These are industry-standard defaults and should form the base of any nginx config.

Feel free to select "modern" TLS settings, should work fine for your use cases but may cause issues for the occasional person.