nginx.conf

user www-data www-data;
worker_processes auto;
pid /var/run/nginx.pid;
daemon off;
worker_rlimit_nofile 262144;

events {
    worker_connections 16384;
    multi_accept on;
    use epoll;
}

http {
        server_tokens off;
        sendfile on;
        charset utf-8;
        tcp_nopush on;
        tcp_nodelay on;

        log_format private '[$time_local] $host "$request" $status $body_bytes_sent';

        types_hash_max_size 2048;
        server_names_hash_bucket_size 64;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;
        add_header X-Content-Type-Options nosniff;

        access_log /var/log/nginx/access.log private;
        error_log /var/log/nginx/error.log;
        add_header Referrer-Policy same-origin;

        gzip on;
        gzip_disable "msie6";
        gzip_types text/plain text/css application/json application/javascript application/x-javascript text/javascript text/xml application/xml application/rss+xml application/atom+xml application/rdf+xml image/svg+xml;
        gzip_vary on;
        gzip_proxied any;
        gzip_comp_level 6;
        gzip_buffers 16 8k;

        include /etc/nginx/conf.d/*.conf;

    server {
        listen 80 backlog=4096 default_server;
        listen [::]:80 ipv6only=on default_server;
        listen 443 backlog=4096 default_server ssl;
        listen [::]:443 ipv6only=on default_server ssl;
        server_name _;
        ssl_certificate     /image/config/ssl/domain.crt;
        ssl_certificate_key /image/config/ssl/domain.key;

        index index.php index.html;
        root /var/www;

        location /media/ {
            alias /data/media/;
            expires 7d;
            access_log off;
        }
        location ^~ /media/cachedfiles {
            deny all;
            return 404;
        }
        location ^~ /media/invoices {
            deny all;
            return 404;
        }
        location /static/ {
            alias /pretix/src/pretix/static.dist/;
            access_log off;
            expires 365d;
            add_header Cache-Control "public";
            add_header Access-Control-Allow-Origin "*";
            gzip on;
        }
        location / {
            # Very important:
            #   proxy_pass http://unix:/tmp/pretix.sock:;
            # is not the same as
            #   proxy_pass http://unix:/tmp/pretix.sock:/;
            # In the latter case, nginx will apply its URL parsing, in the former it doesn't.
            # There are situations in which pretix' API will deal with "file names" containing %2F%2F, which
            # nginx will normalize to %2F, which can break ticket validation.
            proxy_pass http://unix:/tmp/pretix.sock:;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
        }
    }
}