New answers tagged

1

In general there is absolutely no security benefit to encrypting traffic between services running on the same host. (Localhost traffic can only be intercepted by an attacker that has full access to the server. When they can do that they can already access all data stored on your server directly (from the file system) and won't need to bother with ...


0

Why don't you just reuse $server_name? This variable is set to the first server_name defined in the server block. Just make sure the first defined name is the one you want (and it probably already is).


1

This approach should work: location ~ ^/user-content/img/([0-9A-F]{2})([0-9A-F]{2})([0-9A-F]{2})(.*)$ { root /srv/foo/bar/uploads; try_files /$1/$2/$3/$1$2$3$4 =404; autoindex off; access_log off; expires 30d; } In the location line, we capture parts of the filename to four different variables using regular expressions, first three parts ...


1

You can try (not tested) location /user-content/img/ { rewrite ^/user-content/img/(\w{2})(\w{2})(\w{2})(.*) /$1/$2/$3/$4 break; root /srv/foo/bar/uploads; autoindex off; access_log off; expires 30d; }


0

You can use variables declared via map as described in this SO question, which discusses using custom variables in the expression part of location blocks: https://stackoverflow.com/a/61513351/1604622


0

Try to modify it like this: location /service-1/ { proxy_pass http://127.0.0.1:8080/; }


0

Edit & edit this under http{ in nginx.conf on VPS1 server{ server_name antiD; listen [PORT1]; ssl_preread on; location/{ proxy_pass https://[IP2]:[PORT2]; } } before you test and reload nginx on it. if it is not https, delete ssl_preread line.


0

In the server block for crm.domain.com, you should leave both lines uncommented listen 80; listen 443 ssl; in order for the Nginx server, for this server_name (crm.domain.com), to listen on both ports. Hope this helps.


0

Although I think that can be achieved with nginx, there are other tools for these specific purposes. I suggest you take a look into some API Gateway tools like Kong, Traefik, and Apigee


0

The issue may be caused by PM2. If you're enabled watching, the app will restart on every single file change(and new uploads too). The solution could be disabling watching completely or adding the uploads folder to ignore list. More: https://pm2.keymetrics.io/docs/usage/watch-and-restart/


0

You can use regex negative lookahead feature (details here): location ~ /\.(?!well-known).* { deny all; } Or use Richard Smith's solution with the second location block.


2

Yes, this is possible. Make your own software listen on local loopback alone, e.g. on localhost:8080. Terminate TLS with NGINX. server { listen 443 ssl; server_name www.example.com; ssl_certificate www.example.com.crt; ssl_certificate_key www.example.com.key; ssl_protocols TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; #... } As a ...


1

Your OS might treat /tmp in a special way, so that every user has its own /tmp directory. Therefore, since nginx runs as www-data or similar user, it cannot see the file you have created using your own account. Please try some directory under /var/www instead.


1

You should be able to transform your hash key using one or more map blocks. Not tested: map $cookie_my_cookie_name $my_hash_key { "" $remote_addr; default $cookie_my_cookie_name; } upstream { hash $my_hash_key consistent; } I do not think what you describe in your question really serves most purposes well, though. As soon as the ...


0

You can exclude 3xx status from being log using map like map $status $log { default 1; ~^[^3] 0; } Then change access_log to : access_log /var/log/nginx/access.log combined if=$log;


1

You should put the site config files in /etc/nginx/sites-enabled. To solve your problem, check if you have a default site config in /etc/nginx/sites-enabled and delete it. Then, move your myapp.conf file to /etc/nginx/sites-enabled and restart nginx.


0

I can't see any relation between the DNS and the Nginx redirection issue. Nevertheless, when you are debugging redirections, try not to use a desktop web browser like Firefox, Chrome, etc. as they use to cache redirections and fool you. It's better to test the redirection using curl: curl -I https://www.yoursite.com If you don't have curl then you'd better ...


0

I just finished chatting with a Namecheap rep. It turned out to be DNS not propagating yet, which I incorrectly ruled out earlier. As you may likely know already, it can take up to 24, even 48 hours. Speaking with someone who had not recently connected to my site allowed me to get things running as they should.


1

i want to disable buffering completely Technically, you shouldn't be doing it in most of the cases. Buffering is required for things like FastCGI caching, and more importantly, allows asynchronously fetching data from upstream, thus keeping your backend (often heavy on RAM usage), free, while slow clients are fetching data. Adjust your buffers instead in ...


0

You could set it up like me server { #redirect all naked domains to https and www if ($host = aihello.com) { return 301 https://www.aihello.com$request_uri; } #redirect all unsecure www to secure www if ($host = www.aihello.com) { return 301 https://www.aihello.com$request_uri; } ...


1

If you want to prevent caching for non-logged users, you should check the value of WordPress login cookie. Then you don't need to set those headers. This configuration could produce the results you are looking for: http { map $http_cookie $cachefiles { default "/cache/$request_uri.html /cache$request_uri/index.html"; "~.*...


0

Thanks to @Nomadic <3 I think this is much simpler and useful access_log /var/log/nginx/access.$status.log;


0

You will need a TLS certificate that includes their domain name. Your options are roughly: You request a TLS certificate for the customer domain: the customer may need to add/update their CAA policy to allow that. add that customer domain to the *.example.com certificate you already have as an “alternate name”. Note that you’re limited to a maximum number ...


0

I'll assume this is about certificates with SSL and that what you actually already have is a wildcard certificate (used by SSL or TLS). Let's also assume that your service is something like an Apache (or nginx based on one of the tags attached to your question) web service. Feel free to clarify this. However as a "New contributor" I cannot ask ...


-1

user460778 answer is the correct one, there can be only entry point for a container, here it should be php-fpm service, So you need to run crons from supervisor. My supervisor file looks like this [supervisord] nodaemon=true [program:php-fpm] command = /usr/local/sbin/php-fpm autostart=true autorestart=true [program:cron] autorestart=false command=cron -f


0

I think the name parameter in shared:name:size needs to be unique per certificate. Multiple server blocks (different domains or subdomains) might or might not share certificates. Therefore, there isn't a one size fits all default value for the name parameter. I would guess they could just default to not sharing the cache between server blocks, but I'm not an ...


0

I don't have enough reputation to comment so I submit it as an answer... You could probably do it with map. In the http block: map $http_x_auth $has_basic_auth { "some_string" no_basic_auth; default with_basic_auth; } In your location block: try_files nonexistent @$has_basic_auth; And then add two named locations: location @no_basic_auth { # ...


0

just need add two parameter proxy_set_header Host "fqdn.local"; and sub_filter "fqdn.local" "fqdn.extern"; It's work for vCenter 7.0 server { listen 443 ssl http2; # ssl_certificate and ssl_certificate_key are required ssl_certificate /etc/letsencrypt/live/myletsencryptdomain/fullchain.pem; ssl_certificate_key /...


0

For nginx you need to use stream and not http. You can add this to your /etc/nginx/nginx.conf stream { map $ssl_preread_server_name $targetBackend { ~^(?<domain>.+).example.com$ 192.168.1.2:443; ~^(?<domain>.+).random.com$ $domain.internal.local:443; } server { listen 443; proxy_pass $targetBackend; ...


0

I was facing the exact problem described here. The following settings made it work. GitLab Docker: GITLAB_OMNIBUS_CONFIG: | external_url 'http://<domain>/gitlab/' [...] ports: - "8929:80" NGINX: location /gitlab/ { # ## https://github.com/gitlabhq/gitlabhq/issues/694 # ## Some requests take more ...


3

You can solve the problem in your option #1 (which, as you said, is a much better approach) by setting the HTTP_X_FORWARDED_PROTO in your nginx config with proxy_set_header X-Forwarded-Proto $scheme; and configuring WordPress to recognize it by appending this line to wp-config.php if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['...


1

Normally I would prefer to do all the heavy lifting on the reverse proxy and keep the backend site that gets exposed as original as possible. Your problem seems to be in essence that the (WordPress) backend generates and uses (absolute) URI’s that differ from what you want visitors to use. You can remedy that by rewriting the (HTML) content that WordPress ...


3

You should be able to tell Apache that the incoming request is being proxied from a HTTPS request with the proxy_set_header X-Forwarded-Proto "https"; declaration in the first setup


3

You might want to try using a location (doc) or $uri (doc) since both match a normalized URI. Since if is evil I would suggest a location (untested): location ~* ^/(?!test|something) { return 404; } Edit: I reread your question and it should BLOCK access to the mentioned locations in the regex. So I added the "not"...


0

below setting worked for me to load the index.php file but for / location I am getting 301 too many redirects. server { listen 80; server_name example.com; location = / { rewrite ^ /index.php permanent; } location / { proxy_pass http://example.com:80; } location /abc { proxy_pass http://...


1

First make your self familiar with what PHP is. Understand that Nginx is only a Webserver and not an php Applicationserver. You probably want something like php-fpm. Then in the Official Nginx Documentation you will find, how to best configure your Webserver


0

This worked for me: # rules server { #general listen 80; # add www. if ($host ~ ^(?!www)) { rewrite ^/(.*)$ http://www.$host/$1 permanent; } # remove subdomain if ($host ~ "^www\.(.*?)\.(.{3,}\.([a-z]{2}\.[a-z]{2}|[a-z]{2,4}))$") { set $host_without_sub $2; rewrite ^/(.*)$ http://www.$...


2

Serving anything other than the files specifically copied to a static folder is not typically what you want for Django-powered applications. The typical setup works like this: everything in /static gets handled by the web server (this is what the location /static {} block is about: the alias points to the directory where the django collectstatic commands ...


0

You need to configure the application that is running at 127.0.0.1:8000 to block these requests. nginx simply passes all requests starting with / to your web application, except for requests starting with /static.


2

By adding the location ~* \.(gif|png|jpe?g)$ block, these URIs are no loger processed by the location / block. See how Nginx processes a request. You will need to make the proxy_xxx statements available to the new block. The proxy_set_header statements can be inherited. For example: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; ...


0

I was able to fix this by putting the proxy_set_header inside the location{} and not the server{} block.


0

By default on Ubuntu 18.04+, certbot should add /etc/cron.d/certbot and run every 12 hours (*/12). If you do not see a file there, you can create your own cronjob by doing sudo crontab -e and adding a simple job that follows the template instructions. You'll need to be sure that cron understands where certbot lives, or use the full path. Generally the full ...


0

I'd run the java in a docker container, then use traefik to serve the main domain and the subdirectory from different containers or hosts. Or you could use haproxy, then you probably would need to bind the java to another port.


1

I suggest you to use subdomain to do this. ex- https://example.example.com


1

None of those "work" because the regex you specified in your location isn't the same as the regex you specified in Apache's .htaccess, and you aren't trying to use matches from it in try_files. For the .htaccess you have posted, something like this should be more appropriate: location ~ ^(.*)/(.*) { try_files $uri $1.php?rewrite=$2&$args =...


0

Alright. I hope this example may be helpful for someone. location ~ ^/cam/([0-9]+)/ { set $port_num $1; proxy_pass http://localhost:$port_num/; } If you are confused about what is happening there (as I was before read the docs), the location uses a regular expression to find anything that start with /cam/ (after the url) and ...


0

May be https://medium.com/building-the-system/gunicorn-3-means-of-concurrency-efbb547674b7 will help try different values for --workers


0

This form was working for me with websockets (without quotes): location /alternate/primus/ { proxy_pass http://servername/primus/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; }


0

You are trying to expose port 8000 on two different containers. Each container where you expose ports must use a unique port number on the host.


0

There are few ways to avoid it: Use static IP, nginx will return 503's if it doesn't respond. Use the resolver directive to point to something that can resolve the host, regardless if it's currently up or not. Use the resolver directive at the location level, if you can't do the above (this will allow Nginx to start): location /some_path { resolver ...


Top 50 recent answers are included