Current FedSocket implementation has a bunch of problems. It doesn't
have proper error handling (in case of an error the server just doesn't
respond until the connection is closed, while the client doesn't match
any error messages and just assumes there has been an error after 15s)
and the code is full of bad descisions (see: fetch registry which uses
uuids for no reason and waits for a response by recursively querying a
 ets table until the value changes, or double JSON encoding).

Sometime ago I almost completed rewriting fedsockets from scrach to
adress these issues. However, while doing so, I realized that fedsockets
 are just too overkill for what they were trying to accomplish, which is
 reduce the overhead of federation by not signing every message.
This could be done without reimplementing failure states and endpoint
 logic we already have with HTTP by, for example, using TLS cert auth,
or switching to a more performant signature algorithm. I opened
https://git.pleroma.social/pleroma/pleroma/-/issues/2262 for further
discussion on alternatives to fedsockets.

From discussions I had with other Pleroma developers it seems like they
 would approve the descision to remove them as well,
therefore I am submitting this patch.

Based on SSL config from https://ssl-config.mozilla.org/

Fix Cache Control headers on media

See merge request pleroma/pleroma!2295

since Pleroma.Web.Endpoint binds on IPv4 only and `localhost.` resolves to
  [::0] on some systems

  fixes #930.

Replaces `listen 80` with `listen [::]:80`, same with 443

Nginx is currently not caching data because proxy_buffering needs to be
enabled for caching to work at all, and we are receiving a Cache-Control
header from Pleroma that states "max-age=0, private, must-revalidate"

Even disregarding the Cache-Control header that should actually be set
to "public, max-age=1209600" as defined in the reverse_proxy code, we
don't want to obey this header at all as it overrides our Nginx caching
rules.

'self' only allows forms submitted to the same origin, which
breaks the "remote follow" form.  To allow remote following,
we want to allow forms to be submitted to any host.

Closes: https://git.pleroma.social/pleroma/pleroma/issues/266

nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead

* Added OCSP Stapling
* Added SSL Cache
* Changed ciphers
* Specified ECDH curves

* Removed TLSv1 and TLSv1.1
* Added OCSP Stapling
* Added SSL Cache
* Changed ciphers
* Specified ECDH curves

proxy_ignore_client_abort will continue to fetch from upstream even if a client aborts the connection. This is highly recommended when cache is being used. If a client leaves/refreshes the page while a user's avatar or some other media is halfway loaded, the cached copy might in some cases be broken. Leaving future requests to the same URL broken until cache expires.

The built-in nginx default does not allow users to upload images
larger than 1 MB. This increases the maximum request size to match
the default Pleroma config upload_limit parameter. Some helpful
comments were also added.