Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to share configuration directives across two nginx server {} blocks? I'd like to avoid duplicating the rules, as my site's HTTPS and HTTP content are served with the exact same config.

Currently, it's like this:

server {
  listen 80;
  ...
}

server {
  listen 443;

  ssl on; # etc.
  ...
}

Can I do something along the lines of:

server {
  listen 80, 443;
  ...

  if(port == 443) {
    ssl on; #etc
  }
}
share|improve this question

5 Answers 5

up vote 86 down vote accepted

You can combine this into one server block like so:

server {
    listen 80;
    listen 443 default_server ssl;

    # other directives
}

Official How-To

share|improve this answer
2  
Ah, I had no idea nginx was intelligent enough to ignore the SSL directives if loaded over port 80. Awesome! –  ceejayoz May 21 '09 at 19:34
36  
nginx is all sorts of WIN. –  Jauder Ho May 21 '09 at 19:38
4  
and if you have several sites at one server, it's worth mentioning that "default" is not obligatory –  how Jul 1 '11 at 15:32
1  
So elegant it hurts... –  Alix Axel Nov 24 '12 at 1:39
1  
I believe this works best "listen 443 default ssl;" not "listen 443 default_server ssl;" } –  Andres Mar 31 '13 at 7:52

To clarify the accepted answer, you need to omit

SSL on;

and you just need the following for nginx version after 0.8.21

listen 443 ssl;

Reference:

Nginx Docs - Configuring A single HTTP/HTTPS server

share|improve this answer
1  
Thanks for the follow-up and the reference link. –  Alix Axel Nov 24 '12 at 1:45
    
Thank you! I could not figure out why nothing on http was working. Removing SSL on; worked. –  Chris Cummings Feb 14 at 16:27

I don't know of a way like you suggest, but there's certainly an easy and maintainable way:

server {
    listen 80;
    include serverFoo.conf;
}
server {
    listen 443;
    ssl on;
    include serverFoo.conf;
}
share|improve this answer
2  
+1 = works for me. (Couldn't get it to work with the other method.) –  lackey Jul 3 '09 at 15:44
    
Also, the other example doesn't account for 'proxy_pass' if acting as a load balancer. –  Mike Purcell Apr 24 '13 at 23:34
    
This option is great if your server_name is different for each port –  iDev247 Oct 3 '13 at 6:40

Expanding on the already helpful answers, here is a more complete example:

server {

    # Listen on port 80 and 443
    # on both IPv4 and IPv6
    listen 80;
    listen [::]:80 ipv6only=on;
    listen 443 ssl;
    listen [::]:443 ipv6only=on ssl;

    # Set website folder
    root /path/to/your/website;

    # Enable SSL
    ssl_certificate your-cert.pem;
    ssl_certificate_key your-cert.key;
    ssl_session_timeout 5m;
    ssl_protocols SSLv3 TLSv1;
    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
    ssl_prefer_server_ciphers on;
}
share|improve this answer

Just to add to Igor/Jauder's post, if you're listening to a specific IP you can use:

listen xxx.xxx.xxx.xxx;
listen xxx.xxx.xxx.xxx:443 default ssl;
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.