What would you advise to change in such an NGINX config?

Question

Nginx

I am learning to configure NGINX, tell me, what would you advise to add / remove / change in such a config?
One core, 768MB of memory, the server will mainly distribute static html with pictures, maybe after some time I will connect the PHP7.0-FPM backend. But for the distribution of small statics, what else do you think can be optimized?
nginx.conf

user www-data;
worker_processes 2;

error_log  /var/log/nginx/error.log crit;
pid /run/nginx.pid;

worker_rlimit_nofile 16384;

timer_resolution 100ms;

worker_priority -5;

events {
  worker_connections 4096;
  multi_accept on;
  use epoll;
}

http {
  sendfile on;
  sendfile_max_chunk 512k;
  tcp_nopush on;
  tcp_nodelay on;
  types_hash_max_size 2048;
  server_tokens off;

#	access_log  /var/log/nginx/access.log  main;
  access_log off;

  include /etc/nginx/mime.types;
  default_type application/octet-stream;

  gzip on;
  gzip_disable "msie6";
  gzip_vary on;
  gzip_proxied any;
  gzip_comp_level 5;
  gzip_buffers 16 8k;
  gzip_http_version 1.1;
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
  gzip_min_length 256;

  client_body_buffer_size 16K;
  client_header_buffer_size 1k;
  client_max_body_size 4m;
  large_client_header_buffers 2 2k;
  client_body_timeout 16;
  client_header_timeout 16;

  open_file_cache max=16384 inactive=20s;
  open_file_cache_valid 60s;
  open_file_cache_min_uses 2;
  open_file_cache_errors on;

  keepalive_timeout 120;
  keepalive_requests 1024;
  send_timeout 2;

  include /etc/nginx/conf.d/*.conf;
  include /etc/nginx/sites-enabled/*;
}

server

server {
  listen 80;
  listen [::]:80;

  server_name domain.com www.domain.com;
  server_tokens off;

  return 301 https://domain.com$request_uri;
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name www.domain.com;
  server_tokens off;

  ssl_certificate /etc/nginx/1234/12345.pem;
  ssl_certificate_key /etc/nginx/1234/12345.key;
  ssl_session_timeout 12h;
  ssl_session_cache builtin:2048 shared:SSL:10m;
  ssl_session_tickets on;

  ssl_dhparam /etc/nginx/1234/dh.pem;

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
  ssl_prefer_server_ciphers on;

  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /etc/nginx/1234/ca-certs.pem;
  resolver 8.8.8.8 8.8.4.4 valid=300s;
  resolver_timeout 5s;

  add_header Strict-Transport-Security max-age=15552000;
  add_header X-Frame-Options SAMEORIGIN;
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header Public-Key-Pins 'pin-sha256="ZaeC7aDCKHf5PSdQFunx5hcO9byyJRD2OXDiAjGHa9M="; pin-sha256="m/CdGXPW3bzy+HkDHIG/E/gyTXXOcw7HlwITZWOzJ4Y="; max-age=604800';

  return 301 https://domain.com$request_uri;
}

server {
  listen 443 ssl http2 default_server;
  listen [::]:443 ssl http2 default_server;

  server_name domain.com;
  server_tokens off;

  ssl_certificate /etc/nginx/1234/12345.pem;
  ssl_certificate_key /etc/nginx/1234/12345.key;
  ssl_session_timeout 12h;
  ssl_session_cache builtin:2048 shared:SSL:10m;
  ssl_session_tickets on;

  ssl_dhparam /etc/nginx/1234/dh.pem;

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
  ssl_prefer_server_ciphers on;

  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /etc/nginx/1234/ca-certs.pem;
  resolver 8.8.8.8 8.8.4.4 valid=300s;
  resolver_timeout 5s;

  add_header Strict-Transport-Security max-age=15552000;
  add_header X-Frame-Options SAMEORIGIN;	add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header Public-Key-Pins 'pin-sha256="ZaeC7aDCKHf5PSdQFunx5hcO9byyJRD2OXDiAjGHa9M="; pin-sha256="m/CdGXPW3bzy+HkDHIG/E/gyTXXOcw7HlwITZWOzJ4Y="; max-age=604800';

  client_body_buffer_size  10K;
  client_header_buffer_size 10k;
  client_max_body_size 10m;
  large_client_header_buffers 2 10k;

  root /var/www/html;

  index index.html index.htm;

  rewrite ^/(.+)/$ /$1 permanent;

  location / {
    try_files $uri $uri.html $uri/ =404;
  }

  location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
    expires 24d;
    access_log off;
    log_not_found off;
  }

  location ~* ^.+\.(js|css)$ {
    expires 7d;
    access_log off;
    log_not_found off;
  }

  #location ~ \.php$ {
  #	include snippets/fastcgi-php.conf;
  #
  #	# With php5-cgi alone:
  #	fastcgi_pass 127.0.0.1:9000;
  #	# With php5-fpm:
  #	fastcgi_pass unix:/var/run/php5-fpm.sock;
  #}
}

Answer 1

Everything is working

-Doctor, look at my penis!
- member as a member ...
- No, doctor, you look what a handsome man!

good config, abstruse, with a bunch of optimizations for it’s not clear what tasks and for what hardware
A good
resolver, except that you shouldn’t give it to nginx
It’s better to set up a private resolver from https://en.wikipedia.org/wiki/Comparison_of_DNS_se...

resolver 8.8.8.8 8.8.4.4 valid=300s;
  resolver_timeout 5s;

especially since its role in this config is incomprehensible
And it is include /etc/nginx/sites-enabled/*;not clear why
And it is not indicated for which version of the config