) Server
  # DNS UDP proxy onto DNS UDP
  server {
    listen 53 udp;
    proxy_responses 1;
    js_preread dns.preread_dns_request;
    proxy_pass dns;
  }

  # DNS over HTTPS (gateway) Service
  # Upstream can be either DNS(TCP) or DoT. If upstream is DNS, proxy_ssl should be off.
  server {
    listen 8053;
    js_filter dns.filter_doh_request;
    proxy_pass dns;
  }
}