[OnePlus 3 & 3T Cross Device Development] anupritaisno1:
I also compile everything nginx links to

Here's what my nginx says:

nginx version: nginx/1.17.4
built with OpenSSL 3.0.0-dev xx XXX xxxx
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --with-openssl=../openssl --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-threads --with-stream --with-stream_ssl_module --with-http_slice_module --with-mail --with-mail_ssl_module --with-file-aio --with-http_v2_module --with-zlib=../zlib-1.2.11 --with-pcre=../pcre-8.43 --with-cc-opt='-g0 -O3 -funroll-loops -fipa-pta -fstack-protector-all -fstack-clash-protection -Wa,--noexecstack -Wp,-D_FORTIFY_SOURCE=2 -D_GLIBCXX_ASSERTIONS -fPIC -pie -fpie -mindirect-branch=thunk -mfunction-return=thunk -fwrapv -march=native -mtune=native -DTCP_FASTOPEN=23 --param ssp-buffer-size=4 -m64 -fexceptions -flto -fwhole-program' --with-openssl-opt='-fstack-protector-all -fstack-clash-protection -fPIC -fpie -mindirect-branch=thunk -mfunction-return=thunk -fwrapv -march=native -mtune=native -DTCP_FASTOPEN=23 -m64 -fexceptions -flto -fwhole-program no-shared no-ssl2 no-ssl3 enable-ec_nistp_64_gcc_128 no-comp no-idea no-weak-ssl-ciphers no-psk no-srp -g0 -O3 -march=native -mtune=native -fexceptions' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -Wl,-pie -fPIC -pie -Wl,-z,--as-needed -Wl,-z,noexecstack -Wl,-z,noexecheap -Wl,-z,defs -Wl,-z,nodlopen -Wl,-z,nodump -flto' --add-module=../ModSecurity-nginx --add-module=../ngx_brotli --with-cc='gcc -g0 -O3 -funroll-loops -fstack-protector-all -fstack-clash-protection -Wa,--noexecstack -Wp,-D_FORTIFY_SOURCE=2 -D_GLIBCXX_ASSERTIONS -fPIC -pie -fpie -mindirect-branch=thunk -mfunction-return=thunk -fwrapv -march=native -mtune=native -DTCP_FASTOPEN=23 --param ssp-buffer-size=4 -m64 -fexceptions -flto -fwhole-program'

If any flags are duplicated that's due to bugs in arch's pkgbuild system. I got random errors like "fortify source requires optimisation" unless I duplicated the flags in every place

I am aware --param ssp-buffer-size is useless with -fstack-protector-all. That's just a flag left from when I used -fstack-protector-strong

I also have systemd sandbox nginx. The only readwrite path is a directory that stores nginx's pid file for systemd. Here's what I have

Description=A high performance web server and a reverse proxy server
After=network.target network-online.target nss-lookup.target

[Service]
Type=forking
PIDFile=/var/run/nginx.pid
PrivateDevices=yes
SyslogLevel=err

ExecStart=/usr/bin/nginx -g 'pid REDACTED; error_log stderr;'
ExecReload=/usr/bin/nginx -s reload
KillSignal=SIGQUIT
KillMode=mixed

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/nginx.service.d/override.conf
[Service]
ProtectSystem=strict
PrivateTmp=true
ProtectHome=read-only
ProtectKernelTunables=true
ProtectControlGroups=true
ProtectKernelModules=true
PrivateDevices=true
SystemCallArchitectures=native
ReadWritePaths=-REDACTED
DevicePolicy=closed
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
CPUQuota=50%

Anything with a REDACTED next to it was obviously removed