Cheatsheet

Web Servers and Proxies

nginx configuration and the commands around it: serve files, proxy to an app, balance load, cache, compress and add HTTPS.

Practice this path

Commands

```
sudo nginx -t
```
Test the configuration before you use it
```
sudo nginx -s reload  |  sudo systemctl reload nginx
```
Apply a new configuration without dropping connections
```
sudo nginx -T | less
```
Print the full configuration nginx actually loaded

tail -f /var/log/nginx/access.log /var/log/nginx/error.log

Follow both logs

curl -I -H "Host: example.test" http://127.0.0.1/

Test a virtual host without DNS

Serve a site

server {
    listen 80;
    server_name example.test www.example.test;
    root /var/www/example;
    index index.html;
}

A static site

location / {
    try_files $uri $uri/ =404;
}

Serve a file or folder, or answer 404

```
location / {
    try_files $uri /index.html;
}
```
A single-page app: unknown paths get the app
```
location /static/ {
    alias /srv/assets/;
    expires 7d;
}
```
A different folder for one URL prefix, with browser caching
```
error_page 404 /404.html;
```
A custom error page

location ~ /\.(?!well-known) { deny all; }

Hide dotfiles

Location matching

nginx picks the longest matching prefix, and a regex can override it.

```
location = /health { ... }
```
Exact match: highest priority
```
location ^~ /images/ { ... }
```
A prefix that wins over regular expressions
```
location ~ \.php$ { ... }
```
A case-sensitive regular expression (~* ignores case)
```
location /api/ { ... }
```
A plain prefix

Reverse proxy

```
location /api/ {
    proxy_pass http://127.0.0.1:3000/;
}
```
Forward /api/x to the app as /x (the trailing slash cuts the prefix)

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

Tell the app who is really asking

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

Let WebSockets through

proxy_read_timeout 60s;
client_max_body_size 20m;

Timeouts and the biggest upload

Load balancing

upstream app {
    least_conn;
    server 10.0.0.11:3000 weight=2;
    server 10.0.0.12:3000;
    server 10.0.0.13:3000 backup;
}

A pool: least connections, weights, and a standby

```
proxy_pass http://app;
```
Send requests to the pool

server 10.0.0.12:3000 max_fails=3 fail_timeout=30s;

Take a failing server out for a while

```
ip_hash;
```
Keep one client on the same server

Caching and compression

gzip on;
gzip_types text/css application/javascript application/json image/svg+xml;

Compress text responses

proxy_cache_path /var/cache/nginx keys_zone=cache:10m max_size=1g inactive=60m;

Define a cache (in the http block)

proxy_cache cache;
proxy_cache_valid 200 10m;
add_header X-Cache-Status $upstream_cache_status;

Cache good answers for 10 minutes, and show hit or miss

expires 30d;
add_header Cache-Control "public, immutable";

Let browsers keep fingerprinted files for a long time

HTTPS and redirects

server {
    listen 80;
    server_name example.test;
    return 301 https://$host$request_uri;
}

Send all HTTP to HTTPS

listen 443 ssl;
ssl_certificate     /etc/ssl/example.pem;
ssl_certificate_key /etc/ssl/example.key;
ssl_protocols TLSv1.2 TLSv1.3;

Turn on TLS

add_header Strict-Transport-Security "max-age=31536000" always;

Tell browsers to use HTTPS only (HSTS)

server_name www.example.test;
return 301 https://example.test$request_uri;

Redirect www to the bare domain

openssl req -x509 -newkey rsa:2048 -nodes -days 30 -keyout key.pem -out cert.pem -subj "/CN=example.test"

A throwaway self-signed certificate for testing

Cheatsheet for the Web Servers and Proxies path · Deboistech · All cheatsheets