nginx

What it does

How to write it

nginx [-t] [-T] [-s signal] [-c file] [-g directives]
systemctl {start|reload|status} nginx

Main parts

Config blocks

http { … }

Settings for all web traffic.

server { … }

One virtual host (listen port, server_name, TLS).

location PATH { … }

Rules for some URLs (root, proxy_pass, headers).

upstream NAME { … }

A group of backend servers for load balancing.

stream { … }

TCP/UDP proxying (databases, other protocols).

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Install, open the firewall and start

   #dnf install -y nginx
   #firewall-cmd --add-service={http,https} --permanent && firewall-cmd --reload
   #systemctl enable --now nginx
   $curl -I http://localhost/

2. 2Test and reload after a change

   #nginx -t
   nginx: configuration file /etc/nginx/nginx.conf test is successful
   #systemctl reload nginx

   reload keeps open connections; a broken config is refused, the old one keeps running.

3. 3Serve a static site

   #cat /etc/nginx/conf.d/site.conf
   server {
       listen 80;
       server_name www.example.com;
       root /srv/www/site;
       index index.html;
   }
   #semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?' && restorecon -Rv /srv/www

4. 4Reverse proxy to an app on port 8080

   #cat /etc/nginx/conf.d/app.conf
   server {
       listen 80;
       server_name app.example.com;
       location / {
           proxy_pass http://127.0.0.1:8080;
           proxy_set_header Host $host;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
       }
   }
   #setsebool -P httpd_can_network_connect on

5. 5HTTPS with a certificate and HTTP redirect

   #cat /etc/nginx/conf.d/tls.conf
   server { listen 80; server_name shop.example.com; return 301 https://$host$request_uri; }
   server {
       listen 443 ssl;
       http2 on;
       server_name shop.example.com;
       ssl_certificate     /etc/pki/tls/certs/shop.crt;
       ssl_certificate_key /etc/pki/tls/private/shop.key;
       ssl_protocols TLSv1.2 TLSv1.3;
       add_header Strict-Transport-Security "max-age=31536000" always;
   }

6. 6Load-balance three app servers

   #cat /etc/nginx/conf.d/lb.conf
   upstream app { least_conn; server 10.30.2.11:8080; server 10.30.2.12:8080; server 10.30.2.13:8080 max_fails=3 fail_timeout=30s; }
   server { listen 80; location / { proxy_pass http://app; } }

7. 7Limit request rates (brute force, scrapers)

   #cat /etc/nginx/conf.d/limits.conf
   limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
   server { location /login { limit_req zone=login burst=5 nodelay; proxy_pass http://127.0.0.1:8080; } }

8. 8Add security headers and hide the version

   #cat /etc/nginx/conf.d/security.conf
   server_tokens off;
   add_header X-Content-Type-Options nosniff always;
   add_header X-Frame-Options DENY always;
   add_header Referrer-Policy strict-origin-when-cross-origin always;

9. 9Read the logs

   #tail -f /var/log/nginx/access.log /var/log/nginx/error.log
   #awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn
   #journalctl -u nginx -n 30

10. 10Show the full active configuration

    #nginx -T | grep -E "server_name|listen|proxy_pass"

11. 11Run nginx in a container

    $podman run -d --name web -p 8080:8080 -v ./site:/usr/share/nginx/html:ro,Z docker.io/nginxinc/nginx-unprivileged:1.27

Nothing matches this filter.

Files

/etc/nginx/nginx.conf

Main configuration.

/etc/nginx/conf.d/*.conf

Sites and extra settings.

/var/log/nginx/

access.log and error.log.

/usr/share/nginx/html

Default web root.

Exit codes