Nginx & Reverse Proxy Documentation

Ubuntu/Debian Installation

Install Nginx on Ubuntu or Debian systems using the package manager:

sudo apt update

sudo apt install nginx

sudo systemctl start nginx
sudo systemctl enable nginx

sudo systemctl status nginx

CentOS/RHEL Installation

For CentOS or RHEL systems:

sudo yum install epel-release

sudo yum install nginx

sudo systemctl start nginx
sudo systemctl enable nginx

sudo ufw allow 'Nginx Full'

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Directory Structure

Understanding Nginx configuration structure:

• /etc/nginx/nginx.conf - Main configuration file
• /etc/nginx/sites-available/ - Available site configurations
• /etc/nginx/sites-enabled/ - Enabled site configurations
• /var/log/nginx/ - Log files directory
• /var/www/html/ - Default web root

Basic Server Block

Create a basic server configuration:

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com;
    index index.html index.htm index.php;

    location / {
        try_files $uri $uri/ =404;
    }

    # Log files
    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log;
}

PHP Configuration

Add PHP support to your server block:

location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
}

Step 1: Domain & DNS Setup

First, configure your domain to point to your server. This must be done before setting up SSL certificates.

server {
# -------------------------------------------------------

# HTTP -> HTTPS (men tillad ACME-challenges for cert fornyelse)
server {
    if ($host = api.example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name api.example.com;

    # ACME (Let's Encrypt) – lad certbot validere uden at blive redirectet
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
        allow all;
    }

    return 301 https://api.example.comk$request_uri;




}

# HTTPS -> din NGINX-egg / webservice på port
server {
    listen 443 ssl http2;
    server_name api.example.com;

    # Let's Encrypt certifikater
    ssl_certificate /etc/letsencrypt/live/docs.mrfaws.dk/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/docs.mrfaws.dk/privkey.pem; # managed by Certbot

    # Fornuftige TLS-indstillinger
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # Sikkerheds-headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Proxy til din specifikke Pterodactyl-server (HTTP på 3000)
    location / {
         proxy_pass http://127.0.0.1:3000;

        # Vigtige headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support (hvis nødvendigt)
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Timeouts (så builds/uploads ikke dør for hurtigt)
        proxy_read_timeout 300;
        proxy_send_timeout 300;
    }




}

}

Load Balancing

Set up load balancing across multiple backend servers:

upstream backend {
    server 127.0.0.1:3000 weight=3;
    server 127.0.0.1:3001 weight=2;
    server 127.0.0.1:3002 backup;
}

server {
    listen 80;
    server_name app.example.com;

    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Domain & DNS Setup

Before configuring your reverse proxy, ensure your domain is properly set up:

example.com    A    45.133.74.72

# Check if DNS is working
dig example.com A
nslookup example.com

# Test from different locations
dig @8.8.8.8 example.com A
dig @1.1.1.1 example.com A

Step 2: Generate Nginx Configuration

Create a custom Nginx configuration file for your domain and backend application:

Step 3: Deploy Configuration

Save your generated configuration file and deploy it to your server:

# Create new site configuration (replace 'your-domain.com' with your actual domain)
sudo nano /etc/nginx/sites-available/your-domain.com

# Or upload your downloaded file
sudo cp ~/your-domain.com-nginx.conf /etc/nginx/sites-available/your-domain.com

# Create symbolic link to enable site
sudo ln -sf /etc/nginx/sites-available/your-domain.com /etc/nginx/sites-enabled/your-domain.com

# Test configuration syntax
sudo nginx -t

# If test passes, reload Nginx
sudo systemctl reload nginx

Step 4: SSL Certificate (Optional)

If you didn't include SSL in your configuration, you can add it using Certbot:

# Install Certbot (if not already installed)
sudo apt install certbot python3-certbot-nginx

# Generate certificate for your domain
sudo certbot --nginx -d your-domain.com -d www.your-domain.com

Step 5: Management & Troubleshooting

Use these commands to manage and troubleshoot your reverse proxy:

# Check Nginx status
sudo systemctl status nginx

# Start Nginx
sudo systemctl start nginx

# Stop Nginx
sudo systemctl stop nginx

# Restart Nginx (full restart)
sudo systemctl restart nginx

# Reload configuration (preferred - no downtime)
sudo systemctl reload nginx

# Test configuration syntax
sudo nginx -t

# Test specific configuration file
sudo nginx -t -c /etc/nginx/sites-available/your-domain.com

# View access logs (real-time)
sudo tail -f /var/log/nginx/access.log

# View error logs (real-time)
sudo tail -f /var/log/nginx/error.log

# View logs for specific domain
sudo tail -f /var/log/nginx/your-domain.com.access.log
sudo tail -f /var/log/nginx/your-domain.com.error.log

Let's Encrypt with Certbot

Install and configure free SSL certificates:

sudo apt install certbot python3-certbot-nginx

sudo certbot --nginx -d example.com -d www.example.com

sudo crontab -e
# Add: 0 12 * * * /usr/bin/certbot renew --quiet

SSL Server Block

Example SSL configuration:

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;
    
    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

Security Headers

Add security headers to protect against common attacks:

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Rate Limiting

Implement rate limiting to prevent abuse:

limit_req_zone $binary_remote_addr zone=api:10m rate=10r/m;
limit_req_zone $binary_remote_addr zone=login:10m rate=1r/m;

location /api/ {
    limit_req zone=api burst=20 nodelay;
    proxy_pass http://backend;
}

location /login {
    limit_req zone=login burst=5 nodelay;
    proxy_pass http://backend;
}

Hide Server Information

Hide Nginx version and server information:

server_tokens off;

Gzip Compression

Enable gzip compression for better performance:

gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_proxied expired no-cache no-store private auth;
gzip_types
    text/plain
    text/css
    text/xml
    text/javascript
    application/x-javascript
    application/xml+rss
    application/javascript
    application/json;

Caching

Set up proxy caching for improved performance:

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g 
                 inactive=60m use_temp_path=off;

location / {
    proxy_cache my_cache;
    proxy_pass http://backend;
    proxy_set_header Host $host;
    proxy_cache_bypass $http_pragma;
    proxy_cache_revalidate on;
    proxy_cache_min_uses 1;
    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
    proxy_cache_lock on;
    add_header X-Cache-Status $upstream_cache_status;
}

Worker Configuration

Optimize worker processes and connections:

worker_processes auto;
worker_connections 1024;
worker_rlimit_nofile 2048;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

Common Issues

Useful Commands

sudo nginx -t

sudo systemctl reload nginx

sudo systemctl status nginx

tail -f /var/log/nginx/access.log

tail -f /var/log/nginx/error.log

sudo netstat -tulpn | grep :80