How to implement selective caching in NGINX?

Question

Nginx

Greetings, I'm not a professional in administration, so I'm looking for help here, I hope kind people will help. A site should be opened very soon, where there will be a sharp influx of users, to ensure stability, I decided to use NGINX in caching mode (other cp offered in Vesta: default, hosting, http2). It is in this mode that when virtual users are launched, the server shows the best response results and does not crash.
But, I ran into a problem, the site is under development and is only accessible with a password, but if I enable caching, this protection is bypassed, as I understand it, all users are given the page I downloaded bypassing authorization.

I would also like to exclude the admin directory from caching by entering in the config:

location /administrator {
add_header Cache-Control no-cache;
expires -1;
}
I get an error starting NGINX Error: nginx failed to start with new config

what am I doing wrong? how to implement selective caching of directories and ask the user to enter authorization data, and not to issue a ready-made page ignoring authorization bypass? Please correct me if there are errors in the config or I'm going the wrong way, I'm ready to provide additional information about the server or other configs if any are needed, thanks!

CMS Joomla / Php 7.4.15 / CGI-FastCGI / nginx 1.18.0 2cores 4gb ram

nginx settings

# Server globals
user nginx;
worker_processes 2;
worker_rlimit_nofile 65535;
error_log /var/log/nginx/error.log crit;
pid /var/run/nginx.pid;

# Worker config
events {
worker_connections 1024;
use epoll;
multi_accept on;
}

http {
# Main settings
sendfile on;
tcp_nopush on;
tcp_nodelay on;
client_header_timeout 11;
client_body_timeout 11;
client_header_buffer_size 2k;
client_body_buffer_size 2k;
client_max_body_size 15m;
large_client_header_buffers 8 4k;
send_timeout 4;
keepalive_timeout 11 11;
keepalive_requests 100;
reset_timedout_connection on;
server_tokens off;
server_name_in_redirect off;
server_names_hash_max_size 512;
server_names_hash_bucket_size 512;

# Log format
log_format main '$remote_addr - $remote_user [$time_local] $request '
'"$status" $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
log_format bytes '$body_bytes_sent';
#access_log /var/log/nginx/access.log main;
access_log off;
error_log /var/log/nginx/error.log crit;

# Mime settings
include /etc/nginx/mime.types;
default_type application/octet-stream;

# Compression
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 512;
gzip_buffers 8 64k;
gzip_types text/plain text/css text/javascript text/js text/xml application/json application/javascript application/x-javascript application/xml application/xml+rss application/x-font-ttf image/svg+xml font/opentype;
gzip_proxied any;
gzip_disable "MSIE [1-6]\.";

# Proxy settings
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass_header Set-Cookie;
proxy_connect_timeout 30;
proxy_send_timeout 30;
proxy_read_timeout 30;
proxy_buffers 32 4k;

# Cloudflare https://www.cloudflare.com/ips
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
#set_real_ip_from 2400:cb00::/32;
#set_real_ip_from 2606:4700::/32;
#set_real_ip_from 2803:f800::/32;
#set_real_ip_from 2405:b500::/32;
#set_real_ip_from 2405:8100::/32;
#set_real_ip_from 2c0f:f248::/32;
#set_real_ip_from 2a06:98c0::/29;
real_ip_header CF-Connecting-IP;

# SSL PCI Compliance
ssl_session_cache shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";

# Error pages
error_page 403 /error/403.html;
error_page 404 /error/404.html;
error_page 502 503 504 /error/50x.html;

# Cache settings
proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=1000m;
proxy_cache_key "$request_method|$http_if_modified_since|$http_if_none_match|$host|$request_uri $cookie_user";
proxy_temp_path /var/cache/nginx/temp;
proxy_ignore_headers Expires Cache-Control;
proxy_cache_use_stale error timeout invalid_header http_502;
proxy_cache_valid 200 301 302 304 5m;
proxy_hide_header "Set-Cookie";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;



# Cache bypass
map $http_cookie $no_cache {
default 0;
~SESS 1;
~wordpress_logged_in 1;
}

# File cache settings
open_file_cache max=200000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;

# Wildcard include
include /etc/nginx/conf.d/*.conf;
}

Answer 1

What kind of traffic do you expect and what do you have inside?
From experience, there is a site on joomla, spinning on a regular hosting for 2k rubles a year with a daily attendance of 40k per day, caching is not even included in joomla. When increasing the load, we use native Joomla
caching, there are several options ,
read here joomla.center/baza-joomla/skorost-zagruzki-joomla/nastrojka-keshirovaniya-v-joomla configuring servers for joomla dogs ate more than Koreans.