gzip on;
gzip_types text/plain text/css application/json application/javascript;
gzip_min_length 1000;
gzip_vary on;

# Check if brotli is already built in
nginx -V 2>&1 | grep brotli

# Debian/Ubuntu (Nginx 1.17+)
apt install libnginx-mod-http-brotli

worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
}

http {
    # === Compression Modules ===
    # zstd (Caddy 2.7+ / Nginx 1.21+ with module)
    # or brotli
    brotli on;
    brotli_comp_level 5;           # 4-6 is the sweet spot; 5 is best
    brotli_min_length 200;         # Skip files < 200B (compression overhead)

    # gzip fallback
    gzip on;
    gzip_comp_level 6;
    gzip_min_length 512;
    gzip_vary on;

    # === HPCC Tier 1: brotli covers high-gain types ===
    brotli_types
        text/css
        text/javascript
        application/javascript
        application/json
        application/xml
        image/svg+xml
        application/wasm
        application/manifest+json;

    # === HPCC Tier 2: gzip covers medium-gain types ===
    gzip_types
        text/html
        application/xhtml+xml
        image/svg+xml
        text/xml
        application/atom+xml
        application/rss+xml;

    # === Log compressed sizes ===
    log_format compression '$remote_addr - $request '
                           '$status $body_bytes_sent '
                           'gzip:$gzip_ratio brotli:$brotli_ratio '
                           '$request_time';
    access_log /var/log/nginx/access.log compression;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # === Per-IP Rate Limiting (optional) ===
    # 5MB/s cap per connection; first 1MB goes full-speed
    limit_rate 5m;
    limit_rate_after 1m;

    root /var/www/mysite;
    index index.html;

    # === Build artifacts (content-hashed filenames) → 1 year ===
    location ~* \.(?:css|js|woff2?)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header ETag "W/\"$mtime\"";
    }

    # === Images / video (no compression benefit) → 30 days ===
    location ~* \.(?:jpg|jpeg|png|webp|avif|mp4|webm|ico)$ {
        expires 30d;
        add_header Cache-Control "public";
        add_header ETag "W/\"$mtime\"";
    }

    # === HTML / API → short cache ===
    location / {
        expires 5m;
        add_header Cache-Control "public, s-maxage=300";
        try_files $uri $uri/ /index.html;
    }

    # Block hidden files
    location ~ /\. {
        deny all;
        log_not_found off;
    }
}

nginx -t
systemctl reload nginx

# Confirm brotli is active
curl -sI -H "Accept-Encoding: br" https://example.com/app.js | grep -i content-encoding
# Expected: Content-Encoding: br

example.com {
    # Three-tier compression (zstd > br > gzip) in one line
    encode zstd br gzip

    # Tiered caching
    @hashed {
        re ^/(assets|static|build)/.*\.\w{8}\.(?:css|js|woff2?)$
    }
    @images {
        ext jpg jpeg png webp avif mp4 webm ico
    }

    header @hashed {
        Cache-Control "public, max-age=31536000, immutable"
    }

    header @images {
        Cache-Control "public, max-age=2592000"
    }

    header {
        Cache-Control "public, max-age=300"
    }

    log {
        output file /var/log/caddy/access.log
    }
}

# Install Caddy 2 (Debian/Ubuntu)
apt install caddy
systemctl enable --now caddy

#!/usr/bin/env python3
"""
check_bandwidth_saving.py
Compare egress traffic with and without compression.
Usage: python3 check_bandwidth_saving.py https://your-domain.com
"""
import requests
import sys

URL = sys.argv[1] if len(sys.argv) > 1 else "https://example.com"

TEST_FILES = [
    "/",
    "/static/js/main.abc12345.js",
    "/static/css/style.def67890.css",
    "/static/img/logo.webp",
    "/api/status",
]

def fetch(url: str, encoding: str = None) -> tuple[int, int]:
    headers = {"Accept-Encoding": encoding or "identity"}
    resp = requests.get(url, headers=headers, allow_redirects=True, timeout=10)
    content_length = len(resp.content)
    original = int(resp.headers.get("Content-Length", content_length))
    return original, content_length

print(f"Testing: {URL}")
print(f"{'File':<40} {'Original':>10} {'zstd/br':>10} {'gzip':>10} {'Saving':>8}")
print("-" * 85)

total_orig = total_best = total_gzip = 0

for f in TEST_FILES:
    try:
        full_url = URL.rstrip('/') + f
        orig, best_bytes = fetch(full_url, encoding="br")
        _,  gz_bytes     = fetch(full_url, encoding="gzip")
        saving = (1 - best_bytes/orig) * 100 if orig else 0
        total_orig += orig
        total_best += best_bytes
        total_gzip += gz_bytes
        print(f"{f:<40} {orig:>10,} {best_bytes:>10,} {gz_bytes:>10,} {saving:>7.1f}%")
    except Exception as e:
        print(f"{f:<40} ERROR: {e}")

print("-" * 85)
best_saving  = (1 - total_best/total_orig) * 100 if total_orig else 0
gzip_saving  = (1 - total_gzip/total_orig) * 100 if total_orig else 0
print(f"Total: {total_orig:,} B | best {total_best:,} B (-{best_saving:.1f}%) | gzip {total_gzip:,} B (-{gzip_saving:.1f}%)")

python3 check_bandwidth_saving.py https://your-vps-domain.com

http {
    # 3MB/s cap per connection; first 2MB full-speed
    limit_rate 3m;
    limit_rate_after 2m;

    # Optional: burst limiter
    limit_req_zone $binary_remote_addr zone=bandwidth:10m rate=5r/s;

    server {
        limit_req zone=bandwidth burst=10 nodelay;
        # ...
    }
}

limit_rate 833k;          # 50MB/60s ≈ 833KB/s
limit_rate_after 1m;      # first 1MB full-speed