Some of these settings seem a bit dubious - setting the nginx keepalive timeout to 5 seconds for example does nothing to "harden" things, but kills performance

Some of these settings seem a bit dubious - setting the nginx keepalive timeout to 5 seconds for example does nothing to "harden" things, but kills performance of HTTPS sites. Be sure you understand what you're actually doing before blanket applying all of these.