46
votes

What best practices do you use while using NGinx?

2
  • Just a note that this does not work for a Magento setup. Still investigating the reasons but I think it has something to do with the query string.
    – Jauder Ho
    Jun 4, 2009 at 8:26
  • location /wordpress must be useful when you have wordpress in subdirectory named "wordpress". What about when we have wordpress in web root "/"?
    – rahul286
    Dec 10, 2009 at 12:24

15 Answers 15

21
votes

How to combine HTTP and HTTPS blocks.

server {
    listen 80;
    listen 443 default ssl;

    # other directives
}

This was posted as an answer to a different question. See here.

21
votes

By far, the best tips I have ever seen are from the author on it's pitfall page: https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/

15
votes

Generally, using "if" is a bad practice (according to author of nginx). if possible, better to use try_file of error_page directives instead "if (-f ...)"

Combining tip with maintenence.html file and tip with try_files we get:

location / {
    try_files /maintenance.html $uri $uri/ @wordpress;
}

When maintenance ends, just mv maintenance.html from $root.

1
  • 16
    This is not ideal as /maintenance.html will be served as a 200 response. You probably want search engines to recognize that the maintenance page is not your actual website. You would probably want to return a 503 (Service Temporarily Unavailable). The only way I can figure out how to do this is with an if (-f ...) { return 503; } and error_page 503 /maintenance.html. What do you think? Jun 2, 2011 at 14:08
11
votes

Configure nginx to use stronger SSL ciphers. By default, SSLv2 is enabled (which you should disable if possible).

ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5;

http://tumblelog.jauderho.com/post/121851623/nginx-and-stronger-ssl

8
votes

Its often more efficient to use the map directive in place of regular expressions when switching the root for matching subdomains:

server {

    server_name mysite.tld ~^.+\.mysite\.tld$;

    map $host $files {
        default            common;
        mysite.tld         common;
        www.mysite.tld     common;
        admin.mysite.tld   admin;
        system.mysite.tld  system;
        *.mysite.tld       users;
    }

    root /var/www/mysite/$files;

}
1
  • 5
    you do know that you can do server_name mysite.tld *.mysite.tld
    – Unknown
    Jun 5, 2009 at 8:58
8
votes

The empty_gif module is also very useful, especially if you need monitor responses from the webserver (using nagios/monit/etc):

location /token {
    empty_gif;
}

location /favicon.ico {
    empty_gif;
}

location /img/1px.gif {
    empty_gif;
} 
3
  • 1
    Can you provide a real world example for this? I still don't fully understand how it's useful. Jun 5, 2009 at 16:22
  • 1
    @ The Pixel Developer, its only really useful for speed. Nginx keeps the data for an empty gif in memory so it never has to load from disk.
    – Unknown
    Jun 12, 2009 at 2:34
  • 5
    also access_log off; for those locations is common practice Nov 6, 2009 at 8:24
6
votes

We set up Nginx with Chef, using this cookbook which contains scripts for handling nginx configuration similar to how Debian does Apache2, and also some sample templates with sane defaults.

0
5
votes

Here's a good method for returning a maintenance page. All requests are rewritten and the correct http code is returned. (503 - Service unavailable)

error_page 503 /maintenance.html;

location /
{
    if (-f $document_root/maintenance.html)
    {
        return 503;
    }

    try_files $uri /index.php?$args;
}

location = /maintenance.html
{
    rewrite ^ /maintenance.html break;
}
2
  • 1
    Actually, I disagree -- I added a comment to serverfault.com/questions/18994/nginx-best-practices/…. Basically, you want to return a 503 error or else bots and indexers will think your maintenance page is part of your actual site... There's nothing wrong with an if statement if you use it correctly -- the docs say that ifs are safe if you're just doing return xxx;. Jun 2, 2011 at 14:10
  • Also, is location = /maintenance.html { break; } necessary? Jun 2, 2011 at 14:12
4
votes

From nginx 0.7.12 and later, a "" is usable in server_name to catch requests without a "Host" header.

You can use the following as a catchall for undefined virtual hosts.

server {
  server_name _ "";
}
4
  • Does your exemple work only for requests with an undefined vhost or will it also work with requests with an unknown (wrong) vhost?
    – Benoit
    Jun 4, 2009 at 8:26
  • @Benoit it works for anything that is not defined.
    – Unknown
    Jun 8, 2009 at 0:49
  • Is " server_name _ * " is not supported nginx 0.7 onwards?
    – rahul286
    Dec 10, 2009 at 12:19
  • 1
    Please note this is only partially true. "" will catch a MISSING Host header, but it will not be catch a request with a Host header that doesn't match anything. If you want a catch-all server block then see the default_server flag under the listen directive. Apr 9, 2011 at 23:48
3
votes

I also posted a while ago about how to properly handle gzip compression with nginx as older browsers may have issues with just a blanket gzip statement. HTH.

http://tumblelog.jauderho.com/post/27655495/gzip-compression-with-nginx

3
votes

I don't know if it is a best practice, but definitely a neat hack to get nested conditions in nginx. Here's a sample from the nginx wiki.

location /xxxx/ {
  set $test "";

  if ($request_method = POST) {
    set $test  P;
  }

  if ($http_cookie ~* "CCCC=.+(?:;|$)" ) {
    set $test  "${test}C";
  }

  if ($test = PC) {
    #rewrite rule goes here.
  } 
}
1
  • 3
    I'd put that in the category of "ugly but occasionally necessary practice" -- certainly not something to be encouraged.
    – womble
    Jul 30, 2011 at 2:56
2
votes

If you need to flip contextually between http and https for subdomains handled by the same server block, you can use variables to do so. Might not be the most efficient way to do things, but it works:

server {
  server mysite.tld ~^.+\.mysite\.tld$;

  set $req_ssl = 0;

  map $host $files {
      default            common;
      mysite.tld         common;
      www.mysite.tld     common;
      admin.mysite.tld   admin;
      system.mysite.tld  system;
      *.mysite.tld       users;
  }

  root /var/www/mysite/$files;

  if ( $files = "admin" ){
    set $req_ssl 1;
  }

  if ( $files = "common" ){
    set $req_ssl 2;
  }

  if ( $scheme = http )
  {
    set $req_ssl $req_ssl.1;
  }

  if ( $scheme = https )
  {
    set $req_ssl $req_ssl.2;
  }

  if ($req_ssl = 1.1){
    rewrite ^ https://$host$uri;
  }

  if ($req_ssl = 2.2){
    rewrite ^ http://$host$uri;
  }

}
2
votes

I always try to use the root directive in the top of the server block so I can take advantage of the $document_root variable and never, but never, include the root directive inside a location block.

The Pitfalls Page from the Nginx wiki has some great tips about best practices.

1
vote

If you are using nginx as a proxy, having the timeout settings adjusted can be important to ensure you are not having nginx drop connections before your application is done with them, especially if you are dealing with a high traffic application:

proxy_connect_timeout
proxy_send_timeout
0
votes

Did you take a look over here?

http://www.directadmin.com/forum/showthread.php?p=137288

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .