Skip to content

Digitalocean step by step guide to nginx configuration

Solved Configure
  • Hello guys,
    i’m in trouble, i’m trying to follow some tutorials to setup nginx for my digitalocean droplets.

    what i have:
    i have a react application now running at http://111.222.33.44:8080/ (fake ip, real port)

    the served folder is into /home/MYNAME/ folder on the server

    and it works, but i’ve buyed a domain, and i want to use mydomain.it to serve the same folder as now, with https and ssl.

    Can someone please helpe with that? i’m stucked, nothing works so far…

  • @justoverclock Thanks. Your config appears to be in default, which is fine, but was not set correctly. In the location block, I’ve set

                    proxy_set_header X-Real-IP $remote_addr;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header Host $http_host;
                    proxy_set_header X-NginX-Proxy true;
    
                    proxy_pass http://127.0.0.1:8080/;
                    proxy_redirect off;
    
                    # Socket.IO Support
                    proxy_http_version 1.1;
                    proxy_set_header Upgrade $http_upgrade;
                    proxy_set_header Connection "upgrade";
    

    This should now work when you to to https://vfgest.it

  • Hello guys,
    i’m in trouble, i’m trying to follow some tutorials to setup nginx for my digitalocean droplets.

    what i have:
    i have a react application now running at http://111.222.33.44:8080/ (fake ip, real port)

    the served folder is into /home/MYNAME/ folder on the server

    and it works, but i’ve buyed a domain, and i want to use mydomain.it to serve the same folder as now, with https and ssl.

    Can someone please helpe with that? i’m stucked, nothing works so far…

    its really odd…

    i don’t know what i’m doing exactly but…now if i navigate to https://vfgest.it/ i see the nginx page
    if i navigate to https://www.vfgest.it/ i see a 404 error
    if i navigate to vfgest.it:8080 (without www and without http) i can see the site

  • its really odd…

    i don’t know what i’m doing exactly but…now if i navigate to https://vfgest.it/ i see the nginx page
    if i navigate to https://www.vfgest.it/ i see a 404 error
    if i navigate to vfgest.it:8080 (without www and without http) i can see the site

    @justoverclock What you need here is a reverse proxy. If you navigate to the site with custom port (in this case, 8080), you’ll get the site directly, but for cosmetic reasons, this won’t work. You need an NGINX server block, which is simple enough to do. What is currently in your server’s nginx.conf ?

  • @justoverclock What you need here is a reverse proxy. If you navigate to the site with custom port (in this case, 8080), you’ll get the site directly, but for cosmetic reasons, this won’t work. You need an NGINX server block, which is simple enough to do. What is currently in your server’s nginx.conf ?

    @phenomlab

    user www-data;
    worker_processes auto;
    pid /run/nginx.pid;
    include /etc/nginx/modules-enabled/*.conf;
    
    events {
    	worker_connections 768;
    	# multi_accept on;
    }
    
    http {
    
    	##
    	# Basic Settings
    	##
    
    	sendfile on;
    	tcp_nopush on;
    	types_hash_max_size 2048;
    	# server_tokens off;
    
    	server_names_hash_bucket_size 64;
    	# server_name_in_redirect off;
    
    	include /etc/nginx/mime.types;
    	default_type application/octet-stream;
    
    	##
    	# SSL Settings
    	##
    
    	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    	ssl_prefer_server_ciphers on;
    
    	##
    	# Logging Settings
    	##
    
    	access_log /var/log/nginx/access.log;
    	error_log /var/log/nginx/error.log;
    
    	##
    	# Gzip Settings
    	##
    
    	gzip on;
    
    	# gzip_vary on;
    	# gzip_proxied any;
    	# gzip_comp_level 6;
    	# gzip_buffers 16 8k;
    	# gzip_http_version 1.1;
    	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    
    	##
    	# Virtual Host Configs
    	##
    
    	include /etc/nginx/conf.d/*.conf;
    	include /etc/nginx/sites-enabled/*;
    }
    
    
    #mail {
    #	# See sample authentication script at:
    #	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
    #
    #	# auth_http localhost/auth.php;
    #	# pop3_capabilities "TOP" "USER";
    #	# imap_capabilities "IMAP4rev1" "UIDPLUS";
    #
    #	server {
    #		listen     localhost:110;
    #		protocol   pop3;
    #		proxy      on;
    #	}
    #
    #	server {
    #		listen     localhost:143;
    #		protocol   imap;
    #		proxy      on;
    #	}
    #}
    
  • @phenomlab

    user www-data;
    worker_processes auto;
    pid /run/nginx.pid;
    include /etc/nginx/modules-enabled/*.conf;
    
    events {
    	worker_connections 768;
    	# multi_accept on;
    }
    
    http {
    
    	##
    	# Basic Settings
    	##
    
    	sendfile on;
    	tcp_nopush on;
    	types_hash_max_size 2048;
    	# server_tokens off;
    
    	server_names_hash_bucket_size 64;
    	# server_name_in_redirect off;
    
    	include /etc/nginx/mime.types;
    	default_type application/octet-stream;
    
    	##
    	# SSL Settings
    	##
    
    	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    	ssl_prefer_server_ciphers on;
    
    	##
    	# Logging Settings
    	##
    
    	access_log /var/log/nginx/access.log;
    	error_log /var/log/nginx/error.log;
    
    	##
    	# Gzip Settings
    	##
    
    	gzip on;
    
    	# gzip_vary on;
    	# gzip_proxied any;
    	# gzip_comp_level 6;
    	# gzip_buffers 16 8k;
    	# gzip_http_version 1.1;
    	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    
    	##
    	# Virtual Host Configs
    	##
    
    	include /etc/nginx/conf.d/*.conf;
    	include /etc/nginx/sites-enabled/*;
    }
    
    
    #mail {
    #	# See sample authentication script at:
    #	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
    #
    #	# auth_http localhost/auth.php;
    #	# pop3_capabilities "TOP" "USER";
    #	# imap_capabilities "IMAP4rev1" "UIDPLUS";
    #
    #	server {
    #		listen     localhost:110;
    #		protocol   pop3;
    #		proxy      on;
    #	}
    #
    #	server {
    #		listen     localhost:143;
    #		protocol   imap;
    #		proxy      on;
    #	}
    #}
    

    @justoverclock Can you send me the one for the site you have posted about, which should be inside /etc/nginx/sites-enabled/ ?

  • @justoverclock Can you send me the one for the site you have posted about, which should be inside /etc/nginx/sites-enabled/ ?

    @phenomlab i have two folder inside…

    default
    vfgest (i think that i make this one due to a tutorial)

    do you want the default?

  • @phenomlab i have two folder inside…

    default
    vfgest (i think that i make this one due to a tutorial)

    do you want the default?

    @justoverclock No, probably the one inside vfgest.

  • @justoverclock No, probably the one inside vfgest.

    @phenomlab mmmhhh odd…these are not folders…but links i suppose…i dont know where should i go…

    now i’m in /etc/nginx

  • @phenomlab mmmhhh odd…these are not folders…but links i suppose…i dont know where should i go…

    now i’m in /etc/nginx

    @justoverclock Can you give me access to your host ? Send me the details in a PM

  • @justoverclock Can you give me access to your host ? Send me the details in a PM

    @phenomlab you have pm

  • @justoverclock Thanks. Your config appears to be in default, which is fine, but was not set correctly. In the location block, I’ve set

                    proxy_set_header X-Real-IP $remote_addr;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header Host $http_host;
                    proxy_set_header X-NginX-Proxy true;
    
                    proxy_pass http://127.0.0.1:8080/;
                    proxy_redirect off;
    
                    # Socket.IO Support
                    proxy_http_version 1.1;
                    proxy_set_header Upgrade $http_upgrade;
                    proxy_set_header Connection "upgrade";
    

    This should now work when you to to https://vfgest.it

  • @justoverclock Thanks. Your config appears to be in default, which is fine, but was not set correctly. In the location block, I’ve set

                    proxy_set_header X-Real-IP $remote_addr;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header Host $http_host;
                    proxy_set_header X-NginX-Proxy true;
    
                    proxy_pass http://127.0.0.1:8080/;
                    proxy_redirect off;
    
                    # Socket.IO Support
                    proxy_http_version 1.1;
                    proxy_set_header Upgrade $http_upgrade;
                    proxy_set_header Connection "upgrade";
    

    This should now work when you to to https://vfgest.it

    @phenomlab works but if i type https://www.vfgest.it/ i see a 404 error page, works only with no www

  • @phenomlab works but if i type https://www.vfgest.it/ i see a 404 error page, works only with no www

    @justoverclock Hold on.

  • @phenomlab works but if i type https://www.vfgest.it/ i see a 404 error page, works only with no www

    @justoverclock That will work now, but your certificate binding is not correct. The certificate is for the non-www only, so you’ll get an error. Let me fix that.

  • @justoverclock That will work now, but your certificate binding is not correct. The certificate is for the non-www only, so you’ll get an error. Let me fix that.

    @phenomlab for sure is my fault, i’ve done all by myself with a tutorial with a certbot

  • @phenomlab works but if i type https://www.vfgest.it/ i see a 404 error page, works only with no www

    @justoverclock All done. Both https://vfgest.it and https://vfgest.it should work now

    You have to adjust certbot for this to work - see below command transcript executed on your host

    root@vito-fiore:/etc/nginx/sites-enabled# sudo certbot
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    
    Which names would you like to activate HTTPS for?
    We recommend selecting either all domains, or all domains in a VirtualHost/server block.
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    1: vfgest.it
    2: www.vfgest.it
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Select the appropriate numbers separated by commas and/or spaces, or leave input
    blank to select all options shown (Enter 'c' to cancel):
    
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    You have an existing certificate that contains a portion of the domains you
    requested (ref: /etc/letsencrypt/renewal/vfgest.it.conf)
    
    It contains these names: vfgest.it
    
    You requested these names for the new certificate: vfgest.it, www.vfgest.it.
    
    Do you want to expand and replace this existing certificate with the new
    certificate?
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    (E)xpand/(C)ancel: E
    Renewing an existing certificate for vfgest.it and www.vfgest.it
    
    Successfully received certificate.
    Certificate is saved at: /etc/letsencrypt/live/vfgest.it/fullchain.pem
    Key is saved at:         /etc/letsencrypt/live/vfgest.it/privkey.pem
    This certificate expires on 2022-12-29.
    These files will be updated when the certificate renews.
    Certbot has set up a scheduled task to automatically renew this certificate in the background.
    
    Deploying certificate
    Successfully deployed certificate for vfgest.it to /etc/nginx/sites-enabled/vfgest
    Successfully deployed certificate for www.vfgest.it to /etc/nginx/sites-enabled/vfgest
    Your existing certificate has been successfully renewed, and the new certificate has been installed.
    
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    If you like Certbot, please consider supporting our work by:
     * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
     * Donating to EFF:                    https://eff.org/donate-le
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    root@vito-fiore:/etc/nginx/sites-enabled#
    
  • @phenomlab for sure is my fault, i’ve done all by myself with a tutorial with a certbot

    @justoverclock You can drop the vfgest conf file as it’s not being used

  • @justoverclock You can drop the vfgest conf file as it’s not being used

    @phenomlab thank you very much!!!

  • @phenomlab thank you very much!!!

    @justoverclock Anytime

  • @phenomlab thank you very much!!!

    @justoverclock You should change your app so that it only listens on localhost or 127.0.0.1 for security reasons as you are currently exposing it publicly via port 8080. The reverse proxy means that this is not required, as nginx redirects it for you and is fully secure.


Did this solution help you?
Did you find the suggested solution useful? Why not buy me a coffee? It's a nice gesture, and a great way to show your appreciation 💗

Related Topics
  • Is nginx necessary to use?

    Moved Solved Hosting
    2
    1 Votes
    2 Posts
    408 Views
    @Panda said in Cloudflare bot fight mode and Google search: Basic question again, is nginx necessary to use? No, but you’d need something at least to handle the inbound requests, so you could use Apache, NGINX, Caddy… (there are plenty of them, but I tend to prefer NGINX) @Panda said in Cloudflare bot fight mode and Google search: Do these two sites need to be attached to different ports, and the ports put in the DNS record? No. They will both use ports 80 (HTTP) and 443 (HTTPS) by default. @Panda said in Cloudflare bot fight mode and Google search: Its not currently working, but how would the domain name know which of the two sites to resolve to without more info? Currently it only says the IP of the whole server. Yes, that’s correct. Domain routing is handled (for example) at the NGINX level, so whatever you have in DNS will be presented as the hostname, and NGINX will expect a match which once received, will then be forwarded onto the relevant destination. As an example, in your NGINX config, you could have (at a basic level used in reverse proxy mode - obviously, the IP addresses here are redacted and replaced with fakes). We assume you have created an A record in your DNS called “proxy” which resolves to 192.206.28.1, so fully qualified, will be proxy.sudonix.org in this case. The web browser requests this site, which is in turn received by NGINX and matches the below config server { server_name proxy.sudonix.org; listen 192.206.28.1; root /home/sudonix.org/domains/proxy.sudonix.org/ogproxy; index index.php index.htm index.html; access_log /var/log/virtualmin/proxy.sudonix.org_access_log; error_log /var/log/virtualmin/proxy.sudonix.org_error_log; location / { proxy_set_header Access-Control-Allow-Origin *; proxy_set_header Host $host; proxy_pass http://localhost:2000; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Api-Key $http_x_api_key; } location /images { index index.php index.htm index.html; root /home/sudonix.org/domains/proxy.sudonix.org/ogproxy; } fastcgi_split_path_info "^(.+\.php)(/.+)$"; listen 192.206.28.1:443 ssl http2; ssl_certificate /home/sudonix.org/domains/proxy.sudonix.org/ssl.combined; ssl_certificate_key /home/sudonix.org/ssl.key; } The important part here is server_name proxy.sudonix.org; as this is used to “map” the request to the actual domain name, which you can see in the root section as root /home/sudonix.org/domains/proxy.sudonix.org/ogproxy; As the DNS record you specified matches this hostname, NGINX then knows what to do with the request when it receives it.
  • Optimum config for NodeBB under NGINX

    Performance
    4
    3 Votes
    4 Posts
    872 Views
    @crazycells hi - no security reason, or anything specific in this case. However, the nginx.conf I posted was from my Dev environment which uses this port as a way of not interfering with production. And yes, I use clustering on this site with three instances.
  • 14 Votes
    69 Posts
    14k Views
    @phenomlab Seems to be better with some scaling fix for redis on redis.conf. I haven’t seen the message yet since the changes I made # I increase it to the value of /proc/sys/net/core/somaxconn tcp-backlog 4096 # I'm uncommenting because it can slow down Redis. Uncommented by default !!!!!!!!!!!!!!!!!!! #save 900 1 #save 300 10 #save 60 10000 If you have other Redis optimizations. I take all your advice https://severalnines.com/blog/performance-tuning-redis/
  • 4 Votes
    8 Posts
    2k Views
    @phenomlab Sorry to delay in responding, yes as i mentioned above, i had to remove my redis from docker and reinstall a new image with this command docker run --name=redis -p 127.0.0.1:6379:6379 -d -t redis:alpine and now when i test my ip and port on https://www.yougetsignal.com/tools/open-ports/ the status of my redis port is closed. I think which to configure firewall in droplet digital ocean is a good idea too, and i will configure soon. Thanks for the help!
  • how to change flarum configuration from apache to nginx?

    Solved Configure
    3
    0 Votes
    3 Posts
    428 Views
    See https://sudonix.com/topic/226/issues-getting-flarum-to-work-on-new-host/28?_=1645013723672
  • Virtualmin Letsencrypt Renewal

    Solved Hosting
    13
    1 Votes
    13 Posts
    2k Views
    @gotwf said in Virtualmin Letsencrypt Renewal: I favor KISS engineering Then I think you’ll be able to appreciate this https://content.sudonix.com/keep-it-simple-stupid/
  • is my DMARC configured correctly?

    Solved Configure
    3
    2
    3 Votes
    3 Posts
    525 Views
    @phenomlab said in is my DMARC configured correctly?: you’ll get one from every domain that receives email from yours. Today I have received another mail from outlook DMARC, i was referring to your reply again and found it very helpful/informative. thanks again. I wish sudonix 100 more great years ahead!
  • help me configuring cron job for fof/sitemap - flarum

    Solved Configure
    36
    18 Votes
    36 Posts
    3k Views
    you are too fast