NGINX Config Reviewer

What this skill does

Reviews an nginx.conf (and any included files) for security and performance smells — weak TLS, missing gzip, oversized buffers, lack of cache headers — and produces a punch-list with concrete config snippets.

Inputs

• config_path: path to the main nginx.conf.
• Optional nginx_version: target version, defaults to detecting via nginx -v.
• Optional mozilla_profile: intermediate (default) or modern.

Steps

1. Run nginx -t -c <config_path> to confirm the config is syntactically valid.
2. Collect all included files: nginx -T -c <config_path> dumps the merged config; parse it.
3. TLS audit:
   • ssl_protocols must be TLSv1.2 TLSv1.3 (intermediate) or TLSv1.3 only (modern).
   • ssl_ciphers must follow the Mozilla profile string.
   • ssl_prefer_server_ciphers should be off for TLSv1.3-only configs, on otherwise.
   • HSTS header set on HTTPS server blocks.
4. Performance audit:
   • gzip on and gzip_types covering text/css application/javascript application/json text/xml.
   • client_max_body_size not over 50m unless the route truly needs uploads.
   • keepalive_timeout between 30s and 75s.
   • sendfile on; tcp_nopush on; for static-heavy locations.
5. Caching audit:
   • Static-asset locations (location ~* \.(js|css|png|jpg|woff2)$) should set expires 1y and add_header Cache-Control "public, immutable".
6. Security headers per server block: X-Content-Type-Options, Referrer-Policy, X-Frame-Options or Content-Security-Policy: frame-ancestors.
7. Detect server_tokens off; missing means the version is exposed.
8. Emit findings keyed to the directive's file:line (parsed from nginx -T output via the # configuration file markers).
9. Compose a markdown report.

Output

nginx-review.md with sections per audit family (TLS, Perf, Caching, Headers), each row showing file:line, current value, recommended value, and a paste-ready config snippet. Exit 1 if any TLS finding is critical (e.g., TLSv1.0 enabled).

Verification

After applying suggested changes, run nginx -t and confirm syntax pass, then nginx -s reload in a staging environment. Run testssl.sh https://<host> and confirm grade A or A+. Use curl -I https://<host> to verify HSTS and cache headers are present.

Edge cases

• Configs with stream blocks (TCP/UDP proxy): apply only the relevant TLS rules; HTTP-specific rules don't apply.
• Configs using the lua-nginx-module: skip Lua content but still check the surrounding directives.
• Configs generated by Kubernetes ingress controllers: changes here may be overwritten; recommend changing the controller's template instead.
• Servers behind a TLS-terminating LB: TLS audit may be moot; document the trust boundary.