Checkout the latest ngx_brotli and build the dependencies:

git clone --recurse-submodules -j8 https://github.com/google/ngx_brotli
cd ngx_brotli/deps/brotli
mkdir out && cd out
cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DCMAKE_C_FLAGS="-Ofast -m64 -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="-Ofast -m64 -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" -DCMAKE_INSTALL_PREFIX=./installed ..
cmake --build . --config Release --target brotlienc

nginx编译时增加
--add-module=/path/to/ngx_brotli

- 阅读剩余部分 -

在http部分配置了

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;

在vhost中配置了

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

在nginx documentation 的 Module ngx_http_headers_module 中提到了一段话，大致意思就是，如果当前级别没有定义 add_header 则会继承上一级，如果定义了 add_header 则不会去理会上一级。

There could be several add_header directives. These directives are
inherited from the previous configuration level if and only if there
are no add_header directives defined on the current level.

意味着vhost如果定义了add_header，则不会从主配置中继承，由于子站点配置了HSTS，定义了add_header，所以主配置中的add_header不再生效。

- 阅读剩余部分 -

This directive appeared in version 1.19.4.

If enabled, SSL handshakes in the server block will be rejected.

For example, in the following configuration, SSL handshakes with server names other than example.com are rejected:

server {
    listen               443 ssl default_server;
    ssl_reject_handshake on;
}

server {
    listen              443 ssl;
    server_name         example.com;
    ssl_certificate     example.com.crt;
    ssl_certificate_key example.com.key;
}

对于正常小图的访问不限制，把正常图的大小限定为 100K 以内，超出时就进行限速，速度限定为最大 100k/s

location ~ .*\.(gif|jpg|jpeg|png|bmp)$
 {     
   expires 30d;
   limit_rate_after 100k;
   limit_rate 100k;
}

- 阅读剩余部分 -

LNMP无法删除或更改权限，显示：rm: cannot remove `.user.ini': Operation not permitted
无法删除“.user.ini”文件解决方法,运行后删除即可

chattr -i /home/wwwroot/yoursite/.user.ini
如果是需要修改文件，记得修改完以后运行：

chattr +i /home/wwwroot/yoursite/.user.ini