Hot answers tagged

33

The difference between mainline and stable is explained here: https://www.nginx.com/blog/nginx-1-6-1-7-released/ A graphical summary: Among other differences: Note that stable does not mean more reliable or more bug-free. In fact, the mainline is generally regarded as more reliable because we port all bug fixes to it, and not just critical fixes ...


24

You can also do the following: server { listen 80; listen 8000; server_name example.org; root /var/www/; }


19

Simple location prefix matching works for this without using a rewrite rule as long as you specify a URI in the proxy_pass directive: location /foo { proxy_pass http://localhost:3200/; } Notice the additional / at the end of the proxy_pass directive. NGINX will strip the matched prefix /foo and pass the remainder to the backend server at the URI /. ...


18

I've just run into the same problem, but I think I know why it happens. nginx 1.9.6 is not a stock package on Ubuntu 14.04, so you're probably getting it from an nginx PPA. That's fine, but those packages are built with the stock libraries from 14.04, which is to say OpenSSL 1.0.1f. Unfortunately that version of OpenSSL does not contain RFC7301 ALPN support ...


12

You can verify that nginx was built with OpenSSL by running nginx -V. [root@saurok ~]# nginx -V nginx version: nginx/1.8.0 built by gcc 5.1.1 20150618 (Red Hat 5.1.1-4) (GCC) built with OpenSSL 1.0.1k-fips 8 Jan 2015 TLS SNI support enabled ... You can verify that OpenSSL uses Intel AES-NI by running OpenSSL's internal benchmarks. Compare the output of ...


11

Your INPUT rule allows traffic with source port 80 - but traffic coming into a web server is for destination port 80. You are, in essence, allowing only INPUT traffic from other webservers. Change --sport to --dport in your rule, and all should be better. The same point applies to nearly all your other rules, by the way.


11

Order matters in iptables, rules are traversed sequentially. REJECT all -- anywhere anywhere reject-with icmp-host-prohibited ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https After rejecting everything the subsequent rule opening port 443 for HTTPS will never be reached and have no effect. Your general reject ...


8

A more up-to-date answer: # # Wide-open CORS config for nginx # location / { if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Origin' '*'; # # Om nom nom cookies # add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; ...


8

Doing this with Lua is substantially easier than it sounds: server { set_by_lua $server_name 'return os.getenv("NGINX_SERVERNAME")'; } I found that here: https://docs.apitools.com/blog/2014/07/02/using-environment-variables-in-nginx-conf.html Edit: Apparently this requires installing the lua module: https://github.com/openresty/lua-nginx-module


8

You can use AWS API Gateway (documemtation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


8

Time passes and it seems that now letsencrypt-auto certonly --standalone now works as expected The README.rst supplied as part of the git repo you reference in your question has this to say nginx/0.8.48+ (highly experimental, not included in letsencrypt-auto) Erm ... that's it. Iain's reading manuals as a service (RMAAS) at your erm ... ...


7

It looks like a spambot trying to send an invalid request, or possibly to see if your server is misconfigured to allow proxying. Do you have to worry? I find it a bit strange that a 302 status code is returned, as in 302 Found, I would expect such request to generate a 404 Not Found, or maybe 400 Bad Request or 403 Forbidden, but, in general, these kinds ...


7

Benchmarks are lies, don't reflect the reality but might be a useful tool to detect bottlenecks. But you have to understand the benchmarks. Given that you omit essential details needed to understand the benchmark results it might be that you don't really understand what might affect the results of the benchmark. Especially information about the size of the ...


7

Disclaimer: The same advice applies to all services pushing more than 10Gbps. Included but not limited to load balancers, caching servers, webservers (HAProxy, Varnish, nginx, tomcat, ...) What you want to do is wrong, don't do it Use a CDN instead CDN are meant to deliver cachable static content. Use the right tool for the job (akamai, MaxCDN, cloudflare,...


6

Foreword Update in 2016. Things are evolving, all servers are getting better, they all support SSL and the web is more amazing than ever. Unless stated, the following is targeted toward professionals in business and start-ups, supporting thousands to millions of users. These tools and architectures require a lot of users/hardware/money. You can try this ...


6

In Ubuntu 14.04 the file to change user and group in PHP-FPM is: /etc/php5/fpm/pool.d/www.conf. In this file change these parameters: user = www group = www listen.owner = www listen.group = www


6

Just to improve on the above answer, which is correct. The following works great: location /elb-status { access_log off; return 200 'A-OK!'; # because default content-type is application/octet-stream, # browser will offer to "save the file"... # the next line allows you to see it in the browser so you can test add_header Content-...


6

What you want is called virtual hosting. And it works much better than what you described! Just add multiple server blocks with different server_name and root directories. One server block per domain name. Note that only one of them can be marked as default_server but apart from that all blocks can look identical. The best way to do this is by creating one ...


6

Output from Chrome's Warning Page This server could not prove that it is www.example.com; its security certificate is from example.com. This may be caused by a misconfiguration or an attacker intercepting your connection. The certificate has been issued to the top level domain, example.com, but not the the subdomain www.exmample.com. If the ssl issuer ...


6

Well, here goes my answer, according to the comments: In my opinion, there aren't that many ways to solve this as of today, 2016/05/09. Basically you've to try somehow to get a modern nginx into your system, compiled against >= openssl 1.0.2~. The only two options I see currently: Either you compile for yourself, which you don't want to do, which is ...


6

Someone else will probably think of something complicated involving if but I think I have a very simple solution for this. Your application caches files using the URL path, without query arguments, as the filename. If the requested URL has a query string, you don't want to use the cache. nginx has a variable $is_args which is empty if there is no query ...


6

The only method I could see of doing this would be to use Lua within Nginx to perform the scan, this would however block the Nginx worker which means that it would not be serving content. I would strongly suggest performing the check within your application rather than at the web service level. If you come up with a way to perform the scanning without ...


6

You have somehow managed to install nginx and the yum repository (provided by nginx.org) you have installed along with it is not compatible with Amazon Linux. It is intended for RHEL 7 or CentOS 7. Amazon Linux is not compatible with RHEL/CentOS, and packages for these often do not work on Amazon Linux. To resolve the problem, launch a new instance with a ...


5

It's not always that the SCRIPT_FILENAME is wrong. It may also be PHP is running as the wrong user/group. This example is specific to Mac OS X, which in my experience is the most troublesome to setup (Debian is easy by comparison) - I've just upgraded from PHP 5.6 to 7.0, using homebrew and the excellent josegonzalez packages. The problem was that a new ...


5

From official Nginx docker file: Using environment variables in nginx configuration: Out-of-the-box, Nginx doesn't support using environment variables inside most configuration blocks. But envsubst may be used as a workaround if you need to generate your nginx configuration dynamically before nginx starts. Here is an example using ...


5

Your add_header Strict-Transport-Security ... in server block removes add_headers from upper level. proxy_redirect is superfluous. You just used default value, and moreover if you happen to change proxy_pass and forget to change proxy_redirect you'll get strange errors. proxy_set_header X-Frame-Options is meaningless. proxy_set_header X-Forwarded-Ssl on ...


5

You can achieve this easily using server blocks in Nginx to create multiple 'virtual hosts', each with a different HTTP configuration. This works by Nginx processing your request differently depending on which URL you used to reach the server. Put simply, to reach siteone.com you need to create a server block with a server_name value of siteone.com. Each ...


5

There is a built in traffic shaper in linux kernel. You can implement it by tc directive. In your case I'd reccomend this: 1) Create a root directive # tc qdisc add dev eth0 handle ffff: ingress 2) Create a directive tree both both traffic classes (256k for http and 64k for ftp) #tc filter add dev eth0 parent ffff: protocol ip prio 50 \ u32 ...


5

Damn it. I needed to point to the mainline repo, instead of the stable one. I updated nginx.repo to the following: # nginx.repo [nginx] name=nginx repo baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/ gpgcheck=0 enabled=1 I now have nginx 1.9.5 :)


5

If you get the error message Failed to start nginx.service: Unit nginx.service failed to load: No such file or directory. systemd has not found a unit file. Obviously installation from source did not provide a unit file. You need to create a unit file for nginx like this. [Unit] Description=The NGINX HTTP and reverse proxy server After=syslog.target ...



Only top voted, non community-wiki answers of a minimum length are eligible