Hot answers tagged

23

IPv6/IPv4 preference is determined by the initiator of a connection, i.e. the web browser. The address selection rules are defined in RFC 6724. While these can be overridden, it is only by the user reconfiguring their operating system. The only way you can force someone to use IPv4 is to not offer IPv6 at all. Obviously this is not a practical solution even ...


16

The difference between mainline and stable is explained here: https://www.nginx.com/blog/nginx-1-6-1-7-released/ A graphical summary: Among other differences: Note that stable does not mean more reliable or more bug-free. In fact, the mainline is generally regarded as more reliable because we port all bug fixes to it, and not just critical fixes ...


16

TL;DR - the fix (which you may not even need) is VERY SIMPLE and at the end of this answer. I'll try to address your specific questions, but your misunderstanding of what PATH_INFO is makes the questions themselves a little bit wrong. First question should be "What is this path info business?" Path info is stuff after the script in a URI (should start ...


14

There are couple of ways to achieve HA of a Load Balancer - or in that regards any service. Lets assume you have two machines, with IP addresses: 192.168.100.101 192.168.100.102 Users connect to an IP, so what you want to do is separate IP from specific box - eg create virtual IP. That IP will be 192.168.100.100. Now, you can choose HA service which ...


13

Such preferences can be expressed using SRV records. Unfortunately those are not supported for HTTP. So you are left with a situation where the client alone is making the choice between IPv4 and IPv6. Many clients use the roundtrip time of SYN + SYN-ACK to decide which of the two to use. So by slowing down the sending of a SYN-ACK packet on IPv6, you can ...


13

I got this working using try_files: location / { try_files "${uri}_${args}" 404.html; } This will try to find a file on disk named after the pattern you provided with a "_" instead of the "?". Further configuration depends on how you saved static files like images or stylesheets. You can add a fallback trying to read them without query string form ...


12

You can verify that nginx was built with OpenSSL by running nginx -V. [root@saurok ~]# nginx -V nginx version: nginx/1.8.0 built by gcc 5.1.1 20150618 (Red Hat 5.1.1-4) (GCC) built with OpenSSL 1.0.1k-fips 8 Jan 2015 TLS SNI support enabled ... You can verify that OpenSSL uses Intel AES-NI by running OpenSSL's internal benchmarks. Compare the output of ...


11

Your INPUT rule allows traffic with source port 80 - but traffic coming into a web server is for destination port 80. You are, in essence, allowing only INPUT traffic from other webservers. Change --sport to --dport in your rule, and all should be better. The same point applies to nearly all your other rules, by the way.


11

You should almost always use $host, as it's the only one guaranteed to have something sensible regardless of how the user-agent behaves, unless you specifically need the semantics of one of the other variables. The difference is explained in the nginx documentation: $host contains "in this order of precedence: host name from the request line, or host name ...


10

If you host multiple vhost domains with a single Nginx instance, you can't use the single combined listen directive listen [::]:80 ipv6only=off; for each of them. Nginx has a weird quirk where you can only specify the ipv6only parameter once for each port, or it will fail to start. That means you can't specify it for each vhost domain server block. As ...


9

DNSSec is all about cryptographically signing DNS responses from a DNS server. NGINX is a web server, not a DNS server. So to answer your question: You don't.


9

You can return a simple string as HTTP response: location / { return 200 $document_root; }


8

Even though this was asked long ago, I was compiling nginx with more module, but with newer version of nginx, I found I don't have to custom compile nginx, all I needed was to add always directive. http://nginx.org/en/docs/http/ngx_http_headers_module.html Syntax: add_header name value [always]; If the always parameter is specified (1.7.5), the header ...


8

I would like to add to the previous answers that the most important is not how you call the directories (though that is a very useful convention), but what you actually put in nginx.conf. Example configuration: http { include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*.conf; include /etc/nginx/sites-enabled/my_own_conf; ... } ...


8

The data in question does NOT need to be secure... prevent warning about mixing secure I think you should probably understand the reason for these warnings instead of just trying to ignore them as best as possible. If content on a secure site is included from a insecure site it might affect the security of the original site. The server takes on ...


8

You must create a default vhost configuration file and include it before of others. For example you can save this default config to /etc/nginx/conf/default.conf: server { listen 80 default_server; return 444; } And include it in nginx.conf: http { .... include "/etc/nginx/conf/default.conf"; include "/etc/nginx/vhosts/*.conf"; } Be sure ...


8

From the source code: http://lxr.nginx.org/ident?_i=ngx_http_set_etag 1803 ngx_int_t 1804 ngx_http_set_etag(ngx_http_request_t *r) 1805 { 1806 ngx_table_elt_t *etag; 1807 ngx_http_core_loc_conf_t *clcf; 1808 1809 clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module); 1810 1811 if (!clcf->etag) { 1812 return ...


7

I was having the same issue. It turned out the the problem was caused by SCRIPT_FILENAME fcgi param. When I added it to virtual host config everything started working: location ~ \.php$ { include fastcgi_params; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/var/run/php5-fpm.sock; fastcgi_index index.php; fastcgi_param ...


7

I would use map: map $http_origin $cors_header { default ""; "~^https?://[^/]+\.example\.com(:[0-9]+)?$" "$http_origin"; } server { ... location / { add_header Access-Control-Allow-Origin $cors_header; try_files $uri $uri/ /index.php; } ... }


7

You can run the following tests: telnet $server_ip 443 this will tell you if there is something listening in that port telnet desktop.just4bettors.mobi 443 Trying xxx.xxx.xx.xxx... Connected to desktop.just4bettors.mobi. Escape character is '^]'. ^] telnet> q Connection closed. openssl s_client -connect $server_ip:443 -showcerts this will actually ...


7

A more up-to-date answer: # # Wide-open CORS config for nginx # location / { if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Origin' '*'; # # Om nom nom cookies # add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; ...


7

A small addition to the great answer from Xaviar: If you happen to be not so well acquainted with nginx, there's an important difference between adding the slash to the end of the the proxy_pass directive. The following does not work: location ~* ^/dir/ { rewrite ^/dir/(.*) /$1 break; proxy_pass http://backend/; but this one does: location ~* ...


7

Time passes and it seems that now letsencrypt-auto certonly --standalone now works as expected The README.rst supplied as part of the git repo you reference in your question has this to say nginx/0.8.48+ (highly experimental, not included in letsencrypt-auto) Erm ... that's it. Iain's reading manuals as a service (RMAAS) at your erm ... ...


6

Benchmarks are lies, don't reflect the reality but might be a useful tool to detect bottlenecks. But you have to understand the benchmarks. Given that you omit essential details needed to understand the benchmark results it might be that you don't really understand what might affect the results of the benchmark. Especially information about the size of the ...


6

The STS response header is only effective on secure schemes. The client must visit the https page at least once to get a STS entry in the HSTS cache. The spec suggests that servers SHOULD redirect to https from HTTP, but that is not always feasible. So you could try to sniff unsupported User-Agent at the back-end, and only issue a redirect if the UA is not ...


6

Simple location prefix matching works for this without using a rewrite rule as long as you specify a URI in the proxy_pass directive: location /foo { proxy_pass http://localhost:3200/; } Notice the additional / at the end of the proxy_pass directive. NGINX will strip the matched prefix /foo and pass the remainder to the backend server at the URI /. ...


6

I don't see that you need a separate location at all. A simple rewrite should do. For instance: server { rewrite /api/lang /server/i18n-angular/$arg_lang.json last;


6

It seems nginx supports rewriting the requests to the proxied server so updating the config to this made it work: location /grafana { proxy_pass http://localhost:3000; rewrite ^/grafana/(.*) /$1 break; proxy_set_header Host $host; } My grafana.ini also has an updated root: [server] root_url = ...


6

Using round robin DNS is not that great for high availability - if one server goes offline, clients will still try to connect to it and wait for a timeout. There are other ways to achieve this. 1) Active/Passive load balancers Basically one load balancer handles all traffic for one IP address. If that balancer goes down, the passive node jumps in and ...


6

High Availability with load balancers is commonly implemented using a virtual ip address (VIP) protocol which allows several hosts (i.e. load balancers) to answer to one common ip address in one of several possible ways (variations on active/passive, active/active). There are a good number of these protocols, the ones I have seen most with regular load ...



Only top voted, non community-wiki answers of a minimum length are eligible