https://www.notion.so/Nginx-984ac72f069c4beaa52fcef4a25f8948
Install Nginx on CentOS 8
1. Update the System:
First, update your system to ensure all packages are up to date.
1
sudo dnf update -y
2. Add the Nginx Repository
CentOS 8 doesn’t include the latest Nginx packages in its default repositories. To get the latest version, add the official Nginx repository.
Create a repository file for Nginx:
1
sudo nano /etc/yum.repos.d/nginx.repo
Add the following content to the file:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
The nginx-stable repository is enabled by default, while the nginx-mainline repository is not. You can enable the nginx-mainline repository by setting enabled=1 if you prefer to use the mainline version of Nginx.
3. Install Nginx:
Install Nginx using the dnf package manager.
1
sudo dnf install nginx -y
4. Start and Enable Nginx:
Once the installation is complete, start the Nginx service and enable it to start on boot.
1
2
sudo systemctl start nginx
sudo systemctl enable nginx
5. Verify Nginx Installation:
You can verify that Nginx is running by checking its status.
1
sudo systemctl status nginx
6. Adjust Firewall Settings:
If you have a firewall enabled, you’ll need to allow traffic on HTTP (port 80) and HTTPS (port 443) ports.
1
2
3
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload
Distribute Domains to Ports
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
server {
listen 80;
server_name domain1.com;
location / {
proxy_pass http://localhost:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
server {
listen 80;
server_name domain2.com;
location / {
proxy_pass http://localhost:8081;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
Use map:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
http {
map $host $backend {
default localhost:80;
domain1.com localhost:8080;
domain2.com localhost:8081;
}
server {
listen 80;
location / {
proxy_pass http://$backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}
Certificate in Nginx
1. Obtain an SSL/TLS Certificate
You can obtain a certificate from a Certificate Authority (CA) like Let’s Encrypt, which provides free SSL/TLS certificates. Using Certbot, you can automate the process of obtaining and renewing certificates
Install Certbot:
1
sudo dnf install certbot python3-certbot-nginx -y
Obtain a Certificate:
Replace your_domain.com with your actual domain name.
1
sudo certbot --nginx -d your_domain.com
Follow the prompts to complete the certificate issuance process. Certbot will automatically configure Nginx for SSL.
2. Manually Configuring Nginx with an SSL/TLS Certificate
If you have an existing certificate or need to configure it manually, follow these steps:
Create a Configuration File for Your Site:
1
sudo nano /etc/nginx/conf.d/your_domain.conf
Add SSL Configuration:
Replace your_domain.com with your actual domain name and specify the paths to your certificate and key files.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
server {
listen 80;
server_name your_domain.com;
return 301 https://$host$request_uri; # Redirect HTTP to HTTPS
}
server {
listen 443 ssl;
server_name your_domain.com;
ssl_certificate /etc/letsencrypt/live/your_domain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/your_domain.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
location / {
proxy_pass http://backend_server; # Change to your backend application address
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
3. Configure Firewall
Ensure your firewall allows HTTPS traffic:
1
2
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload
4. Test and Reload Nginx
Test Nginx Configuration:
1
sudo nginx -t
Reload Nginx to Apply Changes:
1
sudo systemctl reload nginx
Docker
1