1

I'm starting with Nginx.

I installed on my server:

  • 1 Drupal site on www.example.com
  • 1 GoAccess site on analytics.example.com
  • 1 Netdata site on monitoring.example.com

The IP address and example.com must redirect to www.example.com

All domain and subdomain dovent redirect to https

On my OVH web host, I created domains example.com www.example.com analytics.example.com monitoring.example.com pointing to the IP address of my server.

When I enter the IP address of my server in the browser's address bar, it redirects to analytics.example.com why ?

How to redirect to www.example.com ?

Before creating the configuration for analytics.example.com and monitoring.example.com it worked.

When I test my configuration :

sudo nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

sudo nano /etc/nginx/sites-available/www-example-com

server {
    listen 443 ssl http2;
    listen [::]:443 ssl ipv6only=on http2;
    server_name www.example.com;
    root /var/www/www-example-com/web;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Download-Options "noopen" always;
    add_header X-Permitted-Cross-Domain-Policies "none" always;
    add_header Content-Security-Policy "default-src https: data: wss: 'unsafe-inline' 'unsafe-eval'; base-uri 'self';" always;

    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/css text/javascript text/xml text/plain text/x-component application/javascript application/json application/xml application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;

    expires 1209600s;

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    location ~* \.(txt|log)$ {
        deny all;
    }

    location ~ \..*/.*\.php$ {
        return 403;
    }

    location ~ ^/sites/.*/private/ {
        return 403;
    }

    location ~ ^/sites/[^/]+/files/.*\.php$ {
        deny all;
    }

    location ~* ^/.well-known/ {
        allow all;
    }

    location ~ (^|/)\. {
        return 403;
    }

    location / {
        try_files $uri /index.php?$query_string;
    }

    location @rewrite {
        rewrite ^/(.*)$ /index.php?q=$1;
    }

    location ~ /vendor/.*\.php$ {
        deny all;
        return 404;
    }

    location ~ '\.php$|^/update.php' {
        expires off;
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        include fastcgi_params;
        fastcgi_param HTTP_PROXY "";
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_intercept_errors on;
        fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
    }

    location ~ ^/sites/.*/files/styles/ {
        try_files $uri @rewrite;
    }

    location ~ ^(/[a-z\-]+)?/system/files/ {
        try_files $uri /index.php?$query_string;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
        try_files $uri @rewrite;
        expires max;
        log_not_found off;
    }
}

server {
    listen 80;
    server_name www.example.com example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443;
    server_name example.com;
    return 301 https://www.$server_name$request_uri;
}

https://goaccess.io/faq

sudo nano /etc/nginx/sites-available/analytics-example-com

server {
    listen 443 ssl http2;
    server_name analytics.example.com;
    root /var/www/analytics-example-com/web;
    report.html;

    auth_basic "Protected";
    auth_basic_user_file /var/www/analytics-example-com/web/.htpasswd;

    ssl_certificate /etc/letsencrypt/live/analytics.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/analytics.example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

server {
    listen 80;
    server_name analytics.example.com;
    return 301 https://$server_name$request_uri;
}

https://jesuisadmin.fr/netdata-solution-monitoring-legere-serveur-linux/

sudo nano /etc/nginx/sites-available/monitoring-example-com

upstream backend {
    server 127.0.0.1:19999;
    keepalive 64;
}

server {
    listen 443 ssl http2;
    server_name monitoring.example.com;
    root /var/www/monitoring-example-com/web;

    auth_basic "Protected";
    auth_basic_user_file /var/www/monitoring-example-com/web/.htpasswd;

    ssl_certificate /etc/letsencrypt/live/monitoring.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/monitoring.example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://backend;
        proxy_http_version 1.1;
        proxy_pass_request_headers on;
        proxy_set_header Connection "keep-alive";
        proxy_store off;
    }
}

server {
    listen 80;
    server_name monitoring.example.com;
    return 301 https://$server_name$request_uri;
}
3
  • You need to use the Nginx default_server directive.
    – Tim
    Mar 5, 2019 at 19:12
  • @Tim Thank you, where should this code be placed? listen to 80, listen to 443 or 2. On IPv4 or IPv6 or 2. Can you take my code for www.domain.com and make an answer? thank you
    – ML19
    Mar 5, 2019 at 19:38
  • Sure, done. You will probably need to keep enhancing your understanding of Nginx if you're going to run production web servers.
    – Tim
    Mar 5, 2019 at 19:52

1 Answer 1

3

You need to use the default_server directive. I think you need it on one http and one https block.

server {
  listen 443 ssl http2;
  listen [::]:443 ssl ipv6only=on http2;
  server_name www.domaine.com default_server;
  root /var/www/www-domaine-com/web;
  // etc
}

server {
  listen 80;
  server_name www.domaine.com default_server;
  root /var/www/www-domaine-com/web;
  // etc
}

On my servers I reject all requests to the IP without a domain, I don't see any value in serving those requests.

server {
  listen      80 default_server;
  server_name _; # Wildcard, any domain is served
  return      444; # This means "go away", effectively
  access_log off; log_not_found off;
}

Since SSL/TLS requires a valid certificate for the domain name I don't think it's possible to do this with https.

0

Not the answer you're looking for? Browse other questions tagged .