Master Nginx Performance: Essential Config Tweaks for High‑Concurrency Environments

Nginx Core Optimization Items

Worker processes : set worker_processes 8; (usually equal to CPU cores).

CPU affinity : bind each worker to a CPU with

worker_cpu_affinity 00000001 00000010 00000100 00001000 00010000 00100000 01000000 10000000;

.

Open file limit per worker : worker_rlimit_nofile 65535; (match ulimit -n).

I/O model : enable use epoll; for efficient event handling.

Maximum connections per worker : worker_connections 65535; (total connections = workers × connections).

Keep‑alive timeout : keepalive_timeout 60; (avoid overly long idle connections).

Client header buffer size : client_header_buffer_size 4k; (use system page size).

Open file cache : open_file_cache max=102400 inactive=20s; and open_file_cache_valid 30s; with open_file_cache_min_uses 1;.

Hide server version : server_tokens off;.

Enable sendfile : sendfile on; (kernel‑level file transfer).

TCP optimizations : tcp_nopush on; and tcp_nodelay on; to improve packet handling.

FastCGI Directives

fastcgi_cache_path /usr/local/nginx/fastcgi_cache levels=1:2 keys_zone=TEST:10m inactive=5m;

fastcgi_connect_timeout 300;

fastcgi_send_timeout 300;

fastcgi_read_timeout 300;

fastcgi_buffer_size 16k;

fastcgi_buffers 16 16k;

fastcgi_busy_buffers_size 32k;

fastcgi_temp_file_write_size 32k;

fastcgi_cache TEST;

fastcgi_cache_valid 200 302 1h;

fastcgi_cache_valid 301 1d;

fastcgi_cache_valid any 1m;

fastcgi_cache_min_uses 1;

fastcgi_cache_use_stale error timeout invalid_header http_500;

Kernel Parameter Tuning (sysctl)

net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.tcp_tw_recycle = 0   # disabled for NAT environments
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_syncookies = 1
net.core.somaxconn = 262144
net.core.netdev_max_backlog = 262144
net.ipv4.tcp_max_orphans = 262144
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 30

Nginx Monitoring

Compile Nginx with --with-http_stub_status_module and add a status location:

location = /nginx_status {
    stub_status on;
    access_log off;
    allow 127.0.0.1;
    deny all;
}

Query with curl 127.0.0.1/nginx_status. External tools such as ngxtop or nginx‑rrd can provide richer visualizations.

Common Nginx Security Hardening

# Disable directory listing
autoindex off;
# Disable SSI
ssi off;
# Hide version information
server_tokens off;
# Limit request body sizes
client_body_buffer_size 1K;
client_header_buffer_size 1k;
client_max_body_size 1k;
large_client_header_buffers 2 1k;
# Reduce timeouts to mitigate DoS
client_body_timeout 10;
client_header_timeout 10;
keepalive_timeout 65;
send_timeout 10;
# Limit concurrent connections per IP
limit_zone slimits $binary_remote_addr 5m;
limit_conn slimits 5;

Summary of Nginx Tuning Methods

Hide Nginx version (server_tokens off).

Run Nginx under a non‑default user.

Adjust worker process count and bind each to a CPU.

Optimize the event model (use epoll).

Increase worker_connections and file descriptor limits.

Enable efficient file transfer (sendfile, tcp_nopush, tcp_nodelay).

Fine‑tune keep‑alive and timeout settings.

Configure FastCGI cache and buffer parameters.

Enable gzip compression and appropriate expires headers.

Set up log rotation and proper log formats.

Apply security hardening (disable autoindex, hide tokens, limit request sizes).

Control concurrent connections and enable rate limiting.

Use upstream load‑balancing and keep‑alive pools.

Monitor Nginx with stub_status or external tools.

Adjust kernel TCP parameters for high‑traffic scenarios.