Digitalocean step by step guide to nginx configuration

[justoverclock]

@phenomlab

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	# server_tokens off;

	server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}


#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
#
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}
#}

[phenomlab]

@justoverclock Can you send me the one for the site you have posted about, which should be inside /etc/nginx/sites-enabled/ ?

[justoverclock]

@phenomlab i have two folder inside…

default
vfgest (i think that i make this one due to a tutorial)

do you want the default?

[phenomlab]

@justoverclock No, probably the one inside vfgest.

[justoverclock]

@phenomlab mmmhhh odd…these are not folders…but links i suppose…i dont know where should i go…

now i’m in /etc/nginx

[phenomlab]

@justoverclock Can you give me access to your host ? Send me the details in a PM

[justoverclock]

@phenomlab you have pm

[phenomlab]

@justoverclock Thanks. Your config appears to be in default, which is fine, but was not set correctly. In the location block, I’ve set

                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-NginX-Proxy true;

                proxy_pass http://127.0.0.1:8080/;
                proxy_redirect off;

                # Socket.IO Support
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";

This should now work when you to to https://vfgest.it

[justoverclock]

@phenomlab works but if i type https://www.vfgest.it/ i see a 404 error page, works only with no www

[phenomlab]

@justoverclock Hold on.

[phenomlab]

@justoverclock That will work now, but your certificate binding is not correct. The certificate is for the non-www only, so you’ll get an error. Let me fix that.

[justoverclock]

@phenomlab for sure is my fault, i’ve done all by myself with a tutorial with a certbot

[phenomlab]

@justoverclock All done. Both https://vfgest.it and https://vfgest.it should work now

You have to adjust certbot for this to work - see below command transcript executed on your host

root@vito-fiore:/etc/nginx/sites-enabled# sudo certbot
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: vfgest.it
2: www.vfgest.it
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/vfgest.it.conf)

It contains these names: vfgest.it

You requested these names for the new certificate: vfgest.it, www.vfgest.it.

Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: E
Renewing an existing certificate for vfgest.it and www.vfgest.it

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/vfgest.it/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/vfgest.it/privkey.pem
This certificate expires on 2022-12-29.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for vfgest.it to /etc/nginx/sites-enabled/vfgest
Successfully deployed certificate for www.vfgest.it to /etc/nginx/sites-enabled/vfgest
Your existing certificate has been successfully renewed, and the new certificate has been installed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
root@vito-fiore:/etc/nginx/sites-enabled#

[phenomlab]

@justoverclock You can drop the vfgest conf file as it’s not being used

[justoverclock]

@phenomlab thank you very much!!!

[phenomlab]

@justoverclock Anytime

[phenomlab]

@justoverclock You should change your app so that it only listens on localhost or 127.0.0.1 for security reasons as you are currently exposing it publicly via port 8080. The reverse proxy means that this is not required, as nginx redirects it for you and is fully secure.

[justoverclock]

@phenomlab so now this app use a server created by me with nodejs…so all the api endpoints are available through port 3030

can i set the env variable to https://vfgest.it:3030 ?

[phenomlab]

@justoverclock If the app is listening on 8080, which it typically would, then no, leave it alone. Are the endpoints intended to be public ? Typically, these aren’t accessible via nginx

[justoverclock]

@phenomlab if now i try to login, the endpoint of my api doesn’t work because of mixed content

Mixed Content: The page at 'https://vfgest.it/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://MYSERVERIP:3030/api/login'. This request has been blocked; the content must be served over HTTPS.