Example Configuration

nginx.conf

user       www www;
worker_processes  5;
error_log  logs/error.log;
pid        logs/nginx.pid;
worker_rlimit_nofile 8192;
 
events {
  worker_connections  4096;
}
 
http {
  include    conf/mime.types;
  include    /etc/nginx/proxy.conf;
  include    /etc/nginx/fastcgi.conf;
  index    index.html index.htm index.php;
 
  default_type application/octet-stream;
  log_format   main '$remote_addr - $remote_user [$time_local]  $status '
    '"$request" $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';
  access_log   logs/access.log  main;
  sendfile     on;
  tcp_nopush   on;
  server_names_hash_bucket_size 128; # this seems to be required for some vhosts
 
  server { # php/fastcgi
    listen       80;
    server_name  domain1.com www.domain1.com;
    access_log   logs/domain1.access.log  main;
    root         html;
 
    location ~ \.php$ {
      fastcgi_pass   127.0.0.1:1025;
    }
  }
 
  server { # simple reverse-proxy
    listen       80;
    server_name  domain2.com www.domain2.com;
    access_log   logs/domain2.access.log  main;
 
    # serve static files
    location ~ ^/(images|javascript|js|css|flash|media|static)/  {
      root    /var/www/virtual/big.server.com/htdocs;
      expires 30d;
    }
 
    # pass requests for dynamic content to rails/turbogears/zope, et al
    location / {
      proxy_pass      http://127.0.0.1:8080;
    }
  }
 
  upstream big_server_com {
    server 127.0.0.3:8000 weight=5;
    server 127.0.0.3:8001 weight=5;
    server 192.168.0.1:8000;
    server 192.168.0.1:8001;
  }
 
  server { # simple load balancing
    listen          80;
    server_name     big.server.com;
    access_log      logs/big.server.access.log main;
 
    location / {
      proxy_pass      http://big_server_com;
    }
  }
} 

nginx.conf

  user  www www;
  worker_processes  2;
  pid /var/run/nginx.pid;
 
  # [ debug | info | notice | warn | error | crit ] 
  error_log  /var/log/nginx.error_log  info;
 
  events {
    worker_connections   2000;
    # use [ kqueue | rtsig | epoll | /dev/poll | select | poll ] ;
    use kqueue;
  }
 
  http {
    include       conf/mime.types;
    default_type  application/octet-stream;
 
    log_format main      '$remote_addr - $remote_user [$time_local]  '
      '"$request" $status $bytes_sent '
      '"$http_referer" "$http_user_agent" '
      '"$gzip_ratio"';
 
    log_format download  '$remote_addr - $remote_user [$time_local]  '
      '"$request" $status $bytes_sent '
      '"$http_referer" "$http_user_agent" '
      '"$http_range" "$sent_http_content_range"';
 
    client_header_timeout  3m;
    client_body_timeout    3m;
    send_timeout           3m;
 
    client_header_buffer_size    1k;
    large_client_header_buffers  4 4k;
 
    gzip on;
    gzip_min_length  1100;
    gzip_buffers     4 8k;
    gzip_types       text/plain;
 
    output_buffers   1 32k;
    postpone_output  1460;
 
    sendfile         on;
    tcp_nopush       on;
 
    tcp_nodelay      on;
    send_lowat       12000;
 
    keepalive_timeout  75 20;
 
    # lingering_time     30;
    # lingering_timeout  10;
    # reset_timedout_connection  on;
 
 
    server {
      listen        one.example.com;
      server_name   one.example.com  www.one.example.com;
 
      access_log   /var/log/nginx.access_log  main;
 
      location / {
        proxy_pass         http://127.0.0.1/;
        proxy_redirect     off;
 
        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        # proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
 
        client_max_body_size       10m;
        client_body_buffer_size    128k;
 
        client_body_temp_path      /var/nginx/client_body_temp;
 
        proxy_connect_timeout      90;
        proxy_send_timeout         90;
        proxy_read_timeout         90;
        proxy_send_lowat           12000;
 
        proxy_buffer_size          4k;
        proxy_buffers              4 32k;
        proxy_busy_buffers_size    64k;
        proxy_temp_file_write_size 64k;
 
        proxy_temp_path            /var/nginx/proxy_temp;
 
        charset  koi8-r;
      }
 
      error_page  404  /404.html;
 
      location /404.html {
        root  /spool/www;
 
        charset         on;
        source_charset  koi8-r;
      }
 
      location /old_stuff/ {
        rewrite   ^/old_stuff/(.*)$  /new_stuff/$1  permanent;
      }
 
      location /download/ {
        valid_referers  none  blocked  server_names  *.example.com;
 
        if ($invalid_referer) {
          #rewrite   ^/   http://www.example.com/;
          return   403;
        }
 
        # rewrite_log  on;
        # rewrite /download/*/mp3/*.any_ext to /download/*/mp3/*.mp3
        rewrite ^/(download/.*)/mp3/(.*)\..*$ /$1/mp3/$2.mp3 break;
 
        root         /spool/www;
        # autoindex    on;
        access_log   /var/log/nginx-download.access_log  download;
      }
 
      location ~* ^.+\.(jpg|jpeg|gif)$ {
        root         /spool/www;
        access_log   off;
        expires      30d;
      }
    }
  }

Auxilary Files

proxy_conf

proxy_redirect          off;
proxy_set_header        Host            $host;
proxy_set_header        X-Real-IP       $remote_addr;
proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
client_max_body_size    10m;
client_body_buffer_size 128k;
proxy_connect_timeout   90;
proxy_send_timeout      90;
proxy_read_timeout      90;
proxy_buffers           32 4k;

fastcgi_conf

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;
fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;
 
fastcgi_index  index.php;
 
fastcgi_param  REDIRECT_STATUS    200;

mime_types

types {
  text/html                             html htm shtml;
  text/css                              css;
  text/xml                              xml rss;
  image/gif                             gif;
  image/jpeg                            jpeg jpg;
  application/x-javascript              js;
  text/plain                            txt;
  text/x-component                      htc;
  text/mathml                           mml;
  image/png                             png;
  image/x-icon                          ico;
  image/x-jng                           jng;
  image/vnd.wap.wbmp                    wbmp;
  application/java-archive              jar war ear;
  application/mac-binhex40              hqx;
  application/pdf                       pdf;
  application/x-cocoa                   cco;
  application/x-java-archive-diff       jardiff;
  application/x-java-jnlp-file          jnlp;
  application/x-makeself                run;
  application/x-perl                    pl pm;
  application/x-pilot                   prc pdb;
  application/x-rar-compressed          rar;
  application/x-redhat-package-manager  rpm;
  application/x-sea                     sea;
  application/x-shockwave-flash         swf;
  application/x-stuffit                 sit;
  application/x-tcl                     tcl tk;
  application/x-x509-ca-cert            der pem crt;
  application/x-xpinstall               xpi;
  application/zip                       zip;
  application/octet-stream              deb;
  application/octet-stream              bin exe dll;
  application/octet-stream              dmg;
  application/octet-stream              eot;
  application/octet-stream              iso img;
  application/octet-stream              msi msp msm;
  audio/mpeg                            mp3;
  audio/x-realaudio                     ra;
  video/mpeg                            mpeg mpg;
  video/quicktime                       mov;
  video/x-flv                           flv;
  video/x-msvideo                       avi;
  video/x-ms-wmv                        wmv;
  video/x-ms-asf                        asx asf;
  video/x-mng                           mng;
}

Virtual Hosts Examples

Two Virtual Hosts, Serving Static Files

http {
  index index.html;
 
  server {
    server_name www.domain1.com;
    access_log logs/domain1.access.log main;
 
    root /var/www/domain1.com/htdocs;
  }
 
  server {
    server_name www.domain2.com;
    access_log  logs/domain2.access.log main;
 
    root /var/www/domain2.com/htdocs;
  }
}

A Default Catchall Virtual Host

http {
  index index.html;
 
  server {
    listen 80 default;
    server_name _;
    access_log logs/default.access.log main;
 
    server_name_in_redirect off;
 
    root  /var/www/default/htdocs;
  }
}

Wildcard Subdomains in a Parent Folder

This is just a really easy way to keep adding new subdomains, or to add new domains automatically when DNS records are pointed at the server. Note that I have included FCGI here as well. If you want to just serve static files, strip out the FCGI config and change the default document to index.html. Rather than creating a new vhost.conf file for every domain, just create one of these:

server {
  # Replace this port with the right one for your requirements
  listen 80 [default|default_server];  #could also be 1.2.3.4:80
 
  # Multiple hostnames separated by spaces.  Replace these as well.
  server_name star.yourdomain.com *.yourdomain.com; # Alternately: _
 
  root /PATH/TO/WEBROOT/$host;
 
  error_page 404 errors/404.html;
  access_log logs/star.yourdomain.com.access.log;
 
  index index.php index.html index.htm;
 
  # serve static files directly
  location ~* \.(jpg|jpeg|gif|css|png|js|ico|html)$ {
    access_log off;
    expires max;
  }
 
  location ~ \.php$ {
    include fastcgi_params;
    fastcgi_intercept_errors on;
    # By all means use a different server for the fcgi processes if you need to
    fastcgi_pass   127.0.0.1:YOURFCGIPORTHERE;
  }
 
  location ~ /\.ht {
    deny  all;
  }
}

Reconfiguring Apache

There are two main aspects of your Apache configuration that will need to be edited in order to allow both Apache and Nginx to work together at the same time. But let us first clarify where we are coming from, and what we are going towards.

Configuration overview

At this point, you probably have the following architecture set up on your server:

• A web server application running on port 80, such as Apache
• A dynamic server-side script processing application such as PHP, communicating with your web server via CGI, FastCGI, or as a server module

The new configuration that we are going towards will resemble the following:

• Nginx running on port 80
• Apache or another web server running on a different port, accepting requests coming from local sockets only
• The script processing application configuration will remain unchanged

As you can tell, only two main configuration changes will be applied to Apache as well as the other web server that you are running. Firstly, change the port number in order to avoid conflicts with Nginx, which will then be running as the frontend server. Secondly, (although this is optional) you may want to disallow requests coming from the outside and only allow requests forwarded by Nginx. Both configuration steps are detailed in the next sections.

Resetting the port number

Depending on how your web server was set up (manual build, automatic configuration from server panel managers such as cPanel, Plesk, and so on) you may find yourself with a lot of configuration files to edit. The main configuration file is often found in /etc/httpd/conf/ or /etc/apache2/, and there might be more depending on how your configuration is structured. Some server panel managers create extra configuration files for each virtual host.

There are three main elements you need to replace in your Apache configuration:

• The Listen directive is set to listen on port 80 by default. You will have to replace that port by another such as 8080. This directive is usually found in the main configuration file.
• You must make sure that the following configuration directive is present in the main configuration file: NameVirtualHost A.B.C.D:8080, where A.B.C.D is the IP address of the main network interface on which server communications go through.
• The port you just selected needs to be reported in all your virtual host configuration sections, as described below.

The virtual host sections must be transformed from the following template

<VirtualHost A.B.C.D:80>

  ServerName   example.com

  ServerAlias  www.example.com

  [...]

</VirtualHost>

to the following:

<VirtualHost A.B.C.D:8080>

  ServerName   example.com:8080

  ServerAlias  www.example.com

  [...]

</VirtualHost>

In this example, A.B.C.D is the IP address of the virtual host and example.com is the virtual host's name. The port must be edited on the first two lines.

Accepting local requests only

There are many ways you can restrict Apache to accept only local requests, denying access to the outside world. But first, why would you want to do that? As an extra layer positioned between the client and Apache, Nginx provides a certain comfort in terms of security. Visitors no longer have direct access to Apache, which decreases the potential risk regarding all security issues the web server may have. Globally, it's not necessarily a bad idea to only allow access to your frontend server.

The first method consists of changing the listening network interface in the main configuration file. The Listen directive of Apache lets you specify a port, but also an IP address, although, by default, no IP address is selected resulting in communications coming from all interfaces. All you have to do is replace the Listen 8080 directive by Listen 127.0.0.1:8080; Apache should then only listen on the local IP address. If you do not host Apache on the same server, you will need to specify the IP address of the network interface that can communicate with the server hosting Nginx.

The second alternative is to establish per-virtual-host restrictions:

<VirtualHost A.B.C.D:8080>

  ServerName example.com:8080

  ServerAlias www.example.com

  [...]

  Order deny,allow

  allow from 127.0.0.1

  allow from 192.168.0.1

  eny all

</VirtualHost>

Using the allow and deny Apache directives, you are able to restrict the allowed IP addresses accessing your virtual hosts. This allows for a finer configuration, which can be useful in case some of your websites cannot be fully served by Nginx.

Once all your changes are done, don't forget to reload the server to make sure the new configuration is applied, such as service httpd reload or /etc/init.d/ httpd reload.

Configuring Nginx

There are only a couple of simple steps to establish a working configuration of Nginx, although it can be tweaked more accurately as seen in the next section.

Enabling proxy options

The first step is to enable proxying of requests from your location blocks. Since the proxy_pass directive cannot be placed at the http or server level, you need to include it in every single place that you want to be forwarded. Usually, a location / { fallback block suffices since it encompasses all requests, except those that match location blocks containing a break statement.

Here is a simple example using a single static backend hosted on the same server:

server {

    server_name .example.com;

    root /home/example.com/www;

    [...]

    location / {

        proxy_pass http://127.0.0.1:8080;

    }

}

In the following example, we make use of an Upstream block allowing us to specify multiple servers:

upstream apache {

    server 192.168.0.1:80;

    server 192.168.0.2:80;

    server 192.168.0.3:80 weight=2;

    server 192.168.0.4:80 backup;

}

    server {

    server_name .example.com;

    root /home/example.com/www;

    [...]

    location / {

        proxy_pass http://apache;

    }

}

So far, with such a configuration, all requests are proxied to the backend server; we are now going to separate the content into two categories:

• Dynamic files: Files that require processing before being sent to the client, such as PHP, Perl, and Ruby scripts, will be served by Apache
• Static files: All other content that does not require additional processing, such as images, CSS files, static HTML files, and media, will be served directly by Nginx

We thus have to separate the content somehow to be provided by either server.

Separating content

In order to establish this separation, we can simply use two different location blocks—one that will match the dynamic file extensions and another one encompassing all the other files. This example passes requests for .php files to the proxy:

server {

    server_name .example.com;

    root /home/example.com/www;

    [...]

    location ~* \.php.$ {

      # Proxy all requests with an URI ending with .php*

      # (includes PHP, PHP3, PHP4, PHP5...)

        proxy_pass http://127.0.0.1:8080;

    }

    location / {

        # Your other options here for static content

        # for example cache control, alias...

        expires 30d;

    }

}

This method, although simple, will cause trouble with websites using URL rewriting. Most Web 2.0 websites now use links that hide file extensions such as http://example.com/articles/us-economy-strengthens/; some even replace file extensions with links resembling the following:http://example.com/useconomy- strengthens.html.

When building a reverse-proxy configuration, you have two options:

• Port your Apache rewrite rules to Nginx (usually found in the .htaccess file at the root of the website), in order for Nginx to know the actual file extension of the request and proxy it to Apache correctly.
• If you do not wish to port your Apache rewrite rules, the default behavior shown by Nginx is to return 404 errors for such requests. However, you can alter this behavior in multiple ways, for example, by handling 404 requests with the error_page directive or by testing the existence of files before serving them. Both solutions are detailed below.

Here is an implementation of this mechanism, using the error_page directive :

server {

    server_name .example.com;

    root /home/example.com/www;

    [...]

    location / {

        # Your static files are served here

        expires 30d;

        [...]

        # For 404 errors, submit the query to the @proxy

        # named location block

        error_page 404 @proxy;

    }


    location @proxy {

        proxy_pass http://127.0.0.1:8080;

    }

}

Alternatively, making use of the if directive from the Rewrite module:

server {

    server_name .example.com;

    root /home/example.com/www;

    [...]

    location / {

      # If the requested file extension ends with .php,

      # forward the query to Apache

      if ($request_filename ~* \.php.$) {

        break; # prevents further rewrites

        proxy_pass http://127.0.0.1:8080;

     }

     # If the requested file does not exist,

     # forward the query to Apache

     if (!-f $request_filename) {

       break; # prevents further rewrites

       proxy_pass http://127.0.0.1:8080;

    }

    # Your static files are served here

    expires 30d;

    }

}

There is no real performance difference between both solutions, as they will transfer the same amount of requests to the backend server. You should work on porting your Apache rewrite rules to Nginx if you are looking to get optimal performance.