Hot answers tagged

31

The difference between mainline and stable is explained here: https://www.nginx.com/blog/nginx-1-6-1-7-released/ A graphical summary: Among other differences: Note that stable does not mean more reliable or more bug-free. In fact, the mainline is generally regarded as more reliable because we port all bug fixes to it, and not just critical fixes ...


23

IPv6/IPv4 preference is determined by the initiator of a connection, i.e. the web browser. The address selection rules are defined in RFC 6724. While these can be overridden, it is only by the user reconfiguring their operating system. The only way you can force someone to use IPv4 is to not offer IPv6 at all. Obviously this is not a practical solution even ...


20

You can also do the following: server { listen 80; listen 8000; server_name example.org; root /var/www/; }


17

Simple location prefix matching works for this without using a rewrite rule as long as you specify a URI in the proxy_pass directive: location /foo { proxy_pass http://localhost:3200/; } Notice the additional / at the end of the proxy_pass directive. NGINX will strip the matched prefix /foo and pass the remainder to the backend server at the URI /. ...


14

I've just run into the same problem, but I think I know why it happens. nginx 1.9.6 is not a stock package on Ubuntu 14.04, so you're probably getting it from an nginx PPA. That's fine, but those packages are built with the stock libraries from 14.04, which is to say OpenSSL 1.0.1f. Unfortunately that version of OpenSSL does not contain RFC7301 ALPN support ...


13

Such preferences can be expressed using SRV records. Unfortunately those are not supported for HTTP. So you are left with a situation where the client alone is making the choice between IPv4 and IPv6. Many clients use the roundtrip time of SYN + SYN-ACK to decide which of the two to use. So by slowing down the sending of a SYN-ACK packet on IPv6, you can ...


13

You should almost always use $host, as it's the only one guaranteed to have something sensible regardless of how the user-agent behaves, unless you specifically need the semantics of one of the other variables. The difference is explained in the nginx documentation: $host contains "in this order of precedence: host name from the request line, or host name ...


12

You can verify that nginx was built with OpenSSL by running nginx -V. [root@saurok ~]# nginx -V nginx version: nginx/1.8.0 built by gcc 5.1.1 20150618 (Red Hat 5.1.1-4) (GCC) built with OpenSSL 1.0.1k-fips 8 Jan 2015 TLS SNI support enabled ... You can verify that OpenSSL uses Intel AES-NI by running OpenSSL's internal benchmarks. Compare the output of ...


11

Your INPUT rule allows traffic with source port 80 - but traffic coming into a web server is for destination port 80. You are, in essence, allowing only INPUT traffic from other webservers. Change --sport to --dport in your rule, and all should be better. The same point applies to nearly all your other rules, by the way.


11

Order matters in iptables, rules are traversed sequentially. REJECT all -- anywhere anywhere reject-with icmp-host-prohibited ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https After rejecting everything the subsequent rule opening port 443 for HTTPS will never be reached and have no effect. Your general reject ...


8

A more up-to-date answer: # # Wide-open CORS config for nginx # location / { if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Origin' '*'; # # Om nom nom cookies # add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; ...


8

Time passes and it seems that now letsencrypt-auto certonly --standalone now works as expected The README.rst supplied as part of the git repo you reference in your question has this to say nginx/0.8.48+ (highly experimental, not included in letsencrypt-auto) Erm ... that's it. Iain's reading manuals as a service (RMAAS) at your erm ... ...


7

It looks like a spambot trying to send an invalid request, or possibly to see if your server is misconfigured to allow proxying. Do you have to worry? I find it a bit strange that a 302 status code is returned, as in 302 Found, I would expect such request to generate a 404 Not Found, or maybe 400 Bad Request or 403 Forbidden, but, in general, these kinds ...


7

Benchmarks are lies, don't reflect the reality but might be a useful tool to detect bottlenecks. But you have to understand the benchmarks. Given that you omit essential details needed to understand the benchmark results it might be that you don't really understand what might affect the results of the benchmark. Especially information about the size of the ...


6

Foreword Update in 2016. Things are evolving, all servers are getting better, they all support SSL and the web is more amazing than ever. Unless stated, the following is targeted toward professionals in business and start-ups, supporting thousands to millions of users. These tools and architectures require a lot of users/hardware/money. You can try this ...


6

In Ubuntu 14.04 the file to change user and group in PHP-FPM is: /etc/php5/fpm/pool.d/www.conf. In this file change these parameters: user = www group = www listen.owner = www listen.group = www


6

Doing this with Lua is substantially easier than it sounds: server { set_by_lua $server_name 'return os.getenv("NGINX_SERVERNAME")'; } I found that here: https://docs.apitools.com/blog/2014/07/02/using-environment-variables-in-nginx-conf.html Edit: Apparently this requires installing the lua module: https://github.com/openresty/lua-nginx-module


6

I had a problem with restarting so I just killed the process and started it manually. sudo pkill php5-fpm sudo service php5-fpm start


6

Using round robin DNS is not that great for high availability - if one server goes offline, clients will still try to connect to it and wait for a timeout. There are other ways to achieve this. 1) Active/Passive load balancers Basically one load balancer handles all traffic for one IP address. If that balancer goes down, the passive node jumps in and ...


6

High Availability with load balancers is commonly implemented using a virtual ip address (VIP) protocol which allows several hosts (i.e. load balancers) to answer to one common ip address in one of several possible ways (variations on active/passive, active/active). There are a good number of these protocols, the ones I have seen most with regular load ...


6

You can use AWS API Gateway (documemtation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


6

What you want is called virtual hosting. And it works much better than what you described! Just add multiple server blocks with different server_name and root directories. One server block per domain name. Note that only one of them can be marked as default_server but apart from that all blocks can look identical. The best way to do this is by creating one ...


6

Output from Chrome's Warning Page This server could not prove that it is www.example.com; its security certificate is from example.com. This may be caused by a misconfiguration or an attacker intercepting your connection. The certificate has been issued to the top level domain, example.com, but not the the subdomain www.exmample.com. If the ssl issuer ...


5

Just to improve on the above answer, which is correct. The following works great: location /elb-status { access_log off; return 200 'A-OK!'; # because default content-type is application/octet-stream, # browser will offer to "save the file"... # the next line allows you to see it in the browser so you can test add_header Content-...


5

Your add_header Strict-Transport-Security ... in server block removes add_headers from upper level. proxy_redirect is superfluous. You just used default value, and moreover if you happen to change proxy_pass and forget to change proxy_redirect you'll get strange errors. proxy_set_header X-Frame-Options is meaningless. proxy_set_header X-Forwarded-Ssl on ...


5

You can achieve this easily using server blocks in Nginx to create multiple 'virtual hosts', each with a different HTTP configuration. This works by Nginx processing your request differently depending on which URL you used to reach the server. Put simply, to reach siteone.com you need to create a server block with a server_name value of siteone.com. Each ...


5

There is a built in traffic shaper in linux kernel. You can implement it by tc directive. In your case I'd reccomend this: 1) Create a root directive # tc qdisc add dev eth0 handle ffff: ingress 2) Create a directive tree both both traffic classes (256k for http and 64k for ftp) #tc filter add dev eth0 parent ffff: protocol ip prio 50 \ u32 ...


5

Damn it. I needed to point to the mainline repo, instead of the stable one. I updated nginx.repo to the following: # nginx.repo [nginx] name=nginx repo baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/ gpgcheck=0 enabled=1 I now have nginx 1.9.5 :)


5

If you get the error message Failed to start nginx.service: Unit nginx.service failed to load: No such file or directory. systemd has not found a unit file. Obviously installation from source did not provide a unit file. You need to create a unit file for nginx like this. [Unit] Description=The NGINX HTTP and reverse proxy server After=syslog.target ...


5

From nginx documentation: In this configuration nginx tests only the request’s header field “Host” to determine which server the request should be routed to. If its value does not match any server name, or the request does not contain this header field at all, then nginx will route the request to the default server for this port. In the configuration ...



Only top voted, non community-wiki answers of a minimum length are eligible