my general nick is fd0, but various variations exist because they had been in use, so you can also see me as fd1, fd0` etc.

How to secure your website with haproxy, certbot and nginx

Nginx

Next thing to do is to install Nginx. This is also done the standard way, from the pkg repository:

root@host# pkg_add  nginx
quirks-2.414 signed on 2018-03-28T14:24:37Z
nginx-1.12.2: ok
The following new rcscripts were installed: /etc/rc.d/nginx
See rcctl(8) for details.
Look in /usr/local/share/doc/pkg-readmes for extra documentation.
root@host#

Now we start with a fresh configuration file

root@host# cd /etc/nginx
root@host# mv nginx.conf nginx.conf.distro

Use your favourite editor to create a conf file /etc/nginx/nginx.conf:

user  www;
worker_processes  5;

error_log  logs/error.log;

worker_rlimit_nofile 1024;
events {
    worker_connections  800;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    index         index.html index.htm;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    keepalive_timeout  65;

    #gzip  on;

    server_tokens off;

    server {
        listen       127.0.0.1:80;
        server_name  fd0.openbsd.amsterdam;
        real_ip_header X-Forwarded-For;
        set_real_ip_from 127.0.0.1;

        location / {
            root         /var/www/htdocs/fd0.openbsd.amsterdam;
        }
        access_log  logs/access_fd0.openbsd.amsterdam.log  main;
    }
}

One could ask “Why not use the default httpd and use an external tool?”

One of the answers is that the current httpd does not support different logformats for the access logs. In case of a reverse proxy, as is demonstrated here, the standard logformat does not work, since the ip address of the requestor is 127.0.0.1 for every request.

Up
Prev