Nginx on Ricky

Selectively Disabling HTTP/1.0 and HTTP/1.1

Tue, 03 Feb 2026 09:41:12 +0800

Selectively Disabling HTTP/1.0 and HTTP/1.1

http {

 ...

 # Check for text-based browsers
 map $http_user_agent $is_text_browser {
 default 0;

 # Text-Based Browsers (not exhaustive)
 "~*^w3m" 1;
 "~*^Links" 1;
 "~*^ELinks" 1;
 "~*^lynx" 1;

 # Bots (not exhaustive)
 "~*Googlebot" 1;
 "~*bingbot" 1;
 "~*Yahoo! Slurp" 1;
 "~*DuckDuckBot" 1;
 "~*YandexBot" 1;
 "~*Kagibot" 1;
 }

 # Check if request is HTTP/1.X
 map $server_protocol $is_http1 {
 default 0;
 "HTTP/1.0" 1;
 "HTTP/1.1" 1;
 }

 # If Request is not text-based browser,
 # and is HTTP/1.X, set the http1_and_unknown variable
 # to 1, which is equivalent to "true"
 map "$is_http1:$is_text_browser" $http1_and_unknown {
 default 0;
 "1:0" 1;
 }

 ...

}

Harden a Server with Fail2Ban + nftables

Mon, 08 Dec 2025 16:45:51 +0800

Harden a Server with Fail2Ban + nftables

NGINX Native ACME Support: Rethinking TLS Automation from the Ground Up

Mon, 20 Oct 2025 16:31:00 +0800

NGINX Native ACME Support: Rethinking TLS Automation from the Ground Up

`ngx_http_acme_module`

NGINX 1.25.1

Pre-install

# Install build tools and NGINX dependencies on Debian/Ubuntu
sudo apt update
sudo apt install build-essential libpcre3-dev zlib1g-dev libssl-dev pkg-config libclang-dev git -y

# Install the Rust toolchain (cargo and rustc)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source $HOME/.cargo/env

mkdir -pv /app/nginx/{logs,conf,cache, acme} /app/nginx-build
cd /app/nginx-build

# Clone the ACME module source
git clone https://github.com/nginx/nginx-acme.git /app/nginx-build/nginx-acme
# Or
# git clone git@github.com:nginx/nginx-acme.git /app/nginx-build/nginx-acme

# Download the NGINX source (replace with the version you need)
wget https://nginx.org/download/nginx-1.28.0.tar.gz
tar -zxf nginx-1.28.0.tar.gz

Compile

cd nginx-1.28.0
./configure \
 --prefix=/app/nginx \
 --error-log-path=/app/nginx/error.log \
 --http-log-path=/app/nginx/access.log \
 --pid-path=/app/nginx/nginx.pid \
 --lock-path=/app/nginx/nginx.lock \
 --http-client-body-temp-path=/app/nginx/cache/client_temp \
 --http-proxy-temp-path=/app/nginx/cache/proxy_temp \
 --http-fastcgi-temp-path=/app/nginx/cache/fastcgi_temp \
 --http-uwsgi-temp-path=/app/nginx/cache/uwsgi_temp \
 --http-scgi-temp-path=/app/nginx/cache/scgi_temp \
 --user=nginx \
 --group=nginx \
 --with-compat \
 --with-file-aio \
 --with-threads \
 --with-http_addition_module \
 --with-http_auth_request_module \
 --with-http_dav_module \
 --with-http_flv_module \
 --with-http_gunzip_module \
 --with-http_gzip_static_module \
 --with-http_mp4_module \
 --with-http_random_index_module \
 --with-http_realip_module \
 --with-http_secure_link_module \
 --with-http_slice_module \
 --with-http_ssl_module \
 --with-http_stub_status_module \
 --with-http_sub_module \
 --with-http_v2_module \
 --with-http_v3_module \
 --with-mail \
 --with-mail_ssl_module \
 --with-stream \
 --with-stream_realip_module \
 --with-stream_ssl_module \
 --with-stream_ssl_preread_module \
 --with-cc-opt='-g -O2 -ffile-prefix-map=/home/builder/debuild/nginx-1.28.0/debian/debuild-base/nginx-1.28.0=. -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' \
 --with-ld-opt='-Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie' \
 --add-dynamic-module=/app/nginx-build/nginx-acme

make && \
 make modules && \
 make install

# Run the configure script; the key is --add-dynamic-module
# Note: include all existing NGINX build flags; see nginx -V
# Build the module; note it is make modules, not make install

Config

# /app/nginx/conf/nginx.conf
user nginx;
error_log error.log debug;
pid nginx.pid;

load_module modules/ngx_http_acme_module.so;

events {
 worker_connections 1024;
 multi_accept on;
}

http {
 include mime.types;
 default_type application/octet-stream;
 log_format main '$remote_addr - $remote_user [$time_local] "$host" "$request" '
 '$status $body_bytes_sent "$http_referer" '
 '"$http_user_agent" "$http_x_forwarded_for"';

 access_log access.log main;
 sendfile on;
 tcp_nopush on;
 charset utf-8;
 keepalive_timeout 65;
 gzip on;

 resolver 8.8.8.8 1.1.1.1;
 # Define an ACME issuer instance named letsencrypt
 acme_issuer letsencrypt {
 # Set the ACME directory URL; this is Let's Encrypt production
 uri https://acme-v02.api.letsencrypt.org/directory;
 # Provide a contact email for CA notices (e.g., expiration)
 contact mailto:security-alerts@aidig.co;
 # State file path for ACME account key material
 state_path acme/letsencrypt;
 # Accept the terms of service; required for Let's Encrypt
 accept_terms_of_service;
 }
 # Optional acme_shared_zone stores certs, keys, and challenges for issuers.
 # Default size is 256K; increase as needed.
 acme_shared_zone zone=acme_shared:1M;

 server {
 listen 443 ssl;
 server_name ssl.aidig.co;

 # Step 1: enable ACME for this server and select the letsencrypt issuer
 acme_certificate letsencrypt;
 # Step 2: use dynamic variables managed in memory by the ACME module
 ssl_certificate $acme_certificate;
 ssl_certificate_key $acme_certificate_key;
 ssl_certificate_cache max=2; # required ngx 1.27.4+

 location / {
 default_type text/plain;
 return 200 'OK';
 }
 }

 server {
 listen 80 default_server;
 server_name _;

 # ACME handles /.well-known/acme-challenge/ automatically; this is for all other requests
 location / {
 return 301 https://$host$request_uri;
 }
 }
}

Reduce the Chance of Home Web Services Being Reported

Thu, 02 Oct 2025 09:54:00 +0800

Reduce the Chance of Home Web Services Being Reported
When a plaintext request hits an HTTPS service, Nginx returns a special 497 status code. If that happens, we want Nginx to close the connection and return no response. This requires another non-standard status code 444. Combining the two, add the following config in the server:

error_page 497 @close;

location @close {
 return 444;
}

Use the error_page directive to map 497 to the virtual path @close. When Nginx handles @close, it returns 444 and closes the connection.

Nginx if 避坑指南

Sat, 15 Jun 2024 19:55:10 +0800

if 指令由 rewrite 模块提供，显然它主要是用于 URL 重写领域。典型的 if 用法如下：

http {
 server {
 listen 8080;

 if ($http_user_agent ~ MSIE) {
 rewrite ^(.*)$ /msie/$1 break;
 }

 if ($request_method = POST) {
 return 405;
 }
 }
}

上例中第一个 if 检查如果 user agent 字符串中包含 MSIE，就把 URL 重写为 /msie 开头的路径，这样就可以给微软的 IE 浏览器提供特供版本内容。

第二个 if 检查当前请求的 HTTP 方法，如果是 POST 请求则直接返回 405 状态码。

以上就是 if 最典型的用法，也是 Nginx 最初设想的用法～但很快就被用户玩坏了 😂

天下苦静态配置久矣，Nginx 终于支持动态配置了 👏 这个 if 不就是 c 语言里的条件判断吗？大家玩起来 🎢

Avoiding the Top 10 NGINX Configuration Mistakes - NGINX

Fri, 16 Sep 2022 15:22:23 +0800

Avoiding the Top 10 NGINX Configuration Mistakes - NGINX

1) Not enough file descriptors (FDs) per worker

What’s wrong

worker_connections limits how many concurrent connections a single worker can hold (default 512).
But each worker is also limited by the OS per-process file descriptor limit (often 1024 by default).
Common mistake: increasing worker_connections but not raising the FD limit, causing early exhaustion.

Fix

Set worker_rlimit_nofile in the main context to at least 2× worker_connections (rule of thumb).
Also validate the system-wide FD cap (fs.file-max) so that: worker_rlimit_nofile * worker_processes is well below fs.file-max.

# main context
worker_connections 1024; # inside events {}
worker_rlimit_nofile 2048; # main context

2) The `error_log off` directive (it does not disable error logging)

What’s wrong

Unlike access_log, error_log does not accept an off parameter.
error_log off; creates a file literally named off (often under /etc/nginx/).

Fix (generally not recommended)

If you must suppress error logging due to storage constraints, send it to /dev/null and restrict severity:

# main context
error_log /dev/null emerg;

Note

This only applies after NGINX reads and validates config; startup/reload may still log to the default location unless you start NGINX with -e <error_log_location>.

3) Not enabling keepalive connections to upstream servers

What’s wrong

Default behavior: NGINX opens a new upstream connection for each request.
At high load this can consume resources and can exhaust ephemeral source ports due to TIME-WAIT, preventing new upstream connections.

Fix

(A) Add keepalive to each upstream {}

Top 25 Nginx Tips and Tricks From Practical Experience

Wed, 10 Aug 2022 12:27:28 +0800

Top 25 Nginx Tips and Tricks From Practical Experience
server_tokens off;
ssl_protocols TLSv1.2 TLSv1.3;
Disable any undesirable HTTP methods

 location / {
 limit_except GET HEAD POST { deny all; }
 }

Enable sysctl based protection

net.ipv4.conf.all.rp_filter = 1
net.ipv4.tcp_syncookies = 1

Stop image hotlinking

location /images/ {
 valid_referers none blocked www.domain.com domain.com;
 if ($invalid_referer) {
 return 403;
 }
}

add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Simple A/B Testing with Nginx split_clients

Mon, 04 Jul 2022 14:36:23 +0800

Simple A/B Testing with Nginx split_clients

ngx_http_split_clients_module

Configure

For example, suppose we want 20% of users to be redirected to https://example.com/, 30% to https://example.org/, and the rest to https://example.edu/.

split_clients "${remote_addr}AAA" $variant {
 20% https://example.com/;
 30% https://example.org/;
 * https://example.edu/;
}

server {
 listen 80;
 listen [::]:80;
 server_name _;

 return 302 ${variant};
}

In the example above, the visitor’s IP address plus the string AAA is hashed with MurmurHash2 into a number. If the number falls in the first 20%, $variant is https://example.com/. If it falls in the middle 30%, $variant is https://example.org/. Otherwise it is https://example.edu/.

How Nginx Hides Upstream Errors

Mon, 27 Dec 2021 15:47:12 +0800

How Nginx Hides Upstream Errors

Nginx allows enabling next upstream for the following seven retryable error codes

403 Forbidden
404 Not Found
429 Too Many Requests
500 Internal Server Error
502 Bad Gateway
503 Server Unavailable
504 Gateway Timeout

When upstream returns 404, return a 200 response with a not-found image

You can use proxy_intercept_errors to achieve this.\n> When proxy_intercept_errors is enabled, requests with upstream response codes >= 300 can be further handled via the error_page directive.

Nginx notes

Fri, 19 Nov 2021 14:35:58 +0800

Record Nginx configuration file and explanation.

files structure

.
├── geoip.conf
├── nginx.conf
├── sites-available
│ ├── default.conf
├── sites-enabled
│ ├── default.conf -> ../sites-available/default.conf
├── upstream.conf

geoip.conf

## module: ngx_http_geoip2_module
## https://github.com/leev/ngx_http_geoip2_module
## Read the GeoIP database and set variables
geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
 auto_reload 60m;
 $geoip2_metadata_country_build metadata build_epoch;
 ## Set $geoip2_data_country_code to the ISO 3116 country code for $remote_addr
 $geoip2_data_country_code source=$remote_addr country iso_code;
 ## Set $geoip2_data_country_name to the corresponding English city name
 $geoip2_data_country_name country names en;
}

upstream.conf

## module: ngx_http_upstream_module
## Define server groups
upstream to_nodejs1 {
 ## server address [parameters]; define a server
 ## parameters:
 ## weight=number defines the weight, default is 1
 ## max_fails=number sets max retries to the upstream server, default is 1
 ## fail_timeout=time sets the time to stop sending requests to this upstream server after reaching max_fails, default is 10 seconds
 ## backup marks this upstream server as a backup when others are unavailable
 ## down marks this upstream server as unavailable
 server 10.7.0.12:9000 max_fails=3 fail_timeout=5s;
 server 10.7.0.12:9001 max_fails=3 fail_timeout=5s backup;
}

upstream to_nodejs2 {
 server 10.7.0.12:9002 max_fails=3 fail_timeout=5s;
 server 10.7.0.12:9003 max_fails=3 fail_timeout=5s backup;
}

upstream to_nodejs9005 {
 server 10.7.0.12:9005 max_fails=3 fail_timeout=5s;
}

## module: ngx_http_map_module
## map string $variable { ... } creates a new variable
map $arg_agent $game_api {
 ## $arg_agent is the agent value in the request (https://abc.com/?agent=123)
 ## When agent=123, $game_api is to_nodejs95
 123 to_nodejs95;
 ## If agent ends with 1, 2, 3, or 4, $game_api is to_nodejs1
 ~*1$ to_nodejs1;
 ~*2$ to_nodejs1;
 ~*3$ to_nodejs1;
 ~*4$ to_nodejs1;
 ## If agent does not match the rules above, $game_api defaults to to_nodejs2
 default to_nodejs2;
}

default.conf

## module: ngx_http_limit_req_module
## Limit request handling
## limit_req_zone key zone=name:size rate=rate [sync]; defines request limiting rules
limit_req_zone $binary_remote_addr$server_name zone=websocket:10m rate=1r/m;
## limit_req_status code; sets HTTP status code for rejected connections, default is 503
limit_req_status 502;

## Configure virtual host
server {
 ## listen port [default_server] [ssl] [http2 | spdy] [proxy_protocol] [setfib=number] [fastopen=number] [backlog=number] [rcvbuf=size] [sndbuf=size] [accept_filter=filter] [deferred] [bind] [ipv6only=on|off] [reuseport] [so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]];
 ## Set the listen port, default is *:80
 ## Below listens on port 80 and is the default virtual host
 listen 80 default_server;
 ## server_name name ...; set virtual host name, regex allowed, default is ""
 server_name _;

 access_log logs/default/default.log json;
 error_log logs/default/default.error.log warn;

 ## module: ngx_http_access_module
 ## allow address | CIDR | unix: | all; allow IP access
 allow 1.1.1.1;
 ## deny address | CIDR | unix: | all; deny IP access
 deny 12.34.56.78;

 ## Set the root directory for requests
 root /usr/share/nginx/html;
 ## limit_req zone=name [burst=number] [nodelay | delay=number]; set request limiting zone
 limit_req zone=websocket nodelay;
 ## limit_req_log_level info | notice | warn | error; set log level for rejected requests, default is error
 limit_req_log_level warn;

 ## location [ = | ~ | ~* | ^~ ] uri { ... }
 ## location @name { ... } configure based on the request URI
 location / {
 default_type application/json;
 ## Return HTTP status code 200 with a string
 return 200 '{"Code": "$status", "IP": "$remote_addr"}';
 }
}


server {
 ## Below listens on port 443 and is the default virtual host; all connections use SSL
 listen 443 default_server ssl;
 server_name _;

 access_log logs/default/default.log json;
 error_log logs/default/default.error.log warn;
 ## module: ngx_http_ssl_module
 ## Set the PEM-format certificate
 ssl_certificate /etc/ssl/hddv1.com.crt;
 ## Set the PEM-format key
 ssl_certificate_key /etc/ssl/hddv1.com.key;
 ## Set SSL versions, default is TLSv1 TLSv1.1 TLSv1.2
 ssl_protocols TLSv1.2 TLSv1.3;
 ## Set enabled ciphers, default is HIGH:!aNULL:!MD5
 ssl_ciphers "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC2:!RC4:!aNULL:!eNULL:!LOW:!IDEA:!DES:!TDES:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!EXPORT:!ANON";
 ## Specify the DH parameter file for DHE ciphers
 ssl_dhparam /etc/ssl/dhparams.pem;
 ## Prefer server ciphers, default is off
 ssl_prefer_server_ciphers on;
 ## ssl_session_cache off | none | [builtin[:size]] [shared:name:size];
 ## Set cache and size, default is none
 ssl_session_cache shared:SSL:1m;
 ## Set session reuse time, default is 5 minutes
 ssl_session_timeout 5m;
 add_header X-Frame-Options "SAMEORIGIN";
 add_header X-XSS-Protection "1; mode=block";
 add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

 root /usr/share/nginx/html;
 limit_req zone=websocket nodelay;
 limit_req_log_level warn;
 default_type application/json;

 location / {
 default_type application/json;
 return 200 '{"Code": "$status", "IP": "$remote_addr"}';
 }
}

nginx.conf

## module: ngx_core_module
## worker_processes number | auto; number of Nginx worker processes, auto equals CPU count
worker_processes auto;
## worker_rlimit_nofile number; max open files for workers, default is system RLIMIT_NOFILE
worker_rlimit_nofile 131072;
## worker_shutdown_timeout time; shutdown timeout for reloads and related commands
worker_shutdown_timeout 60;

## error_log file [level]; set error log path
## debug, info, notice, warn, error, crit, alert, emerg
error_log logs/error.log warn;

## pid file; master process ID file location
pid logs/nginx.pid;

## module: ngx_core_module
## Connection handling
events {
 ## worker_connections number; max concurrent connections per worker, default is 512, must be less than worker_rlimit_nofile
 ## max connections = worker_connections * worker_processes
 worker_connections 102400;

 ## accept_mutex on | off; default is off
 ## When on, only one worker accepts new connections while others remain idle
 ## When off, all workers wake up; one accepts, the rest go back to sleep
 ## With TCP long connections and high traffic, off performs better for throughput and QPS
 accept_mutex off;

 ## multi_accept on | off; accept all connections at once, default is off
 multi_accept on;
}

## module: ngx_http_core_module
## HTTP server settings
http {
 ## module: ngx_core_module
 ## include file | mask; include settings from file
 ## Below sets MIME types, defined in the mime.type file
 include mime.types;

 ## default_type mime-type; default MIME type, default is text/plain
 default_type application/octet-stream;
 ## server_names_hash_max_size size; max size of the server_name hash table, default is 512k
 server_names_hash_max_size 2048;
 ## Size of the server_name hash table for fast lookup, default depends on CPU L1 cache
 server_names_hash_bucket_size 256;
 ## server_tokens on | off | build | string; show Nginx version on error pages, default is on
 server_tokens off;
 ## Log 404 in the error log
 log_not_found off;
 ## Enable sendfile() for file transfer efficiency, default is off
 sendfile on;
 ## Use full packets for file sending, default is off
 tcp_nopush on;
 ## Send data as soon as possible, default is on
 tcp_nodelay on;
 ## Set keepalive timeout seconds; Nginx closes after timeout, default is 75
 keepalive_timeout 70;
 ## client_max_body_size size; max allowed request body size
 client_max_body_size 64M;

 ## module: ngx_http_gzip_module
 ## Enable gzip compression, default is off
 gzip on;
 ## Minimum Content-Length to gzip, default is 20
 gzip_min_length 1k;
 ## Gzip buffer size, default is one memory page
 ## gzip_buffers number size;
 gzip_buffers 4 32k;
 ## Compression level, range 1-9, default is 1
 gzip_comp_level 7;
 ## MIME types to compress, default is text/html
 gzip_types text/plain application/x-javascript text/css application/xml text/javascript application/x-httpd-php application/json;
 ## Add Vary: Accept-Encoding to HTTP response headers, default is off
 gzip_vary on;
 ## Disable compression for specific User-Agent
 ## Below disables IE 6
 gzip_disable "MSIE [1-6]\.";

 ## resolver address ... [valid=time] [ipv6=on|off] [status_zone=zone]; use the specified DNS servers for server_name and upstreams
 resolver 114.114.114.114 8.8.8.8 1.1.1.1;

 ## module: ngx_http_headers_module
 ## add_header name value [always]; add fields to HTTP response headers
 ## Below allows CORS
 add_header Access-Control-Allow-Origin *;
 add_header Access-Control-Allow-Headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type;
 add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
 add_header Access-Control-Expose-Headers 'WWW-Authenticate,Server-Authorization,User-Identity-Token';

 ## module: ngx_http_realip_module
 ## set_real_ip_from address | CIDR | unix:; set trusted proxy IPs such as reverse proxies
 set_real_ip_from 10.0.0.0/8;
 set_real_ip_from 172.16.0.0/12;
 set_real_ip_from 192.168.0.0/16;
 ## real_ip_header field | X-Real-IP | X-Forwarded-For | proxy_protocol; define which header provides client IP, default is X-Real-IP
 real_ip_header X-Forwarded-For;
 ## Use the last non-trusted IP or last IP in real_ip_header as the real IP, default is off
 real_ip_recursive on;

 ## module: ngx_http_log_module
 ## log_format name [escape=default|json|none] string ...; set log format
 log_format json escape=json '{"@timestamp":"$time_iso8601",'
 '"@source":"$server_addr",'
 '"ip":"$http_x_forwarded_for",'
 '"client":"$remote_addr",'
 '"request_method":"$request_method",'
 '"scheme":"$scheme",'
 '"domain":"$server_name",'
 '"client_host":"$host",'
 '"referer":"$http_referer",'
 '"request":"$request_uri",'
 '"args":"$args",'
 '"sent_bytes":$body_bytes_sent,'
 '"status":$status,'
 '"responsetime":$request_time,'
 '"upstreamtime":"$upstream_response_time",'
 '"upstreamaddr":"$upstream_addr",'
 '"http_user_agent":"$http_user_agent",'
 '"Country":"$geoip2_data_country_name",'
 '"State":"$geoip2_data_state_name",'
 '"City":"$geoip2_data_city_name",'
 '"https":"$https"'
 '}';
 log_format main '$remote_addr - $remote_user [$time_local] "$request" '
 '$status $body_bytes_sent "$http_referer" '
 '"$http_user_agent" "$http_x_forwarded_for"';
 ## access_log path [format [buffer=size] [gzip[=level]] [flush=time] [if=condition]]; set log path and format name
 ## access_log off; disable logging
 access_log logs/access.log json;
}

Fix Nginx 500 errors (too many open files, connection)

Sat, 09 Oct 2021 11:51:06 +0800

Fix Nginx 500 errors (too many open files, connection)

Nginx 500 errors only show up in logs. Two common cases:

socket() failed (24: Too many open files) while connecting to upstream

$ sudo su - www-data
$ ulimit -n # check current limit (ulimit -a shows all params)
1024

# vim /etc/security/limits.conf # set nofile (max number of open files)
# add/modify the following two lines
* soft nofile 655360
* hard nofile 655360

ulimit -n # log out and log back in to see the new value
655360

# If ulimit -n is not 655360, run ulimit -n 655360 to force set it
# Then verify with ulimit -n or ulimit -Sn (soft) and ulimit -Hn (hard) (or ulimit -a).

# Calculate and set from system level
lsof | wc -l # count open files
sudo vim /etc/sysctl.conf
fs.file-max = 3268890
sudo sysctl -p

512 worker_connections are not enough while connecting to upstream

# /etc/nginx/nginx.conf
worker_connections 10240;

# Refer to Nginx CoreModule
# worker_processes 2;
# worker_rlimit_nofile 10240;
# events {
# # worker_connections 10240;
# }

# Increasing Nginx connections can slow down overall speed because php-cgi is not enough.
# Adjust as follows.

# php-cgi was started with phpfcgid_children="10" and phpfcgid_requests="500"
# ab was run on another server, connect via a switch using GBit ethernet
# http://till.klampaeckel.de/blog/archives/30-PHP-performance-III-Running-nginx.html

# vim /etc/nginx/nginx.conf
worker_connections 10240;
worker_rlimit_nofile

# vim /etc/init.d/php-fcgi
PHP_FCGI_CHILDREN=15
PHP_FCGI_MAX_REQUESTS=1000
change to
PHP_FCGI_CHILDREN=512 # or 150 and increase gradually, watch MySQL connections
PHP_FCGI_MAX_REQUESTS=10240

# The article's phpfcgid_stop() function is good and can be used if needed.
# phpfcgid_stop() {
# echo "Stopping $name."
# pids=`pgrep php-cgi`
# pkill php-cgi
# wait_for_pids $pids
# }

Nginx request_time and upstream_response_time explained

Fri, 14 May 2021 16:04:04 +0800

Nginx request_time and upstream_response_time explained

Time definitions

request_time

Time from the first byte of the client request to the completion of response data being sent. $request_time includes time to receive the request, time for the upstream to respond, and time to send the response (excluding log write time).

upstream_response_time

Time from Nginx establishing a connection to the upstream until all data is received and the connection is closed.

upstream_connect_time

Time to connect to the upstream server. If using an encrypted protocol, this includes handshake time.

Bypass X-Frame-Options with Nginx

Mon, 26 Apr 2021 17:39:33 +0800

Bypass X-Frame-Options with Nginx

The X-Frame-Options HTTP response header tells the browser whether a page can be displayed inside <frame>, <iframe>, <embed>, or <object>. Sites can prevent clickjacking by ensuring their pages are not embedded elsewhere. By using Nginx as a forward proxy, we can bypass X-Frame-Options and embed a third-party page in our own page.

X-Frame-Options has three possible values:

deny: the page cannot be displayed in a frame, even on the same origin.
sameorigin: the page can be displayed in a frame on the same origin.
allow-from uri: the page can be displayed in a frame only from the specified origin.

When Chrome tries to load frame content and X-Frame-Options denies it, the console shows an error like: Refuse to display 'http://192.168.20.101:8080' in a frame because it set 'X-Frame-Options' to 'deny'.

Setting up JWT Authentication

Fri, 23 Apr 2021 11:13:34 +0800

Nginx SSL/TLS configuration with TLSv1.2 and TLSv1.3 - ECDHE and strong ciphers suite (Openssl 1.1.1)

Fri, 22 Jan 2021 13:49:17 +0800

Nginx SSL/TLS configuration with TLSv1.2 and TLSv1.3 - ECDHE and strong ciphers suite (Openssl 1.1.1)

ssl.conf

##
# SSL Settings (TLSv1.2 and TLSv1.3)
##
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'TLS13+AESGCM+AES128:EECDH+AES128';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;
ssl_session_tickets off;
ssl_ecdh_curve X25519:sect571r1:secp521r1:secp384r1

universal-ssl.conf

##
# SSL Settings (TLSv1.0 + TLSv1.1 + TLSv1.2 + TLSv1.3)
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers 'TLS13+AESG+AES128:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES25GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-R-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-S:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;
ssl_session_tickets off;
ssl_ecdh_curve X25519:sect571r1:secp521r1:secp384r1;

In 2020, use the latest NGINX ngx_http_geoip2 module to block IPs by country or region

Tue, 27 Oct 2020 15:44:48 +0800

Install geoip2 lib

cd /usr/local/src
rm -f libmaxminddb-1.4.2.tar.gz
wget https://github.com/maxmind/libmaxminddb/releases/download/1.4.2/libmaxminddb-1.4.2.tar.gz
tar -xzf libmaxminddb-1.4.2.tar.gz
cd libmaxminddb-1.4.2
yum install gcc gcc-c++ make -y
./configure
make
make check
sudo make install

echo '/usr/local/lib' > /etc/ld.so.conf.d/geoip.conf
sudo ldconfig

Download ngx_http_geoip2_module

cd /usr/local/src
wget https://github.com/leev/ngx_http_geoip2_module/archive/3.3.tar.gz
tar -xzf 3.3.tar.gz
mv ngx_http_geoip2_module-3.3 ngx_http_geoip2_module

# nginx集成
cd /usr/local/src
wget http://nginx.org/download/nginx-1.16.1.tar.gz
tar -zxf nginx-1.16.1.tar.gz
cd nginx-1.16.1
useradd -M -s /sbin/nologin www


yum install gcc gcc-c++ make pcre-devel zlib-devel openssl-devel -y
./configure --user=www --group=www --prefix=/usr/local/nginx \
--with-ld-opt="-Wl,-rpath -Wl,/usr/local/lib" \
--with-http_sub_module \
--with-http_realip_module \
--with-http_gzip_static_module \
--with-http_ssl_module \
--with-http_v2_module \
--add-module=/usr/local/src/ngx_http_geoip2_module

make
make install

Download geoip2 IP database

The latest GeoLite2-City.mmdb for 2020 cannot be downloaded directly. You must register a maxmind account.

Nginx HTTPS with Basic Auth reverse proxy for VMware ESXi 6.5 fixed VMRC /screen

Sat, 17 Oct 2020 12:31:02 +0800

Nginx HTTPS with Basic Auth reverse proxy for VMware ESXi 6.5 fixed VMRC /screen

server {
 listen 80;
 server_name esxi.hackion.com;
 return 301 https://$server_name$request_uri;
}

server {
 listen 443 ssl;
 server_name esxi.hackion.com;

 ssl_certificate /mycert.crt;
 ssl_certificate_key /mykey.key;

 location / {
 auth_basic "Restricted Content";
 auth_basic_user_file /etc/nginx/.htpasswd;

 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header Origin '';
 proxy_set_header Authorization ''; #Don't pass the Nginx Basic Auth to ESXi or it will break VMRC.
 proxy_pass_header X-XSRF-TOKEN;
 proxy_pass https://esxi_server;
 proxy_send_timeout 300;
 proxy_read_timeout 300;
 send_timeout 300;
 client_max_body_size 1000m;

 # enables WS support
 proxy_http_version 1.1;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "upgrade";
 }
}

server {
 listen 443 ssl http2;

 # ssl_certificate and ssl_certificate_key are required
 ssl_certificate /etc/letsencrypt/live/myletsencryptdomain/fullchain.pem;
 ssl_certificate_key /etc/letsencrypt/live/myletsencryptdomain/privkey.pem;

 include /etc/nginx/snippets/ssl-params.conf;
 # removed DH params as my ssl-params.conf specifies to only use ECDHE key exchange.

 server_name fqdn.extern;

 location / {
 proxy_set_header Host $http_host;
 proxy_set_header X-Real-IP $remote_addr;

 proxy_ssl_verify off; # No need on isolated LAN
 proxy_pass https://vcenter.ip; # esxi IP Address

 proxy_http_version 1.1;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "upgrade";

 proxy_buffering off;
 client_max_body_size 0;
 proxy_read_timeout 36000s;

 proxy_redirect https://fqdn.local/ https://fqdn.extern/; # read comment below
 # replace vcenter-hostname with your actual vcenter's hostname, and esxi with your nginx's server_name.
 }

 location /websso/SAML2 {
 proxy_set_header Host fqdn.local; # your actual vcenter's hostname
 proxy_set_header X-Real-IP $remote_addr;

 proxy_ssl_verify off; # No need on isolated LAN
 proxy_pass https://vcenter.ip; # esxi IP Address

 proxy_http_version 1.1;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "upgrade";

 proxy_buffering off;
 client_max_body_size 0;
 proxy_read_timeout 36000s;
 proxy_ssl_session_reuse on;

 proxy_redirect https://fqdn.local/ https://fqdn.extern/; # read comment below
 # replace vcenter-hostname with your actual vcenter's hostname, and esxi with your nginx's server_name.
 }
}

nginx 添加第三方nginx_upstream_check_module 模块实现健康状态检测

Sun, 26 Apr 2020 20:05:37 +0800

nginx.conf

 http {
 upstream cluster {
 # simple round-robin
 server 192.168.0.1:80;
 server 192.168.0.2:80;

 check interval=5000 rise=1 fall=3 timeout=4000;
 #check interval=3000 rise=2 fall=5 timeout=1000 type=ssl_hello;
 #check interval=3000 rise=2 fall=5 timeout=1000 type=http;
 #check_http_send "HEAD / HTTP/1.0\r\n\r\n";
 #check_http_expect_alive http_2xx http_3xx;
 }
...

 check
 syntax: *check interval=milliseconds [fall=count] [rise=count]
 [timeout=milliseconds] [default_down=true|false]
 [type=tcp|http|ssl_hello|mysql|ajp|fastcgi]*

 默认配置：interval=3000 fall=5 rise=2 timeout=1000 default_down=true type=tcp*
...

interval：检测间隔 3 秒
fall: 连续检测失败次数 5 次时，认定 relaserver is down
rise: 连续检测成功 2 次时，认定 relaserver is up
timeout: 超时 1 秒
default_down: 初始状态为 down,只有检测通过后才为 up
type: 检测类型方式 tcp
1. tcp :tcp 套接字,不建议使用，后端业务未 100%启动完成,前端已经放开访问的情况
2. ssl_hello：发送 hello 报文并接收 relaserver 返回的 hello 报文
3. http: 自定义发送一个请求，判断上游 relaserver 接收并处理
4. mysql: 连接到 mysql 服务器，判断上游 relaserver 是否还存在
5. ajp: 发送 AJP Cping 数据包，接收并解析 AJP Cpong 响应以诊断上游 relaserver 是否还存活(AJP tomcat 内置的一种协议)
6. fastcgi: php 程序是否存活

example

How Does Nginx Defend Against DDoS?

Fri, 20 Dec 2019 09:42:50 +0800

ngx_http_limit_req_module

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;

Use Nginx and mod_pagespeed to Convert Images to WebP on the Fly

Mon, 07 Oct 2019 10:35:22 +0800

Use Nginx and mod_pagespeed to Convert Images to WebP on the Fly

Compile ngx_pagespeed

First make sure Nginx is built with --with-compat, so we do not need to rebuild Nginx from scratch.

incubator: https://github.com/apache/incubator-pagespeed-ngx.git

# Switch to the nginx source directory and configure the build
./configure --with-compat --add-dynamic-module=../incubator-pagespeed-ngx

# Build modules
make modules

# Copy the built module into the nginx modules directory
sudo cp objs/ngx_pagespeed.so /etc/nginx/modules/

# Create the cache directory for converted images
sudo mkdir -p /var/ngx_pagespeed_cache
sudo chown -R www-data:www-data /var/ngx_pagespeed_cache

load_module modules/ngx_pagespeed.so;


# enable pagespeed module on this server block
pagespeed on;

# Needs to exist and be writable by nginx. Use tmpfs for best performance.
pagespeed FileCachePath /var/ngx_pagespeed_cache;

# Ensure requests for pagespeed optimized resources go to the pagespeed handler
# and no extraneous headers get set.
location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" {
 add_header "" "";
}
location ~ "^/pagespeed_static/" { }
location ~ "^/ngx_pagespeed_beacon$" { }

pagespeed RewriteLevel CoreFilters;

The last line (pagespeed RewriteLevel CoreFilters;) specifies the enabled optimizations. It includes basic filters such as:

Force file download with Nginx

Mon, 19 Aug 2019 12:12:32 +0800

Force file download with Nginx

add_header Content-Disposition 'attachment;';

server {
 listen 80;
 server_name my.domain.com;
 location ~ ^.*/(?P<request_basename>[^/]+\.(mp3))$ {
 root /path/to/mp3/
 add_header Content-Disposition 'attachment; filename="$request_basename"';
 }
}

{
 listen 80;
 server_name backup.baifu-tech.net;
 root /data/backup/rechargecent-mago;
 location / {
 auth_basic "baifu backup center";
 auth_basic_user_file /etc/nginx/ssl/htpasswd;
 autoindex on;
 autoindex_exact_size off;
 autoindex_localtime on;
 }
}

Do you understand the Nginx request processing flow?

Thu, 07 Mar 2019 14:05:55 +0800

Do you understand the Nginx request processing flow?

11 processing phases

NGX_HTTP_POST_READ_PHASE:

A phase after receiving the full HTTP headers. It is before URI rewrite. Very few modules register in this phase, and it is skipped by default.

NGX_HTTP_SERVER_REWRITE_PHASE:

The phase that modifies the URI before matching the location, used for redirects. This is where rewrite directives in the server block but outside location are executed. While reading request headers, nginx selects the virtual host by host and port.

Record Millisecond Precision in Nginx Access Logs

Tue, 24 Jul 2018 18:31:42 +0800

Nginx access logs can record millisecond timestamps, but they are milliseconds since EPOCH, for example 1503544071.865. Another variable, $time_local, records a second-level time format, for example 24/Aug/2017:11:07:51 +0800. Under heavy traffic, we need a millisecond-precision format like 24/Aug/2017:11:07:51.865 +0800. This can be done with Lua.

First, define a variable named time_millis in nginx.conf and initialize it to empty. This is similar to providing a fallback self-signed certificate when using auto-ssl.

Fighting DDoS: nginx, iptables, and fail2ban

Fri, 20 Jul 2018 18:47:42 +0800

Fighting DDoS: nginx, iptables, and fail2ban

Nginx on Ricky

Selectively Disabling HTTP/1.0 and HTTP/1.1

Harden a Server with Fail2Ban + nftables

NGINX Native ACME Support: Rethinking TLS Automation from the Ground Up

ngx_http_acme_module

Pre-install

Compile

Config

Reduce the Chance of Home Web Services Being Reported

Nginx if 避坑指南

Avoiding the Top 10 NGINX Configuration Mistakes - NGINX

1) Not enough file descriptors (FDs) per worker

What’s wrong

Fix

2) The error_log off directive (it does not disable error logging)

What’s wrong

Fix (generally not recommended)

Note

3) Not enabling keepalive connections to upstream servers

What’s wrong

Fix

Top 25 Nginx Tips and Tricks From Practical Experience

Simple A/B Testing with Nginx split_clients

ngx_http_split_clients_module

Configure

How Nginx Hides Upstream Errors

Nginx allows enabling next upstream for the following seven retryable error codes

When upstream returns 404, return a 200 response with a not-found image

Nginx notes

Record Nginx configuration file and explanation.

files structure

geoip.conf

upstream.conf

default.conf

nginx.conf

Fix Nginx 500 errors (too many open files, connection)

socket() failed (24: Too many open files) while connecting to upstream

512 worker_connections are not enough while connecting to upstream

Nginx request_time and upstream_response_time explained

Time definitions

Bypass X-Frame-Options with Nginx

Setting up JWT Authentication

Nginx SSL/TLS configuration with TLSv1.2 and TLSv1.3 - ECDHE and strong ciphers suite (Openssl 1.1.1)

ssl.conf

universal-ssl.conf

In 2020, use the latest NGINX ngx_http_geoip2 module to block IPs by country or region

Install geoip2 lib

Download ngx_http_geoip2_module

Download geoip2 IP database

Nginx HTTPS with Basic Auth reverse proxy for VMware ESXi 6.5 fixed VMRC /screen

nginx 添加第三方nginx_upstream_check_module 模块实现健康状态检测

How Does Nginx Defend Against DDoS?

ngx_http_limit_req_module

Use Nginx and mod_pagespeed to Convert Images to WebP on the Fly

Compile ngx_pagespeed

Force file download with Nginx

Do you understand the Nginx request processing flow?

11 processing phases

Record Millisecond Precision in Nginx Access Logs

Fighting DDoS: nginx, iptables, and fail2ban

`ngx_http_acme_module`

2) The `error_log off` directive (it does not disable error logging)