nginx

1. Description

Some nginx configuration examples.

2. Basic authentication

https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html

The auth_* directives can be added to different contexts, e.g. the server context.

server {
    # ..

    auth_basic "NOT ALLOWED";
    auth_basic_user_file /etc/nginx/.htpasswd;

    # ..
}

The file content of auth_basic_user_file is 1 user per line (USERNAME:HASHED_PASSWORD):

alan:$apr1$2c4myb0h$UTSfR845eEanPaMXoufcX.

Compute the hash of the password with one of these commands:

# the -c flag will create or truncate the file
htpasswd -c /etc/nginx/.htpasswd alan

# OR ..

# don't leave the password in the shell history
 echo "alan:$(openssl passwd -apr1 '<PASSWORD>')" | sudo tee /etc/nginx/.htpasswd

3. Headers

# /etc/nginx/conf.d/00-headers.conf

# https://developer.mozilla.org/en-US/observatory/
# https://nginx.org/en/docs/http/ngx_http_headers_module.html
# https://owasp.org/www-project-secure-headers/index.html
# https://nginx.org/en/docs/dirindex.html
# https://www.ssllabs.com/ssltest/

add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self' https://www.example.net; frame-src 'self' https://www.youtube-nocookie.com; object-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' https:; font-src 'self'; connect-src 'self'; form-action 'self'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-Content-Type-Options "nosniff" always;

# proxy_hide_header X-Powered-By;
# fastcgi_hide_header X-Powered-By;

4. State site

# /etc/nginx/sites-available/www.example.net.conf

server {
    listen 443 ssl; # managed by Certbot
    listen [::]:443 ssl; # managed by Certbot

    server_name www.example.net;

    root /srv/www.example.net;
    index index.html;

    include /etc/nginx/conf.d/00-headers.conf;

    ssl_certificate /etc/letsencrypt/live/www.example.net/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.example.net/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    listen 80;
    listen [::]:80;

    server_name www.example.net;

    location ^~ /.well-known/acme-challenge/ {
        root /var/lib/letsencrypt/;
        try_files $uri =404;
    }

    location / {
        return 301 https://www.example.net$request_uri;
    }
}

5. Reverse proxy

See #static-site-example for port 80 server configuration block.

# /etc/nginx/sites-available/www.example.net.conf

server {
    listen 443 ssl; # managed by Certbot
    listen [::]:443 ssl; # managed by Certbot

    server_name www.example.net;

    include /etc/nginx/conf.d/00-headers.conf;

    client_max_body_size 1G;

    location / {
        proxy_pass http://localhost:5280;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        tcp_nodelay on;

        proxy_hide_header X-Powered-By;
    }

    ssl_certificate /etc/letsencrypt/live/www.example.net/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.example.net/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

6. Default server

# /etc/nginx/sites-available/default-server.conf

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    server_name _;

    return 444;
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;

    server_name _;

    ssl_certificate /etc/letsencrypt/live/example.net/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.net/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    return 444;
}