My Public Notepad: Web Server

Showing posts with label Web Server. Show all posts

Friday, 10 May 2024

Introduction to Nginx

What is Nginx?

HTTP and reverse proxy server
widely used webserver

How to install Nginx on Linux?

Nginx serves a static HTML file by default so we can verify the deployment.

Where is Nginx binary?

# which nginx
/usr/sbin/nginx

To check Nginx version:

# nginx -v
nginx version: nginx/1.24.0

Nginx Configuration

Nginx configuration file is /etc/nginx/nginx.conf.

# cat /etc/nginx/nginx.conf

#######################################################################

# This is the main Nginx configuration file.

# More information about the configuration options is available on

# * the English wiki - http://wiki.nginx.org/Main

# * the Russian documentation - http://sysoev.ru/nginx/

#######################################################################

#----------------------------------------------------------------------

# Main Module - directives that cover basic functionality

# http://wiki.nginx.org/NginxHttpMainModule

#----------------------------------------------------------------------

user mywebapp-user;

# user nginx;

worker_processes auto;

worker_rlimit_nofile 10000;

#timer_resolution 100ms;

error_log /var/log/nginx/error.log;

#error_log /var/log/nginx/error.log notice;

#error_log /var/log/nginx/error.log info;

pid /var/run/nginx.pid;

#----------------------------------------------------------------------

# Events Module

# http://wiki.nginx.org/NginxHttpEventsModule

#----------------------------------------------------------------------

events {

worker_connections 4000;

# worker_connections 1024;

use epoll;

# accept_mutex on;

}

#----------------------------------------------------------------------

# HTTP Core Module

# http://wiki.nginx.org/NginxHttpCoreModule

#----------------------------------------------------------------------

http {

server_names_hash_bucket_size 128;

map $http_cf_ipcountry $allowed_country {

default 1;

"KP" 0; # Korea, Democratic Peoples Republic of (North Korea)

}

include /etc/nginx/mime.types;

default_type application/octet-stream;

log_format main '$remote_addr - $remote_user [$time_local] "$host"

"$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for"

"$http_cf_ipcountry"';

access_log /var/log/nginx/access.log main;

gzip on;

gzip_vary on;

gzip_types text/plain

text/xml

text/css

application/json

application/x-javascript;

gzip_min_length 1024;

server_tokens off;

# Replace client IP from proxies

real_ip_header X-Forwarded-For;

set_real_ip_from 10.0.0.0/8; # AWS VPC CIDR

set_real_ip_from 108.22.214.0/22; # Cloudflare

...

set_real_ip_from 2b06:27c0::/29; # Cloudflare

real_ip_recursive on;

sendfile on;

# tcp_nopush on;

# tcp_nodelay on;

keepalive_timeout 60;

server {

listen 80;

server_name "";

return 403;

}

# Load config files from the /etc/nginx/conf.d directory

include /etc/nginx/conf.d/*.conf;

}

This is a base config file which is usually enough if we're hosting a single website.

If we're hosting multiple websites/domains/brands, we want to keep their configuration isolated in separate files which reside in /etc/nginx/conf.d/*.conf. We create a config file for each website and define for example different error and access log files.

# ls -la /etc/nginx/conf.d/

total 56

drwxr-xr-x. 3 root root 175 May 8 13:07 .

drwxr-xr-x. 4 root root 16384 May 8 13:07 ..

drwxr-x---. 2 ec2-user ec2-user 16384 May 8 13:07 includes

-rw-r-----. 1 ec2-user ec2-user 1474 May 8 13:03 nginx.brandA.conf

-rw-r-----. 1 ec2-user ec2-user 1434 May 8 13:03 nginx.brandB.conf

-rw-r-----. 1 ec2-user ec2-user 1545 May 8 13:03 nginx.brandC.conf

-rw-r-----. 1 ec2-user ec2-user 858 May 8 13:03 nginx_status.conf

Let's check what can be in the override file:

# cat /etc/nginx/conf.d/nginx.brandA.conf

server {

# server settings

listen 80;

# listen 443 ssl;

server_name ~^(dev-|stage-|beta-)?(mywebapp)\.mydomainA\.com$;

# server_name phpfpm.local;

# server_name localhost;

resolver 149.214.169.253; # Amazon EC2 inside VPC

# log settings

error_log /home/mywebapp-user/logs/nginx/error-mywebapp.log;

access_log /home/mywebapp-user/logs/nginx/access-mywebapp.log main;

# client settings

client_body_temp_path /home/mywebapp-user/tmp/client_body;

# block visitors from certain countries

if ($allowed_country = 0) {

return 403; # forbidden

}

# path settings

root /home/mywebapp-user/public;

index index.html index.htm index.php;

# protect private files

location ~ ^/private/(.*)$ {

include conf.d/includes/nginx.trusted-ips.conf;

include conf.d/includes/nginx.php-fpm-brandA.conf;

}

# serve dmg files

location ~ \.dmg$ {