[Статья] Как логировать реальный трафик на своём сайте (nginx + Telegram, без мусора и ботов)

user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;


events {
    worker_connections 768;
    # multi_accept on;
}


http {
      


   log_format redirect_log escape=json
   '{"time":"$time_iso8601",'
   '"ip":"$remote_addr",'
   '"domain":"$host",'
   '"agent":"$http_user_agent"}';
      
    ##
    # Basic Settings
    ##


    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    # server_tokens off;


    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;


    include /etc/nginx/mime.types;
    default_type application/octet-stream;


    ##
    # SSL Settings
    ##


    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;


    ##
    # Logging Settings
    ##


    access_log /var/log/nginx/access.log;
        access_log /var/log/nginx/redirect.log redirect_log;


    ##
    # Gzip Settings
    ##


    gzip on;


    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;


    ##
    # Virtual Host Configs
    ##


    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}




#mail {
#    # See sample authentication script at:
#    # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#    # auth_http localhost/auth.php;
#    # pop3_capabilities "TOP" "USER";
#    # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#    server {
#        listen     localhost:110;
#        protocol   pop3;
#        proxy      on;
#    }
#
#    server {
#        listen     localhost:143;
#        protocol   imap;
#        proxy      on;
#    }
#}

user www-data;
worker_processes auto;
pid /run/nginx.pid;


# РћСЃРЅРѕРІРЅРѕР№ error_log
error_log /var/log/nginx/error.log;


# Модули
include /etc/nginx/modules-enabled/*.conf;


events {
    worker_connections 1024;
    multi_accept on;
}


http {
    ##
    # Базовые настройки
    ##
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;


    types_hash_max_size 2048;
    server_tokens off;
    client_max_body_size 100M;


    server_names_hash_bucket_size 128;


    include /etc/nginx/mime.types;
    default_type application/octet-stream;


    ##
    # Реальный IP за Cloudflare
    ##
    real_ip_header CF-Connecting-IP;
    set_real_ip_from 173.245.48.0/20;
    set_real_ip_from 103.21.244.0/22;
    set_real_ip_from 103.22.200.0/22;
    set_real_ip_from 103.31.4.0/22;
    set_real_ip_from 141.101.64.0/18;
    set_real_ip_from 108.162.192.0/18;
    set_real_ip_from 190.93.240.0/20;
    set_real_ip_from 188.114.96.0/20;
    set_real_ip_from 197.234.240.0/22;
    set_real_ip_from 198.41.128.0/17;
    set_real_ip_from 162.158.0.0/15;
    set_real_ip_from 104.16.0.0/13;
    set_real_ip_from 104.24.0.0/14;
    set_real_ip_from 172.64.0.0/13;
    set_real_ip_from 131.0.72.0/22;


    # Локалки
    set_real_ip_from 127.0.0.1;
    set_real_ip_from 10.0.0.0/8;
    set_real_ip_from 172.16.0.0/12;
    set_real_ip_from 192.168.0.0/16;


    real_ip_recursive on;


    ##
    # Твой общий JSON-лог для других проектов (оставляем как было)
    ##
    log_format json_analytics escape=json
      '{"time":"$time_iso8601",'
       '"ip":"$realip_remote_addr",'
       '"domain":"$host",'
       '"path":"$request_uri",'
       '"agent":"$http_user_agent",'
       '"referer":"$http_referer",'
       '"method":"$request_method",'
       '"status":"$status",'
       '"bytes":"$body_bytes_sent",'
       '"forwarded_for":"$http_x_forwarded_for",'
       '"cf_connecting_ip":"$http_cf_connecting_ip",'
       '"cf_ipcountry":"$http_cf_ipcountry"}';


    access_log /var/log/nginx/access.log json_analytics;
    error_log  /var/log/nginx/error.log  warn;


    ##
    # TLS
    ##
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;


    ##
    # Сжатие
    ##
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/xml+rss
        application/atom+xml
        image/svg+xml;


    ##
    # Кэш дескрипторов
    ##
    open_file_cache max=1000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;


    ##
    # Лимиты
    ##
    limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;


    ##
    # Твои существующие проекты
    ##
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;


    ##
    # === ВАЖНО: MirrorHub — объявляем формат логов ДО серверов ===
    ##
    include /etc/nginx/sites-available/mirrorhub.conf;


    ##
    # MirrorHub — карта доменов (используется скриптами/шаблонами по желанию)
    ##
    map $host $mirrorhub_hit {
        default 0;
        include /etc/nginx/mirrorhub/domains_map.conf;
    }


    ##
    # MirrorHub — per-domain конфиги (server{}), генерируются nginx_sync.py
    ##
    include /etc/nginx/sites-mirrorhub.d/*.conf;


    ##
    # (опционально) дефолт-заглушки
    ##
    # server {
    #     listen 80 default_server;
    #     server_name _;
    #     return 444;
    # }
    # server {
    #     listen 443 ssl default_server;
    #     server_name _;
    #     return 444;
    # }
}