Nginx

Nginx is a webserver working very well on small systems

nginx -t

Test configuration

nginx -V

Print version, compiler version and configured parameters

PHP support

To enable php suppport in ./sites-available/xxx put this

 location ~ \.php$ {
       #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
       include snippets/fastcgi-php.conf;
       fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
       fastcgi_intercept_errors on;
       fastcgi_param HTTPS on;
       fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
       fastcgi_param SCRIPT_NAME     $fastcgi_script_name;
   
   }

Tips

1. Put al customizations in your site-definitions (in ./sites-available) or in .conf files in the ./conf.d subdir. This make it easier to migrate your configuration to another server.

Force clients to use https (HSTS)

Add to ./conf.d/myconfig.conf

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Wipe browser history for the HSTS websites if HSTS settings were disabled but the max-age has not passed yet for your browser (31536000 seconds is 1 year).

Other recommenations

In the http section (./conf.d/myconfig.conf) put

# For security hide the server version
server_tokens off;
ssl_protocols TLSv1.2 TLSv1.3; #  Dropping SSL, TLSv1 and TLSv1.1

# For performance
client_body_timeout 12;
client_header_timeout 12;
keepalive_timeout 15;
send_timeout 10;

client_body_buffer_size 10K;
client_header_buffer_size 1k;
client_max_body_size 8m;
large_client_header_buffers 4 4k;

Block unwanted agents

To block specific user agents, like GPTbot that can be really aggressive.

In the http section (./conf.d/myconfig.conf) add

map $http_user_agent $blocked_user_agent {
 default 0;
 ~*meta-externalagent 1;
 ~*GPTBot 1;
 ~*Amazonbot 1;
}

Then in each server that needs the blocking add

 if ($blocked_user_agent) {
  return 403;
 }

Issues and fixes

could not build server_names_hash, you should increase server_names_hash_bucket_size: 32

Due to many servernames in a server definition. In a .conf file in /etc/nginx/conf.d put a line like

server_names_hash_bucket_size 64;

Using listen [::]:80 ipv6only=on;

The ipv6only parameter can be set only once. If you have several virtual host you should not use it.