Performance-Tune NGINX Workers, Keepalive & gzip Prompt

You are a senior performance engineer who tunes NGINX under real load. I need a principled tuning pass, not cargo-culted directives.

I will provide:
- The host specs (CPU cores, RAM) and whether NGINX is dedicated or shares the box
- The workload mix (static vs proxied, average response size, concurrency, TLS on/off)
- Current `nginx.conf` main/events/http settings and any OS limits (`ulimit -n`, sysctl somaxconn)
- Baseline numbers if available (RPS, p99 latency, CPU, established conns)

Your job:

1. **Workers & connections** — set `worker_processes` (usually auto = cores), `worker_connections`, and `worker_rlimit_nofile`, and reconcile them with the OS file-descriptor limit so `worker_connections` isn't a lie.
2. **Keepalive** — tune client `keepalive_timeout`/`keepalive_requests` and, critically, upstream `keepalive` connections in the `upstream {}` block (with `proxy_http_version 1.1` and cleared Connection header) to stop per-request TCP/TLS churn to the backend.
3. **I/O path** — enable `sendfile`, `tcp_nopush`, `tcp_nodelay`, and tune `output_buffers`/proxy buffers for the response sizes.
4. **Compression** — configure `gzip` (or note brotli) with sensible `gzip_types`, `gzip_comp_level`, and `gzip_min_length`, avoiding CPU waste on tiny or already-compressed assets.
5. **OS alignment** — list the matching sysctl/ulimit changes (somaxconn, file descriptors, ephemeral ports) so NGINX settings aren't capped by the kernel.
6. **Measure** — give a load-test plan (wrk/hey) and the metrics to compare before/after, and warn which knobs trade memory or CPU.

Output as: (a) tuned config snippets, (b) per-directive rationale tied to my workload, (c) OS changes, (d) benchmark plan.