nginx Archives - Page 5 of 6

On a high traffic web site, i want to disable access log as we are hitting I/O Limit. Since we don’t use this access log for anything now, there is no point keep writing it to a file. To disable, you need to add following to server entry for your web site.

access_log off;

Here is an example nginx config with access logs disabled.

server {
    server_name server3.serverok.in www.server3.serverok.in;
    listen 80;
    listen 443 ssl;
    ssl_certificate /etc/ssl/ssl.cert;
    ssl_certificate_key /etc/ssl/ssl.key;
    root /home/server3/public_html;
    index index.html;
    limit_rate_after 10m;
    limit_rate 512k;
    access_log off;
    location / {
        valid_referers none serverok.in www.serverok.in;
        if ($invalid_referer) {
            return 403;
        }
    }
}

December 4, 2018

Enable Directory Listing in Nginx

To enable directory listing in Nginx, add following to server configuration.

autoindex on;

Example

server {
	listen 80 default_server;
	listen [::]:80 default_server;
	root /var/www/html;
	autoindex on;
	index index.php index.html index.htm;

	server_name _;

    location / {
            try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        proxy_read_timeout 600;
        fastcgi_read_timeout 600;
        fastcgi_send_timeout 600;
        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

}

If you need it for a specific folder, add

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    root /var/www/html;
    index index.php index.html index.htm;
    
    server_name _;

    location / {
            try_files $uri $uri/ /index.php?$args;
    }

    location /myfiles {
            autoindex on;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        proxy_read_timeout 600;
        fastcgi_read_timeout 600;
        fastcgi_send_timeout 600;
        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

}

November 25, 2018

Nginx 413 Request Entity Too Large

On Nginx server, when uploading large file, i get error

413 Request Entity Too Large

On nginx error log

2018/10/10 18:15:34 [error] 25787#0: *184 client intended to send too large body: 31354043 bytes, client: 15.17.7.27, server: _, request: "POST /phpmyadmin/import.php HTTP/1.1", host: "13.16.28.19"

To fix, edit nginx config for the web site, under the server section of the web site, add

client_max_body_size 800M;

Restart nginx.

service nginx restart

October 10, 2018

Nginx CloudFlare restore real ip

When using Nginx Behind Cloudflare, logs and web applications show Cloudflare sever IP instead of visitor IP.

To fix this, edit

vi /etc/nginx/nginx.conf

Inside “http” section, add

set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2c0f:f248::/32;
set_real_ip_from 2a06:98c0::/29;

real_ip_header CF-Connecting-IP;

You can get updated list of CloudFlare IPs from

https://www.cloudflare.com/ips

Restart Nginx with

service nginx restart

Example Nginx Config

https://gist.github.com/serverok/fef5c76bf96f8e016bf64095da4a64dc

Back to Nginx

July 25, 2018

Disable Access to a folder in Nginx

To disable access to folder /admin in Nginx, add following to server block of your web site.

location /admin {
    deny all;
    return 404;
}

To disable access to some common virtual control software, use

location ~ /\.ht    {return 404;}
location ~ /\.svn/  {return 404;}
location ~ /\.git/  {return 404;}
location ~ /\.hg/   {return 404;}
location ~ /\.bzr/  {return 404;}

July 17, 2018

Nginx Proxy SSL Verification

When using Nginx as a reverse proxy, you may need to handle SSL verification requests. Passing this request to the backend server may not do any good as back-end servers usually only handle application requests.

To handle SSL validation requests, use the following Nginx Configuration

server {
    listen 80;
    server_name YOUR-DOMAIN.EXTN www.YOUR-DOMAIN.EXTN;

    location ^~ /.well-known/acme-challenge/ {
        allow all;
        autoindex on;
        root /var/www/html;
    }

    location / {
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:4200;
    }
}

Now restart Nginx

service nginx restart

You can get SSL with the following letsencrypt command

certbot --authenticator webroot --webroot-path /var/www/html --installer nginx -d DOMAIN.EXTN -d www.DOMAIN.EXTN

If you have a redirect to HTTPS in your Nginx server block, use something like

server {
    listen 80;
    server_name YOUR-DOMAIN.EXTN www.YOUR-DOMAIN.EXTN;

    location ^~ /.well-known/acme-challenge/ {
        allow all;
        autoindex on;
        root /var/www/html;
    }

    location / {
        return 301 https://DOMAIN.EXTN$request_uri;
    }
}

See LetsEncrypt, Nginx

June 21, 2018

Nginx wildcard virtualhost

wildcard virtual host allow you to host multiple web sites with one configuration file.

Here is what i use for bizhat.com free hosting sub domains.

server {
    listen   167.114.61.119:80;
    server_name *.bizhat.com;
    autoindex on;
    access_log /var/log/nginx/free_access.log;
    error_log /var/log/nginx/free_error.log;
    root /home/vhosts/$host;

    index index.html index.htm default.htm default.html;

    location ~* \.(jpg|jpeg|gif|css|png|js|ico|html)$ {
        access_log off;
        expires max;
    }

    location ~ /\.ht {
        deny  all;
    }

    error_page 302  /302.html;
    location = /302.html {
        root  /home/free.bizhat.com/error;
    }

    error_page 404 /404.html;
    location = /404.html {
          root  /home/free.bizhat.com/error;
    }
}

Nginx

April 28, 2018

Moving from Apache PHP 5 to Nginx PHP 7

Today i moved a high traffic WordPress web using from Apache + PHP 5 to Nginx + PHP 7.2.

Here is a graph provided by LiquidWeb (server provider).

With Apache, load was like 8.

root@host:/etc/php# uptime
12:35:01 up 14:33, 1 user, load average: 8.03, 6.66, 5.84
root@host:/etc/php#

After switching to Nginx + PHP-FPM, load come down to 2.

root@host:~# uptime
17:26:20 up 19:24, 1 user, load average: 1.13, 1.07, 1.21
root@host:~#

Here is sar result.

With Apache idle CPU was approx 72. With Nginx we have 90%+ idle CPU most of the time.

Here is NewRelic Web transactions graph. The break in data is due to PHP 7.2 have no newrelic module installed. So i just switched back to Apache for a while, reinstalled NewRelic for PHP 7.2, then turned Nginx back on.

NewRelic Apdex Score went from poor to fair.

April 9, 2018

Nginx configuration for aMember

Here is Nginx configuration for aMember script

location ~* ^/amember/.*\.(js|ico|gif|jpg|png|css|swf|csv)$ {}
location ~* ^/amember/setup/index.php$ { try_files not-existing-file @php; }
location ~* ^/amember/js.php { try_files not-existing-file @php; }
location ~* ^/amember/index.php$ { try_files not-existing-file @php; }
location ~* ^/amember/public.php$ { try_files not-existing-file @php; }
location ~* ^/amember/public { rewrite ^.*$ /amember/public.php; }
location ~* ^/amember/setup { rewrite ^.*$ /amember/setup/index.php; }
location ~* ^/amember { rewrite ^.*$ /amember/index.php; }
location ~* /amember/data/public/* {}
location ~* /amember/data/.* {internal;}

location ~ \.php$ {
   try_files not-existing-file @php;
}

location @php {
  fastcgi_pass 127.0.0.1:9000;
  include fastcgi_params;
}

See Nginx

January 12, 2018

Nginx

Nginx is a powerful open source web server that is known for its high performance, stability, and flexibility. It is used by millions of websites around the world, and it is a popular choice for web developers and system administrators who need a reliable and efficient way to serve web content.

Install Nginx

Nginx Tricks

Nginx Configuration for scripts

Nginx Reverse Proxy

Nginx Stream

Nginx Errors

December 23, 2017

Nginx Curl SSL error

After installing SSL on Nginx server, it worked on browser, but when i try access using curl command, i get error

# curl  https://serverok.in
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
#

This is fixed by adding ca-bundle to .crt file.

The cert file should be in following format

YOUR_DOMAIN.crt
YOUR_DOMAIN.ca-bundle

This can be done with

cat YOUR_DOMAIN.crt YOUR_DOMAIN.ca-bundle > YOUR_DOMAIN.ssl

Now use YOUR_DOMAIN.ssl as your ssl certificate in nginx.

        ssl on;
        ssl_certificate /etc/ssl/YOUR_DOMAIN.ssl;
        ssl_certificate_key /etc/ssl/YOUR_DOMAIN.key;

December 23, 2017

Tag: nginx

Docker Nginx Proxy

Nginx Disable Access log

Enable Directory Listing in Nginx

Nginx 413 Request Entity Too Large

Nginx CloudFlare restore real ip

Disable Access to a folder in Nginx

Nginx Proxy SSL Verification

Nginx wildcard virtualhost

Moving from Apache PHP 5 to Nginx PHP 7

Nginx configuration for aMember

Nginx

Install Nginx

Nginx Tricks

Nginx Configuration for scripts

Nginx Reverse Proxy

Nginx Stream

Nginx Errors

Nginx Curl SSL error