Setting up NGINX

assuming NGINX is installed or built from scratch already


It is usually assumed that everybody wants HTTPS, right? This is untrue esp. if your website is read-only or providing content without any authentication scheme. You can have a strong SSL setup if you like, while still allowing plain HTTP at the same time. For those out there who are stuck in the past, and sometimes don’t even have SSL support on their ante- diluvian systems, why not serve anything that’s already public without crypto?

Of course HSTS comes in da game and any modern browser might forget about HTTP. However it is NOT a problem to serve HSTS while talking HTTP, as it does not make any difference to e.g. Lynx which did NOT implement HSTS as of Jan 2021.


Setup your HTTP/HTTPS daemon

cd /var/www/html/
rm -f index.html 50x.html

grep --color=always aes /proc/cpuinfo
grep --color=always avx /proc/cpuinfo

openssl dhparam 2048 > /etc/nginx/dhparm.pem
# -rand /dev/urandom
cat /etc/nginx/dhparm.pem

vi mime.types

    text/plain                              bash;
    text/plain                              ksh;
    text/plain                              sh;
    text/plain                              log;
    text/plain                              out;
    text/plain                              md;
    text/plain                              tex;
    application/gzip                        gz;
    application/gzip                        tgz;

mv -i /etc/nginx/nginx.conf /etc/nginx/nginx.conf.dist
grep -vE '^[[:space:]]*(#|$)' /etc/nginx/nginx.conf.dist > /etc/nginx/nginx.conf.clean
grep -vE '^[[:space:]]*(#|$)' /etc/nginx/nginx.conf.dist > /etc/nginx/nginx.conf
vi /etc/nginx/nginx.conf

user www www;
worker_processes auto;

events {
        worker_connections 1024;

http {
        include mime.types;
    default_type text/html;
    #default_type application/octet-stream;
        sendfile on;
        keepalive_timeout 65;
    server_tokens off;

    # adding default_server here
        # http2 pops-up a download window on FF
    # curl: (1) Received HTTP/0.9 when not allowed
        server {
                listen 80 default_server;
                listen [::]:80 default_server;
                server_name _;

                location / {
                        return 301;

            # deal with http-01 challenges (no http2 there)
        location ^~ /.well-known/acme-challenge/ {
            default_type "text/plain";
            # trailing slash matters
            alias /var/www/dehydrated/;

        #ssi on;
        #autoindex on;
        #autoindex_exact_size off;
        location = /robots.txt          { access_log off; log_not_found off; }
        location = /favicon.ico         { access_log off; log_not_found off; }
        location ~ /apple-touch-icon    { access_log off; log_not_found off; }

    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_prefer_server_ciphers off;
    ssl_dhparam /etc/nginx/dhparm.pem;
    # no restriction on ssl_ecdh_curve

    # without includeSubDomains
    # here 180 days otherwise 31536000 seconds (730 days)
    add_header Strict-Transport-Security "max-age=15552000" always;

    # jitsi meet
    #ssl_session_cache shared:SSL:10m;
    #ssl_session_timeout 1d;
    #ssl_session_tickets off;

    ssl_session_cache shared:SSL:40m;
    ssl_session_timeout 4h;
    ssl_session_tickets on;

    add_header X-Frame-Options DENY;

        include conf.d/*.conf;

…and eventually tune your ciphers more.

Note HSTS of 180 days is enough, no need for 365 days.

Virtual host example

Put your certs in place and define SNIs.

Here’s the joined HTTP+HTTPS vhost sample when there is no authentication.

vi conf.d/HOST.conf

server {
        listen 80;
        listen [::]:80;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    ssl_certificate     /etc/dehydrated/certs/;
    ssl_certificate_key /etc/dehydrated/certs/;
    ssl_certificate     /etc/dehydrated/certs/ECC/;
    ssl_certificate_key /etc/dehydrated/certs/ECC/;

        location / {
                root /data/www/$server_name;
                index index index.html index.htm;
                try_files $uri $uri/ =404;

            # deal with http-01 challenges (no http2 there)
            location ^~ /.well-known/acme-challenge/ {
                    default_type "text/plain";
                    # trailing slash matters
                    alias /var/www/dehydrated/;

        #ssi on;
        autoindex on;
        autoindex_exact_size off;
    location = /robots.txt          { access_log off; log_not_found off; }
    location = /favicon.ico         { access_log off; log_not_found off; }
    location ~ /apple-touch-icon    { access_log off; log_not_found off; }

More options

    location ~ /\.                 { access_log off; log_not_found off; deny all; }
    location ~ ~$                  { access_log off; log_not_found off; deny all; }

And of course, if you really need a redirect instead of serving HTTP, here’s the sample when there is truly and mandatory need for SSL.

server {
    listen 80;
    listen [::]:80;

    # redirect to HTTPS
    location / {
        return 301 https://$host$request_uri;

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # dns-01
    ssl_certificate     /etc/dehydrated/certs/nethence_com/fullchain.pem;
    ssl_certificate_key /etc/dehydrated/certs/nethence_com/privkey.pem;

    location / {
        proxy_pass http://x.x.x.x/;

Ready to go

check configuration

nginx -t

enable at boot time

vi /etc/rc.d/rc.local

echo -n nginx...
/usr/local/sbin/nginx && echo done || echo FAIL

on Ubuntu 16+, make sure the System D service for rc-local is enabled and don’t forget to make the script executable

systemctl status rc-local.service
chmod +x /etc/rc.local


ps auxfww | grep nginx | grep -v grep
cat /var/log/
cat /var/lock/nginx.lock
cat /var/db/nginx/nginx.lock


nginx -s reload

shutdown gracefully

nginx -s quit

exit brutally

nginx -s stop



redirect to HTTS or serve HTTP?

curl -i
curl -i

HTTPS just works

curl -i
curl -i

what happens if you’re talking SSL to a non-existing vhost?

curl -i

check 301 on 404

curl -i
curl -i

HTTP additions vs fancy specific setups

prepare headers and footers

cd /var/www/html/
mkdir -p css/
echo '<p>header' > css/header.html
echo '<p>footer' > css/footer.html
touch check-file1
mkdir check-folder/
touch check-folder/check-file2

then enable fancy as http or server context

    location / {
        fancyindex on;
        fancyindex_exact_size off;
        #fancyindex_css_href /css/kult.custom.css;
        fancyindex_header /header.html;
        fancyindex_footer /footer.html;
        fancyindex_ignore favicon.ico robots.txt css/header.html css/footer.html css;
        #fancyindex_localtime off;
    autoindex on;

or just DIY

                        #add_before_body /css/header.html;
            sub_filter '<head><title>Index of $uri</title></head>' '<head><title>TITLE-HERE - $uri</title></head>';
            sub_filter '<h1>Index of $uri</h1>' '<h1 style="font-family:Courier;font-style:italic;text-transform:uppercase;">TITLE-HERE - $uri</h1>';
                        sub_filter_once on;

                        #add_after_body  /css/footer.html;
            sub_filter '</body>' '<div>SOME FOOTER HERE</div></body>';

Note: not adding a footer as some /body and /html would remain – the filter would not differenciate those I added and those from the directory listing.


Pitfalls and Common Mistakes

Getting Started

Syntax: server { … }

Default NGINX Configuration



substitution vs. additions vs. fancy

Module ngx_http_sub_module

Module ngx_http_addition_module

Beautiful listing of files and directories in nginx

Directory Theme


HTTP Strict Transport Security (HSTS) and NGINX

The Importance of a Proper HTTP Strict Transport Security Implementation on Your Web Server

dual cert

Integration Guide

Hybrid RSA and ECDSA certificates with NginX


Controlling NGINX Processes at Runtime

nginx -s stop and -s quit what is the difference?

Debugging Nginx Errors

Copyright © 2022 Pierre-Philipp Braun