DEV Community

Cover image for Complete Guide to Using Nginx
Maksym
Maksym

Posted on

Complete Guide to Using Nginx

#nginx #linux #webdev

Introduction

Nginx (pronounced "engine-x") is a high-performance web server, reverse proxy, and load balancer. Originally created by Igor Sysoev in 2004, nginx has become one of the most popular web servers in the world due to its efficiency, stability, and low resource consumption.

Key Features

  • High Performance: Can handle thousands of concurrent connections
  • Low Memory Usage: Efficient resource utilization
  • Reverse Proxy: Route requests to backend servers
  • Load Balancing: Distribute traffic across multiple servers
  • SSL/TLS Termination: Handle encrypted connections
  • Static File Serving: Excellent for serving static content
  • HTTP Caching: Built-in caching capabilities

Installation

Ubuntu/Debian 

sudo apt update
sudo apt install nginx
Enter fullscreen mode Exit fullscreen mode

CentOS/RHEL/Fedora 

# CentOS/RHEL
sudo yum install nginx

# Fedora
sudo dnf install nginx
Enter fullscreen mode Exit fullscreen mode

macOS (using Homebrew) 

brew install nginx
Enter fullscreen mode Exit fullscreen mode

Starting and Enabling Nginx 

# Start nginx
sudo systemctl start nginx

# Enable nginx to start on boot
sudo systemctl enable nginx

# Check status
sudo systemctl status nginx
Enter fullscreen mode Exit fullscreen mode

Basic Configuration

Configuration File Structure

Nginx configuration files are typically located at:

  • Main config: /etc/nginx/nginx.conf
  • Site configs: /etc/nginx/sites-available/ and /etc/nginx/sites-enabled/
  • Additional configs: /etc/nginx/conf.d/

Basic nginx.conf Structure 

# Main context
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Events context
events {
    worker_connections 1024;
    use epoll;
}

# HTTP context
http {
    # MIME types and basic settings
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # Logging
    access_log /var/log/nginx/access.log;

    # Performance settings
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;

    # Include additional configurations
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}
Enter fullscreen mode Exit fullscreen mode

Common Use Cases

1. Static Web Server

Create a configuration file for serving static content:

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/html;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    # Optimize static file serving
    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}
Enter fullscreen mode Exit fullscreen mode

2. Reverse Proxy

Route requests to a backend application server:

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
Enter fullscreen mode Exit fullscreen mode

3. Load Balancer

Distribute traffic across multiple backend servers:

upstream backend {
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

server {
    listen 80;
    server_name app.example.com;

    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}
Enter fullscreen mode Exit fullscreen mode

4. SSL/HTTPS Configuration

Configure SSL termination with Let's Encrypt certificates:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Modern SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    root /var/www/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}
Enter fullscreen mode Exit fullscreen mode

Advanced Configurations

Rate Limiting

Protect your server from abuse:

http {
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

    server {
        listen 80;
        server_name api.example.com;

        location /api/ {
            limit_req zone=api burst=20 nodelay;
            proxy_pass http://backend;
        }
    }
}
Enter fullscreen mode Exit fullscreen mode

Caching

Implement HTTP caching:

http {
    proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g 
                     inactive=60m use_temp_path=off;

    server {
        listen 80;
        server_name example.com;

        location / {
            proxy_cache my_cache;
            proxy_cache_valid 200 302 10m;
            proxy_cache_valid 404 1m;
            proxy_pass http://backend;
        }
    }
}
Enter fullscreen mode Exit fullscreen mode

Compression

Enable gzip compression:

http {
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/javascript
        application/xml+rss
        application/json;
}
Enter fullscreen mode Exit fullscreen mode

Security Best Practices

Hide Nginx Version 

http {
    server_tokens off;
}
Enter fullscreen mode Exit fullscreen mode

Security Headers 

server {
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
}
Enter fullscreen mode Exit fullscreen mode

IP Restriction 

location /admin {
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;
}
Enter fullscreen mode Exit fullscreen mode

Common Commands

Testing Configuration 

# Test configuration syntax
sudo nginx -t

# Test configuration and show details
sudo nginx -T
Enter fullscreen mode Exit fullscreen mode

Reloading Configuration 

# Reload configuration without downtime
sudo systemctl reload nginx

# Or using nginx command
sudo nginx -s reload
Enter fullscreen mode Exit fullscreen mode

Managing Service 

# Start nginx
sudo systemctl start nginx

# Stop nginx
sudo systemctl stop nginx

# Restart nginx
sudo systemctl restart nginx

# Check status
sudo systemctl status nginx
Enter fullscreen mode Exit fullscreen mode

Troubleshooting

Check Logs 

# Error logs
sudo tail -f /var/log/nginx/error.log

# Access logs
sudo tail -f /var/log/nginx/access.log
Enter fullscreen mode Exit fullscreen mode

Common Issues

Permission Denied (403 Forbidden)

  • Check file permissions: chmod 644 files and chmod 755 directories
  • Verify nginx user has access to the document root
  • Check SELinux settings if applicable

Connection Refused

  • Verify nginx is running: systemctl status nginx
  • Check if the port is being used: netstat -tlnp | grep :80
  • Review firewall settings

Configuration Errors

  • Always test configuration before reloading: nginx -t
  • Check for syntax errors in configuration files
  • Verify file paths exist and are accessible

Performance Tuning

Worker Processes and Connections 

# Set to number of CPU cores
worker_processes auto;

events {
    # Increase for high-traffic sites
    worker_connections 2048;
    use epoll;
    multi_accept on;
}
Enter fullscreen mode Exit fullscreen mode

Buffer Sizes 

http {
    client_body_buffer_size 10K;
    client_header_buffer_size 1k;
    client_max_body_size 8m;
    large_client_header_buffers 2 1k;
}
Enter fullscreen mode Exit fullscreen mode

Timeouts 

http {
    client_body_timeout 12;
    client_header_timeout 12;
    keepalive_timeout 15;
    send_timeout 10;
}
Enter fullscreen mode Exit fullscreen mode

Monitoring

Basic Monitoring with Stub Status 

server {
    listen 80;
    server_name localhost;

    location /nginx_status {
        stub_status on;
        allow 127.0.0.1;
        deny all;
    }
}
Enter fullscreen mode Exit fullscreen mode

Log Analysis

Use tools like GoAccess for log analysis:

goaccess /var/log/nginx/access.log --log-format=COMBINED
Enter fullscreen mode Exit fullscreen mode

Conclusion

Nginx is a powerful and flexible web server that can handle various scenarios from simple static file serving to complex load balancing setups. The key to mastering nginx is understanding its configuration structure and gradually building up complexity as needed.

Start with basic configurations and progressively add features like SSL, caching, and security headers. Always test your configurations before applying them to production, and monitor your server's performance to ensure optimal operation.

For production deployments, consider implementing proper monitoring, logging, and backup strategies to maintain a robust web infrastructure.

Feel free to share your thoughts and criticize this article, if you find any inconvenience! Cheers

Top comments (0)