NGINX — Field Manual

/etc/nginx/
├── nginx.conf              # Main config entry point
├── conf.d/                 # Additional config files (*.conf)
├── sites-available/        # Virtual host definitions (Debian style)
├── sites-enabled/          # Symlinks to active sites
├── snippets/               # Reusable config fragments
├── mime.types              # MIME type mappings
└── fastcgi_params          # FastCGI parameters

/var/log/nginx/
├── access.log              # All HTTP requests
└── error.log               # Errors and warnings

/var/www/html/              # Default web root
/run/nginx.pid              # PID file

main
└── events { }          # Connection processing settings
└── http { }            # HTTP/HTTPS traffic
    └── server { }      # Virtual host (one per domain)
        └── location { } # URL pattern matching
    └── upstream { }    # Load balancing pools

server_name example.com;              # 1. Exact
server_name *.example.com;            # 2. Wildcard prefix
server_name example.*;                # 3. Wildcard suffix
server_name ~^(www\.)?example\.com$; # 4. Regex
server_name _;                        # 5. Catch-all (default_server)

# Static site
location / {
    try_files $uri $uri/ =404;
}

# PHP app (e.g., Laravel, WordPress)
location / {
    try_files $uri $uri/ /index.php?$query_string;
}

# SPA (React, Vue, Angular)
location / {
    try_files $uri $uri/ /index.html;
}

# Named location fallback
location / {
    try_files $uri $uri/ @backend;
}
location @backend {
    proxy_pass http://127.0.0.1:3000;
}

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;

        # Pass real client info
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeouts
        proxy_connect_timeout 10s;
        proxy_read_timeout    30s;
        proxy_send_timeout    30s;

        # Buffer settings
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 16k;
    }
}

upstream app_servers {
    least_conn;                         # Method: least connections

    server 10.0.0.1:3000 weight=3;     # Gets 3x traffic
    server 10.0.0.2:3000 weight=1;
    server 10.0.0.3:3000 backup;       # Only used if others fail

    keepalive 32;                       # Keep connections open
}

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://app_servers;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

# Install Certbot
sudo apt install certbot python3-certbot-nginx -y

# Obtain certificate (modifies nginx config automatically)
sudo certbot --nginx -d example.com -d www.example.com

# Or: obtain only, configure manually
sudo certbot certonly --nginx -d example.com

# Test auto-renewal
sudo certbot renew --dry-run

# Redirect HTTP → HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

# HTTPS server
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Modern TLS settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # HSTS (1 year)
    add_header Strict-Transport-Security "max-age=31536000" always;

    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

http {
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;          # 1-9, sweet spot is 4-6
    gzip_min_length 256;        # Don't compress tiny responses
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        application/xml
        image/svg+xml
        font/woff2;
}

# Hashed assets (aggressive caching)
location ~* \.(js|css)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
}

# Images
location ~* \.(png|jpg|jpeg|gif|webp|ico|svg)$ {
    expires 30d;
    add_header Cache-Control "public";
}

# Fonts
location ~* \.(woff|woff2|ttf|eot)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    add_header Access-Control-Allow-Origin "*";
}

# HTML — short or no cache
location ~* \.html$ {
    expires -1;
    add_header Cache-Control "no-store, must-revalidate";
}

http {
    # Define zones (in http context)
    # 10mb zone stores ~160,000 IP states
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=login:10m   rate=5r/m;
    limit_req_status 429;
}

server {
    # General rate limit
    location / {
        limit_req zone=general burst=20 nodelay;
    }

    # Strict limit on login endpoint
    location /login {
        limit_req zone=login burst=3;
        proxy_pass http://backend;
    }
}

server {
    # Hide Nginx version from error pages and headers
    server_tokens off;

    # Prevent clickjacking
    add_header X-Frame-Options "SAMEORIGIN" always;

    # Prevent MIME type sniffing
    add_header X-Content-Type-Options "nosniff" always;

    # XSS protection (legacy, but still useful)
    add_header X-XSS-Protection "1; mode=block" always;

    # Referrer policy
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Permissions policy
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    # Content Security Policy (customize for your app)
    add_header Content-Security-Policy
        "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
        always;
}