Setup Nginx as web server and as reverse proxy for Apache with Virtualmin support

We know that Nginx is more faster than Apache and most of us prefer to replace Apache with Nginx as their web server. Nginx is known to serve faster static content and run with less RAM. As of this writing, Virtualmin supports Apache as its web server. To take advantage of Nginx, we will install it as reverse proxy for Apache and continue using Virtualmin to manage your domains. This guide also applies to Nginx+PHP FPM setup just skip the “Configure Apache” section and skip the “Configure Virtualmin” section if you are not using Virtualmin. Nginx configurations for virtual host are tailored for Drupal site and the following are the features:

Support for Virtualmin to manage domains.
Microcache support for anonymous and authenticated users.
Seamless upstream switch between reverse proxy to Apache and PHP FPM backends.
Script that aids to generate Nginx configuration from template for your web site domain (for those who don’t use Virtualmin).
Protections from: MIME type deviation, DoS attacks, bad bot/referrer user agents, clickjacking attacks, unauthorized access to private file directory and hotlinking.
Disabled access to any code files and known Drupal files and directories.
Better handling of static resources: css, cur, json, js, jpg/jpeg, gif, htc, ico, png, htm, html, xml, txt, otf, ttf, eot, woff, svg, webp, webm, zip, gz, tar, rar, pdf, pptx, mp3, ogg, flv, mp4, mpa.
Nginx PageSpeed support.
Boost module support.
Advanced CSS/JS Aggregation module support.
RobotsTxt module support.
XML Sitemap module support.
Advanced Help module support.
imagecache module support.
File Force Download module support.
Provision to support Filefield Nginx Progress module.
RSS feed support.
Supports Drupal 8, Drupal 7 and Durpal 6.
The configurations observes Nginx’s inheritance rules for add_header directives.
Protection against illegal HTTP methods (HEAD, GET and POST are only allowed).
The error_log is set to “error” level and access_log is disabled in this Nginx configurations to avoid spending disk IO time.
Implements Nginx PageSpeed module’s Shard domains technique for non-SSL sites.
Uses the Let’s Encrypt free SSL/TLS certificates.

The following procedures are tested on Linode server running Centos 7 64-bit Linux distribution.

Install Nginx

If you need to install Nginx with PageSpeed module please follow the steps here instead then jump to configure Nginx section.

In able to install the latest Nginx server we will need to register Nginx repository:

vi /etc/yum.repos.d/nginx.repo

1

vi /etc/yum.repos.d/nginx.repo

Have the following codes as its content:

name=nginx repo baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/ gpgcheck=0 priority=1 enabled=0

1
2
3
4
5

name=nginx repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=0
priority=1
enabled=0

Note: if just in case the nginx does not install try to hard code the $releasever with value of 7
Install Nginx using yum:

yum --enablerepo=nginx -y install nginx

1

yum --enablerepo=nginx -y install nginx
Make Nginx auto-start upon reboot:

chkconfig nginx on

1

chkconfig nginx on

Configure Nginx

We will not need the native Nginx configurations provided because we will create new configurations. Lets backup the original Nginx configurations first:

mv /etc/nginx /etc/nginx.bak

1

mv /etc/nginx /etc/nginx.bak
Create the folders following the directory structure shown below:
In the next steps, we will populate these folders with Nginx configurations. We will start populating each folder from bottom folder (utils) to top folder (apps).

Create the main Nginx file /etc/nginx/nginx.conf and copy the following scripts to this file:

user apache;

## This number should be, at maximum, the number of CPU cores on your system.
## (since nginx doesn't benefit from more than one worker per CPU.)
worker_processes auto;

## Only log errors
error_log  /var/log/nginx/error.log error;
pid /var/run/nginx.pid;

## Number of file descriptors used for Nginx.
## This is set in the OS with 'ulimit -n 200000'
## or using /etc/security/limits.conf
worker_rlimit_nofile 200000;

events {
  ## Determines how many clients will be served by each worker process.
  ## (worker_connections = 256 * worker_processes)
  ## worker_processes can be identified by `cat /proc/cpuinfo | grep processor`
  ## (Max clients = worker_connections * worker_processes)
  ## "Max clients" is also limited by the number of socket connections
  ## available on the system (~64k)
  worker_connections  1024;

  ## Accept as many connections as possible,
  ## after nginx gets notification about a new connection.
  ## May flood worker_connections, if that option is set too low.
  multi_accept on;
}

http {
  ## MIME types.
  include lib/mime.types;
  default_type application/octet-stream;

  ## Logs
  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
  ## Default log and error files.
  log_not_found off;
  error_log /var/log/nginx/error.log error;
  ## Buffer log writes to speed up IO, or disable them altogether
  #access_log /var/log/nginx/access.log main buffer=16k;
  #access_log /var/log/nginx/access.log;
  access_log off;

  ## Use sendfile() syscall to speed up I/O operations and speed up
  ## static file serving.
  ## Sendfile copies data between one FD and other from within the kernel.
  ## More efficient than read() + write(), since the requires transferring
  ## data to and from the user space.
  sendfile on;

  ## Handling of IPs in proxied and load balancing situations.
  set_real_ip_from 0.0.0.0/32; # all addresses get a real IP.
  real_ip_header X-Forwarded-For; # the ip is forwarded from the load balancer/proxy

  ## Limit Request/Connection
  ## Limit number of requests to mitigate DDoS attack
  limit_req_zone $binary_remote_addr zone=reqlimit:10m rate=60r/s;
  ## Define a zone for limiting the number of simultaneous
  ## connections nginx accepts. 1m means 32000 simultaneous
  ## sessions. We need to define for each server the limit_conn
  ## value referring to this or other zones.
  limit_conn_zone $binary_remote_addr zone=connlimit:5m;

  ## Timeouts.
  client_body_timeout 60s;
  client_header_timeout 60s;
  ## Timeout for keep-alive connections.
  ## Server will close connections after this time.
  keepalive_timeout 75 75;
  send_timeout 60s;
  ## Reset lingering timed out connections. Deflect DDoS.
  reset_timedout_connection on;

  ## TCP options.
  ## don't buffer data-sends (disable Nagle algorithm).
  ## Good for sending frequent small bursts of data in real time.
  tcp_nodelay on;
  ## Optimization of socket handling when using sendfile.
  ## Tcp_nopush causes nginx to attempt to send its HTTP response head in one packet,
  ## instead of using partial frames. This is useful for prepending headers
  ## before calling sendfile, or for throughput optimization.
  tcp_nopush on;

  ## Compression.
  ## Reduces the amount of data that needs to be transferred over the network
  gzip on;
  gzip_buffers 16 8k;
  gzip_comp_level 1;
  gzip_http_version 1.1;
  gzip_min_length 10;
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/x-icon application/vnd.ms-fontobject font/opentype application/x-javascript application/x-font-ttf text/x-js;
  gzip_vary on;
  gzip_proxied any; # Compression for all requests.
  ## No need for regexps. See
  ## http://wiki.nginx.org/NginxHttpGzipModule#gzip_disable
  gzip_disable "msie6";

  ## SSL
  ## Use a SSL/TLS cache for SSL session resume. This needs to be
  ## here (in this context, for session resumption to work. See this
  ## thread on the Nginx mailing list:
  ## http://nginx.org/pipermail/nginx/2010-November/023736.html.
  ## 1MB store about 4000 sessions:
  ## In this case, it store about 80000 sessions in 1 day
  ssl_session_cache shared:SSL:20m;
  ssl_session_timeout 1d;
  ## The server dictates the choice of cipher suites.
  ssl_prefer_server_ciphers on;
  ## Use only Perfect Forward Secrecy Ciphers. Fallback on non ECDH
  ## for crufty clients.
  ## Modern Mozilla SSL Configuration
  #ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
  #ssl_protocols TLSv1.2;
  ## Intermediate Mozilla SSL Configuration 
  ## https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.10.2&openssl=1.0.1e&hsts=no&profile=intermediate
  #ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
  ## No SSLv3 support (SSLv3 POODLE Vulnerability)
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ## Old Mozilla SSL Configuration 
  ## https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.10.2&openssl=1.0.1e&hsts=no&profile=old
  ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP';
  #ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ## Pregenerated Diffie-Hellman parameters 2048.
  ssl_dhparam key/dh_param.pem;
  ## Curve to use for ECDH.
  ssl_ecdh_curve prime256v1;
  ## Enable OCSP stapling. A better way to revocate server certificates.
  ssl_stapling on;
  ## Enable verification of OCSP stapling responses by the server.
  ssl_stapling_verify on;
  ## Server certificate and key (using Let's Encrypt free SSL certificate).
  ssl_certificate /etc/letsencrypt/live/yourwebsite.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/yourwebsite.com/privkey.pem;
  ## Verify chain of trust of OCSP response using Root CA and Intermediate certs
  ssl_trusted_certificate /etc/letsencrypt/live/yourwebsite.com/chain.pem;

  ## Use Google's DNS
  resolver 8.8.8.8 8.8.4.4;

  ## Body size.
  client_max_body_size 50m;

  ## To build optimal server_names_hash
  server_names_hash_bucket_size 72;

  ## If start getting [emerg]: could not build the map_hash,
  ##  you should increase map_hash_bucket_size: 64 in your
  ## logs. Cf. http://wiki.nginx.org/NginxOptimizations.
  #map_hash_bucket_size 192;

  ## Uncomment one of the lines below if you start getting this message:
  ## "[emerg] could not build the variables_hash, you should increase
  ## either variables_hash_max_size: 512 or variables_hash_bucket_size: 64"
  ## You only need to increase one. Increasing variables_hash_max_size to 1024
  ## was recommended in nginx forum by developers.
  ## See this forum topic and responses
  ## http://forum.nginx.org/read.php?2,192277,192286#msg-192286
  ## See http://wiki.nginx.org/HttpCoreModule#variables_hash_bucket_size
  ## The line variables_hash_bucket_size was added for completeness but not
  ## changed from default.
  #variables_hash_max_size 1024; # default 512
  #variables_hash_bucket_size 64; # default is 64

  ## For the filefield_nginx_progress module to work. From the
  ## README. Reserve 1MB under the name 'uploads' to track uploads.
  #upload_progress uploads 1m;

  ## Modify HTTP header
  include utils/mod_header.conf;
  ## Hide the Nginx version number.
  server_tokens off;

  ## Map
  ## Include the map to block HTTP methods.
  include map/block_http_methods.conf;
  ## Support the X-Forwarded-Proto header for fastcgi.
  include map/x_forwarded_proto.conf;
  ## Include blacklist for bad bot and referer blocking.
  include map/blacklist.conf;
  ## Include the Nginx stub status allowed hosts configuration block.
  include map/nginx_status_allowed_hosts.conf;
  ## Include list of allowed hosts to run cron
  include map/cron_allowed_hosts.conf;
  ## Include the php-fpm status allowed hosts configuration block.
  include map/php_fpm_status_allowed_hosts.conf;
  ## Include the caching setup.
  ## Needed for using Drupal with an external cache.
  include map/drupal_external_cache.conf;

  ## Include the upstream servers.
  include utils/service/upstream.conf;
  ## Microcache zone definition.
  include utils/service/microcache_zone.conf;

  ## Handle all undefined server_name
  include utils/undefined_server_name_handler.conf;

  ## Google PageSpeed module
  ## Uncomment the line below if Google PageSpeed module is present
  #include apps/pagespeed/core.conf;

  ## Include all vhosts.
  include sites-enabled/*.conf;
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

user apache;

## This number should be, at maximum, the number of CPU cores on your system.

## (since nginx doesn't benefit from more than one worker per CPU.)

worker_processes auto;

## Only log errors

error_log /var/log/nginx/error.log error;

pid /var/run/nginx.pid;

## Number of file descriptors used for Nginx.

## This is set in the OS with 'ulimit -n 200000'

## or using /etc/security/limits.conf

worker_rlimit_nofile 200000;

events {

## Determines how many clients will be served by each worker process.

## (worker_connections = 256 * worker_processes)

## worker_processes can be identified by `cat /proc/cpuinfo | grep processor`

## (Max clients = worker_connections * worker_processes)

## "Max clients" is also limited by the number of socket connections

## available on the system (~64k)

worker_connections 1024;

## Accept as many connections as possible,

## after nginx gets notification about a new connection.

## May flood worker_connections, if that option is set too low.

multi_accept on;

}

http {

## MIME types.

include lib/mime.types;

default_type application/octet-stream;

## Logs

log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for"';

## Default log and error files.

log_not_found off;

error_log /var/log/nginx/error.log error;

## Buffer log writes to speed up IO, or disable them altogether

#access_log /var/log/nginx/access.log main buffer=16k;

#access_log /var/log/nginx/access.log;

access_log off;

## Use sendfile() syscall to speed up I/O operations and speed up

## static file serving.

## Sendfile copies data between one FD and other from within the kernel.

## More efficient than read() + write(), since the requires transferring

## data to and from the user space.

sendfile on;

## Handling of IPs in proxied and load balancing situations.

set_real_ip_from 0.0.0.0/32; # all addresses get a real IP.

real_ip_header X-Forwarded-For; # the ip is forwarded from the load balancer/proxy

## Limit Request/Connection

## Limit number of requests to mitigate DDoS attack

limit_req_zone $binary_remote_addr zone=reqlimit:10m rate=60r/s;

## Define a zone for limiting the number of simultaneous

## connections nginx accepts. 1m means 32000 simultaneous

## sessions. We need to define for each server the limit_conn

## value referring to this or other zones.

limit_conn_zone $binary_remote_addr zone=connlimit:5m;

## Timeouts.

client_body_timeout 60s;

client_header_timeout 60s;

## Timeout for keep-alive connections.

## Server will close connections after this time.

keepalive_timeout 75 75;

send_timeout 60s;

## Reset lingering timed out connections. Deflect DDoS.

reset_timedout_connection on;

## TCP options.

## don't buffer data-sends (disable Nagle algorithm).

## Good for sending frequent small bursts of data in real time.

tcp_nodelay on;

## Optimization of socket handling when using sendfile.

## Tcp_nopush causes nginx to attempt to send its HTTP response head in one packet,

## instead of using partial frames. This is useful for prepending headers

## before calling sendfile, or for throughput optimization.

tcp_nopush on;

## Compression.

## Reduces the amount of data that needs to be transferred over the network

gzip on;

gzip_buffers 16 8k;

gzip_comp_level 1;

gzip_http_version 1.1;

gzip_min_length 10;

gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/x-icon application/vnd.ms-fontobject font/opentype application/x-javascript application/x-font-ttf text/x-js;

gzip_vary on;

gzip_proxied any; # Compression for all requests.

## No need for regexps. See

## http://wiki.nginx.org/NginxHttpGzipModule#gzip_disable

gzip_disable "msie6";

## SSL

## Use a SSL/TLS cache for SSL session resume. This needs to be

## here (in this context, for session resumption to work. See this

## thread on the Nginx mailing list:

## http://nginx.org/pipermail/nginx/2010-November/023736.html.

## 1MB store about 4000 sessions:

## In this case, it store about 80000 sessions in 1 day

ssl_session_cache shared:SSL:20m;

ssl_session_timeout 1d;

## The server dictates the choice of cipher suites.

ssl_prefer_server_ciphers on;

## Use only Perfect Forward Secrecy Ciphers. Fallback on non ECDH

## for crufty clients.

## Modern Mozilla SSL Configuration

#ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

#ssl_protocols TLSv1.2;

## Intermediate Mozilla SSL Configuration

## https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.10.2&openssl=1.0.1e&hsts=no&profile=intermediate

#ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';

## No SSLv3 support (SSLv3 POODLE Vulnerability)

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

## Old Mozilla SSL Configuration

## https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.10.2&openssl=1.0.1e&hsts=no&profile=old

ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP';

#ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;

## Pregenerated Diffie-Hellman parameters 2048.

ssl_dhparam key/dh_param.pem;

## Curve to use for ECDH.

ssl_ecdh_curve prime256v1;

## Enable OCSP stapling. A better way to revocate server certificates.

ssl_stapling on;

## Enable verification of OCSP stapling responses by the server.

ssl_stapling_verify on;

## Server certificate and key (using Let's Encrypt free SSL certificate).

ssl_certificate /etc/letsencrypt/live/yourwebsite.com/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/yourwebsite.com/privkey.pem;

## Verify chain of trust of OCSP response using Root CA and Intermediate certs

ssl_trusted_certificate /etc/letsencrypt/live/yourwebsite.com/chain.pem;

## Use Google's DNS

resolver 8.8.8.8 8.8.4.4;

## Body size.

client_max_body_size 50m;

## To build optimal server_names_hash

server_names_hash_bucket_size 72;

## If start getting [emerg]: could not build the map_hash,

## you should increase map_hash_bucket_size: 64 in your

## logs. Cf. http://wiki.nginx.org/NginxOptimizations.

#map_hash_bucket_size 192;

## Uncomment one of the lines below if you start getting this message:

## "[emerg] could not build the variables_hash, you should increase

## either variables_hash_max_size: 512 or variables_hash_bucket_size: 64"

## You only need to increase one. Increasing variables_hash_max_size to 1024

## was recommended in nginx forum by developers.

## See this forum topic and responses

## http://forum.nginx.org/read.php?2,192277,192286#msg-192286

## See http://wiki.nginx.org/HttpCoreModule#variables_hash_bucket_size

## The line variables_hash_bucket_size was added for completeness but not

## changed from default.

#variables_hash_max_size 1024; # default 512

#variables_hash_bucket_size 64; # default is 64

## For the filefield_nginx_progress module to work. From the

## README. Reserve 1MB under the name 'uploads' to track uploads.

#upload_progress uploads 1m;

## Modify HTTP header

include utils/mod_header.conf;

## Hide the Nginx version number.

server_tokens off;

## Map

## Include the map to block HTTP methods.

include map/block_http_methods.conf;

## Support the X-Forwarded-Proto header for fastcgi.

include map/x_forwarded_proto.conf;

## Include blacklist for bad bot and referer blocking.

include map/blacklist.conf;

## Include the Nginx stub status allowed hosts configuration block.

include map/nginx_status_allowed_hosts.conf;

## Include list of allowed hosts to run cron

include map/cron_allowed_hosts.conf;

## Include the php-fpm status allowed hosts configuration block.

include map/php_fpm_status_allowed_hosts.conf;

## Include the caching setup.

## Needed for using Drupal with an external cache.

include map/drupal_external_cache.conf;

## Include the upstream servers.

include utils/service/upstream.conf;

## Microcache zone definition.

include utils/service/microcache_zone.conf;

## Handle all undefined server_name

include utils/undefined_server_name_handler.conf;

## Google PageSpeed module

## Uncomment the line below if Google PageSpeed module is present

#include apps/pagespeed/core.conf;

## Include all vhosts.

include sites-enabled/*.conf;

}

Note: To generate the following SSL certificate files:

ssl_certificate /etc/letsencrypt/live/yourwebsite.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourwebsite.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/yourwebsite.com/chain.pem;

ssl_certificate /etc/letsencrypt/live/yourwebsite.com/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/yourwebsite.com/privkey.pem;

ssl_trusted_certificate /etc/letsencrypt/live/yourwebsite.com/chain.pem;

… follow steps in this article: Using Let’s Encrypt free SSL/TLS certificates with Nginx.

Lets populate /etc/nginx/utils:Create the file /etc/nginx/utils/undefined_server_name_handler.conf and copy the following scripts to this file:

## Prevent processing requests with undefined server names (HTTPS)
server {
  listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6
  server_name _;
  return 444;
}

## Prevent processing requests with undefined server names (HTTP)
server {
  listen XXX.XXX.XXX.XXX:80; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6
  server_name _;
  return 444;
}

## Prevent processing requests with undefined server names (HTTPS)
server {
  listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6
  server_name "";
  return 444;
}

## Prevent processing requests with undefined server names (HTTP)
server {
  listen XXX.XXX.XXX.XXX:80; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6
  server_name "";
  return 444;
}

## Prevent processing requests with undefined server names (HTTPS)

server {

listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6

server_name _;

return 444;

}

## Prevent processing requests with undefined server names (HTTP)

server {

listen XXX.XXX.XXX.XXX:80; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6

server_name _;

return 444;

}

## Prevent processing requests with undefined server names (HTTPS)

server {

listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6

server_name "";

return 444;

}

## Prevent processing requests with undefined server names (HTTP)

server {

listen XXX.XXX.XXX.XXX:80; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6

server_name "";

return 444;

}

Note: Replace all the occurrence of XXX.XXX.XXX.XXX with your server’s IPv4 address and XXXX:XXXX::XXXX:XXXX:XXXX:XXXX with your server’s IPv6 address.

Create the file /etc/nginx/utils/mod_header.conf and copy the following scripts to this file:

## Modify HTTP header

## Enable the builtin cross-site scripting (XSS) filter available
## in modern browsers.  Usually enabled by default we just
## reinstate in case it has been somehow disabled for this
## particular server instance.
## https://www.owasp.org/index.php/List_of_useful_HTTP_headers.
add_header X-XSS-Protection '1; mode=block';

## Enable clickjacking protection in modern browsers. Available in
## IE8 also. See
## https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header
## This may conflicts with pseudo streaming (at least with Nginx version 1.0.12).
## Uncomment the line below if you're not using media streaming.
## For sites being framing on the same domain uncomment the line below.
add_header X-Frame-Options SAMEORIGIN;
## For sites accepting to be framed in any context comment the
## line below.
#add_header X-Frame-Options DENY;

## When serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
## to disable content-type sniffing on some browsers.
## https://www.owasp.org/index.php/List_of_useful_HTTP_headers
## currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
## http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
## 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
## Block MIME type sniffing on IE.
add_header X-Content-Options nosniff;

## Add a cache miss/hit status header. This can be disabled if not including
## any of the apps/drupal/microcache* files.
add_header X-Micro-Cache $upstream_cache_status;

## Modify HTTP header

## Enable the builtin cross-site scripting (XSS) filter available

## in modern browsers. Usually enabled by default we just

## reinstate in case it has been somehow disabled for this

## particular server instance.

## https://www.owasp.org/index.php/List_of_useful_HTTP_headers.

add_header X-XSS-Protection '1; mode=block';

## Enable clickjacking protection in modern browsers. Available in

## IE8 also. See

## https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header

## This may conflicts with pseudo streaming (at least with Nginx version 1.0.12).

## Uncomment the line below if you're not using media streaming.

## For sites being framing on the same domain uncomment the line below.

add_header X-Frame-Options SAMEORIGIN;

## For sites accepting to be framed in any context comment the

## line below.

#add_header X-Frame-Options DENY;

## When serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,

## to disable content-type sniffing on some browsers.

## https://www.owasp.org/index.php/List_of_useful_HTTP_headers

## currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx

## http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx

## 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020

## Block MIME type sniffing on IE.

add_header X-Content-Options nosniff;

## Add a cache miss/hit status header. This can be disabled if not including

## any of the apps/drupal/microcache* files.

add_header X-Micro-Cache $upstream_cache_status;

Create the file /etc/nginx/utils/nginx_status_vhost.conf and copy the following scripts to this file:

## The configuration for Nginx status page. As described in
## http://wiki.nginx.org/HttpStubStatusModule.

## php-fpm provides a status and a heartbeat page that is served through the web server.
## Here's an example configuration for them.

## Get the nginx status.
location /nginx_status {
  if ($dont_show_nginx_status) {
    return 404;
  }
  stub_status on;
  access_log off;
}

## The configuration for Nginx status page. As described in

## http://wiki.nginx.org/HttpStubStatusModule.

## php-fpm provides a status and a heartbeat page that is served through the web server.

## Here's an example configuration for them.

## Get the nginx status.

location /nginx_status {

if ($dont_show_nginx_status) {

return 404;

}

stub_status on;

access_log off;

}

Create the file /etc/nginx/utils/apache/microcache.conf and copy the following scripts to this file:

## The cache zone referenced.
proxy_cache microcache;
## The cache key.
proxy_cache_key $scheme$host$request_uri;

## For 200 and 301 make the cache valid for 10 seconds.
proxy_cache_valid 200 301 10s;
## For 302 make it valid for 1 minute.
proxy_cache_valid 302 1m;
## For 404 make it valid 1 second.
proxy_cache_valid 404 1s;
## If there are any upstream errors or the item has expired use
## whatever it is available.
proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504 off;
## The Cache-Control and Expires headers should be delivered untouched
## from the upstream to the client.
proxy_ignore_headers Cache-Control Expires;
## Bypass the cache.
proxy_cache_bypass $no_cache;
proxy_no_cache $no_cache;

## To avoid any interaction with the cache control headers we expire
## everything on this location immediately.
expires epoch;

## Cache locking mechanism for protecting the backendof too many
## simultaneous requests.
proxy_cache_lock on;
## The default timeout, i.e., the time to way before forwarding the
## second request upstream if no reply as arrived in the meantime is 5s.
proxy_cache_lock_timeout 5000; # in miliseconds.

## The cache zone referenced.

proxy_cache microcache;

## The cache key.

proxy_cache_key $scheme$host$request_uri;

## For 200 and 301 make the cache valid for 10 seconds.

proxy_cache_valid 200 301 10s;

## For 302 make it valid for 1 minute.

proxy_cache_valid 302 1m;

## For 404 make it valid 1 second.

proxy_cache_valid 404 1s;

## If there are any upstream errors or the item has expired use

## whatever it is available.

proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504 off;

## The Cache-Control and Expires headers should be delivered untouched

## from the upstream to the client.

proxy_ignore_headers Cache-Control Expires;

## Bypass the cache.

proxy_cache_bypass $no_cache;

proxy_no_cache $no_cache;

## To avoid any interaction with the cache control headers we expire

## everything on this location immediately.

expires epoch;

## Cache locking mechanism for protecting the backendof too many

## simultaneous requests.

proxy_cache_lock on;

## The default timeout, i.e., the time to way before forwarding the

## second request upstream if no reply as arrived in the meantime is 5s.

proxy_cache_lock_timeout 5000; # in miliseconds.

Create the file /etc/nginx/utils/apache/microcache_auth.conf and copy the following scripts to this file:

## The cache zone referenced.
proxy_cache microcache;
## The cache key.
proxy_cache_key $cache_uid@$scheme$host$request_uri;

## For 200 and 301 make the cache valid for 10 seconds.
proxy_cache_valid 200 301 10s;
## For 302 make it valid for 1 minute.
proxy_cache_valid 302 1m;
## For 404 make it valid 1 second.
proxy_cache_valid 404 1s;
## If there are any upstream errors or the item has expired use
## whatever it is available.
proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504 off;
## The Cache-Control and Expires headers should be delivered untouched
## from the upstream to the client.
proxy_ignore_headers Cache-Control Expires;
proxy_pass_header Set-Cookie;
proxy_pass_header Cookie;
## Bypass the cache.
proxy_cache_bypass $no_auth_cache;
proxy_no_cache $no_auth_cache;

## To avoid any interaction with the cache control headers we expire
## everything on this location immediately.
expires epoch;

## Cache locking mechanism for protecting the backendof too many
## simultaneous requests.
proxy_cache_lock on;
## The default timeout, i.e., the time to way before forwarding the
## second request upstream if no reply as arrived in the meantime is 5s.
proxy_cache_lock_timeout 5000; # in miliseconds.

## The cache zone referenced.

proxy_cache microcache;

## The cache key.

proxy_cache_key $cache_uid@$scheme$host$request_uri;

## For 200 and 301 make the cache valid for 10 seconds.

proxy_cache_valid 200 301 10s;

## For 302 make it valid for 1 minute.

proxy_cache_valid 302 1m;

## For 404 make it valid 1 second.

proxy_cache_valid 404 1s;

## If there are any upstream errors or the item has expired use

## whatever it is available.

proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504 off;

## The Cache-Control and Expires headers should be delivered untouched

## from the upstream to the client.

proxy_ignore_headers Cache-Control Expires;

proxy_pass_header Set-Cookie;

proxy_pass_header Cookie;

## Bypass the cache.

proxy_cache_bypass $no_auth_cache;

proxy_no_cache $no_auth_cache;

## To avoid any interaction with the cache control headers we expire

## everything on this location immediately.

expires epoch;

## Cache locking mechanism for protecting the backendof too many

## simultaneous requests.

proxy_cache_lock on;

## The default timeout, i.e., the time to way before forwarding the

## second request upstream if no reply as arrived in the meantime is 5s.

proxy_cache_lock_timeout 5000; # in miliseconds.

Create the file /etc/nginx/utils/apache/microcache_zone.conf and copy the following scripts to this file:

## Defining the proxy cache zone for the microcache as presented at:
## http://fennb.com/microcaching-speed-your-app-up-250x-with-no-n.

## If youre using a Nginx version greater than 1.1.1 then you can
## tweak the Tweaking of the cache loader parameters.
## Cf. http://forum.nginx.org/read.php?21,213197,213209#msg-213209 for
## rationale.
proxy_cache_path /var/cache/nginx/microcache levels=1:2 keys_zone=microcache:5M max_size=1G loader_threshold=2592000000 loader_sleep=1 loader_files=100000;

## Defining the proxy cache zone for the microcache as presented at:

## http://fennb.com/microcaching-speed-your-app-up-250x-with-no-n.

## If youre using a Nginx version greater than 1.1.1 then you can

## tweak the Tweaking of the cache loader parameters.

## Cf. http://forum.nginx.org/read.php?21,213197,213209#msg-213209 for

## rationale.

proxy_cache_path /var/cache/nginx/microcache levels=1:2 keys_zone=microcache:5M max_size=1G loader_threshold=2592000000 loader_sleep=1 loader_files=100000;

Create the file /etc/nginx/utils/apache/php_fpm_status_vhost.conf and copy the following scripts to this file:

## This should be empty. Serves as dummy to prevent nginx non-existing file error.

1	## This should be empty. Serves as dummy to prevent nginx non-existing file error.

Create the file /etc/nginx/utils/apache/php_pass.conf and copy the following scripts to this file:

## Apache configuration
## Configuration for reverse proxy. Passing the necessary headers to
## the backend. Nginx doesn't tunnel the connection, it opens a new
## one. Hence we need to send these headers to the backend so that
## the client(s) IP is available to them. The host is also sent.

proxy_pass http://phpapache;
proxy_http_version 1.1; # keep alive to the Apache upstream
proxy_set_header Connection '';
## Referrer 
proxy_set_header Visitor-referrer $http_referer;
## Rewrite the 'Host' header to the value in the client request,
## or primary server name
proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
## Hide the X-Drupal-Cache header provided by Pressflow.
proxy_hide_header 'X-Drupal-Cache';
## Hide the Drupal 7 header X-Generator.
proxy_hide_header 'X-Generator';

## Apache configuration

## Configuration for reverse proxy. Passing the necessary headers to

## the backend. Nginx doesn't tunnel the connection, it opens a new

## one. Hence we need to send these headers to the backend so that

## the client(s) IP is available to them. The host is also sent.

proxy_pass http://phpapache;

proxy_http_version 1.1; # keep alive to the Apache upstream

proxy_set_header Connection '';

## Referrer

proxy_set_header Visitor-referrer $http_referer;

## Rewrite the 'Host' header to the value in the client request,

## or primary server name

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

## Hide the X-Drupal-Cache header provided by Pressflow.

proxy_hide_header 'X-Drupal-Cache';

## Hide the Drupal 7 header X-Generator.

proxy_hide_header 'X-Generator';

Create the file /etc/nginx/utils/apache/upstream.conf and copy the following scripts to this file:

## Upstream configuration for Apache functioning has a PHP handler.

## Add as many servers as needed.
## Cf. http://wiki.nginx.org/HttpUpstreamModule.
## Note that this configuration assumes by default that keepalive
## upstream connections are supported and that you have a Nginx
## version with the fair load balancer.

upstream phpapache {
  ## Use the least connection algorithm for load balancing. This
  ## algorithm was introduced in versions 1.3.1 and 1.2.2.
  least_conn;

  server 127.0.0.1:8080;
  #server 127.0.0.1:8081;
  ## Create a backend connection cache. Note that this requires
  ## Nginx version greater or equal to 1.1.4.
  ## Cf. http://nginx.org/en/CHANGES.
  keepalive 5;
}

## Upstream configuration for Apache functioning has a PHP handler.

## Add as many servers as needed.

## Cf. http://wiki.nginx.org/HttpUpstreamModule.

## Note that this configuration assumes by default that keepalive

## upstream connections are supported and that you have a Nginx

## version with the fair load balancer.

upstream phpapache {

## Use the least connection algorithm for load balancing. This

## algorithm was introduced in versions 1.3.1 and 1.2.2.

least_conn;

server 127.0.0.1:8080;

#server 127.0.0.1:8081;

## Create a backend connection cache. Note that this requires

## Nginx version greater or equal to 1.1.4.

## Cf. http://nginx.org/en/CHANGES.

keepalive 5;

}

Populate the /etc/nginx/utils/fastcgi folder under this guide: Setup PHP FPM for Nginx.

The /etc/nginx/sites-enabled folder is used as container for enabled websites which are soft link to physical file Nginx configuration of each of your website virtual host stored at /etc/nginx/sites-available/prod.

Lets populate /etc/nginx/sites-available:Create the file /etc/nginx/sites-available/template.conf and copy the following scripts to this file:

## Nginx configuration for {DOM}.

## Redirect HTTPS to HTTP (Domains used for static resource).
server {
  listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6
  server_name s1.{DOM} s2.{DOM} s3.{DOM} s4.{DOM};
  return 301 http://$server_name$request_uri;
}

## Domains used for static resource.
server {
  listen XXX.XXX.XXX.XXX:80; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6
  server_name s1.{DOM} s2.{DOM} s3.{DOM} s4.{DOM};

  ## Access and error logs.
  #access_log /var/log/virtualmin/{DOM}_nginx_access_log;
  access_log off;
  log_not_found off;
  error_log  /var/log/virtualmin/{DOM}_nginx_error_log error;

  ## Allow Let's Encrypt to access the temporary file
  location /.well-known/acme-challenge {
    root /var/www/letsencrypt;
  }

  ## Filesystem root of the site.
  root {HOME};

  ## Set no HTTP Strict Transport Security
  set $hsts "";

  ## Common Nginx configuration for server context
  include apps/drupal/common_server_context.conf;

  ## Named location
  include apps/drupal/named_location.conf;

  ## The 'default' location.
  location / {
    ## Redirect web content to main domain.
    location ~* .(html?|xml)$ {
      return 301 $scheme://www.{DOM}$request_uri;
    }

    ## Accept static files only.
    ## Drupal generated static files.
    include apps/drupal/static_files_handler.conf;
  }
}

## Redirect HTTPS to HTTP (Main server).
server {
  listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6
  server_name {DOM} www.{DOM};
  return 301 http://$server_name$request_uri;
}

## Redirect domain with prefixed www sub-domain.
server {
  ## This is to avoid the spurious if for sub-domain name
  ## "rewriting".
  listen XXX.XXX.XXX.XXX:80; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6
  server_name {DOM};
  return 301 $scheme://www.{DOM}$request_uri;
}

## Main server.
server {
  listen XXX.XXX.XXX.XXX:80; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6
  server_name www.{DOM};

  ## PageSpeed
  ## Uncomment the line below if Google PageSpeed module is present
  #pagespeed ShardDomain $scheme://$server_name $scheme://s1.{DOM},$scheme://s2.{DOM};

  ## Access and error logs.
  #access_log /var/log/virtualmin/{DOM}_nginx_access_log;
  access_log off;
  log_not_found off;
  error_log  /var/log/virtualmin/{DOM}_nginx_error_log error;

  ## Allow Let's Encrypt to access the temporary file
  location /.well-known/acme-challenge {
    root /var/www/letsencrypt;
  }

  ## Filesystem root of the site and index.
  root {HOME};
  index index.php;

  ## Set no HTTP Strict Transport Security
  set $hsts "";

  ## Configuration for Drupal.
  include apps/drupal/core.conf;

  ## Installation handling. If an already installed site there's
  ## no need to touch it. Uncomment the line below if you want to
  ## enable Drupal install PHP script and comment out after
  ## installation. Note that there's a basic auth in front as
  ## secondary line of defense.
  #include apps/drupal/drupal_install.conf;

  ## Configuration for updating the site via update.php and running
  ## cron externally. Uncomment the line below if you want to
  ## enable Drupal xmlrpc, update and cron PHP script
  #include apps/drupal/drupal_cron_update.conf;

  ## Support for upload progress bar. Configurations differ for
  ## Drupal 6 and Drupal 7.
  #include apps/drupal/drupal_upload_progress.conf;

  ## Including the php-fpm status and ping pages config.
  #include utils/service/php_fpm_status_vhost.conf;

  ## Including the Nginx stub status page for having stats about
  ## Nginx activity: http://wiki.nginx.org/HttpStubStatusModule.
  #include utils/nginx_status_vhost.conf;

  {TARGETED_SERVER_CONFIG}
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

## Nginx configuration for {DOM}.

## Redirect HTTPS to HTTP (Domains used for static resource).

server {

listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6

server_name s1.{DOM} s2.{DOM} s3.{DOM} s4.{DOM};

return 301 http://$server_name$request_uri;

}

## Domains used for static resource.

server {

listen XXX.XXX.XXX.XXX:80; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6

server_name s1.{DOM} s2.{DOM} s3.{DOM} s4.{DOM};

## Access and error logs.

#access_log /var/log/virtualmin/{DOM}_nginx_access_log;

access_log off;

log_not_found off;

error_log /var/log/virtualmin/{DOM}_nginx_error_log error;

## Allow Let's Encrypt to access the temporary file

location /.well-known/acme-challenge {

root /var/www/letsencrypt;

}

## Filesystem root of the site.

root {HOME};

## Set no HTTP Strict Transport Security

set $hsts "";

## Common Nginx configuration for server context

include apps/drupal/common_server_context.conf;

## Named location

include apps/drupal/named_location.conf;

## The 'default' location.

location / {

## Redirect web content to main domain.

location ~* .(html?|xml)$ {

return 301 $scheme://www.{DOM}$request_uri;

}

## Accept static files only.

## Drupal generated static files.

include apps/drupal/static_files_handler.conf;

}

## Redirect HTTPS to HTTP (Main server).

server {

listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6

server_name {DOM} www.{DOM};

return 301 http://$server_name$request_uri;

}

## Redirect domain with prefixed www sub-domain.

server {

## This is to avoid the spurious if for sub-domain name

## "rewriting".

listen XXX.XXX.XXX.XXX:80; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6

server_name {DOM};

return 301 $scheme://www.{DOM}$request_uri;

}

## Main server.

server {

listen XXX.XXX.XXX.XXX:80; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6

server_name www.{DOM};

## PageSpeed

## Uncomment the line below if Google PageSpeed module is present

#pagespeed ShardDomain $scheme://$server_name $scheme://s1.{DOM},$scheme://s2.{DOM};

## Access and error logs.

#access_log /var/log/virtualmin/{DOM}_nginx_access_log;

access_log off;

log_not_found off;

error_log /var/log/virtualmin/{DOM}_nginx_error_log error;

## Allow Let's Encrypt to access the temporary file

location /.well-known/acme-challenge {

root /var/www/letsencrypt;

}

## Filesystem root of the site and index.

root {HOME};

index index.php;

## Set no HTTP Strict Transport Security

set $hsts "";

## Configuration for Drupal.

include apps/drupal/core.conf;

## Installation handling. If an already installed site there's

## no need to touch it. Uncomment the line below if you want to

## enable Drupal install PHP script and comment out after

## installation. Note that there's a basic auth in front as

## secondary line of defense.

#include apps/drupal/drupal_install.conf;

## Configuration for updating the site via update.php and running

## cron externally. Uncomment the line below if you want to

## enable Drupal xmlrpc, update and cron PHP script

#include apps/drupal/drupal_cron_update.conf;

## Support for upload progress bar. Configurations differ for

## Drupal 6 and Drupal 7.

#include apps/drupal/drupal_upload_progress.conf;

## Including the php-fpm status and ping pages config.

#include utils/service/php_fpm_status_vhost.conf;

## Including the Nginx stub status page for having stats about

## Nginx activity: http://wiki.nginx.org/HttpStubStatusModule.

#include utils/nginx_status_vhost.conf;

{TARGETED_SERVER_CONFIG}

}

Note: Replace all the occurrence of XXX.XXX.XXX.XXX with your server’s IPv4 address and XXXX:XXXX::XXXX:XXXX:XXXX:XXXX with your server’s IPv6 address.

Create the file /etc/nginx/sites-available/template_ssl.conf and copy the following scripts to this file:

## Nginx configuration for {DOM}.

## Redirect HTTP to HTTPS.
server {
  listen XXX.XXX.XXX.XXX:80; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6
  server_name {DOM} www.{DOM};

  set $nossl 0;
  if ($request_uri ~* /.well-known/acme-challenge/.+) {
    ## Override redirection to HTTPS
    set $nossl 1;
  }
  if ($nossl = 0){
    ## Redirect to HTTPS.
    return 301 https://$server_name$request_uri;
  }
  ## Allow Let's Encrypt to access the temporary file
  location /.well-known/acme-challenge {
    root /var/www/letsencrypt;
  }
}

## HTTPS (Redirect domain with prefixed www sub-domain).
server {
  listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6
  server_name {DOM};

  ## Access and error logs.
  #access_log /var/log/virtualmin/{DOM}_nginx_access_log;
  access_log off;
  log_not_found off;
  error_log  /var/log/virtualmin/{DOM}_nginx_error_log error;

  ## Config to enable HSTS (HTTP Strict Transport Security)
  ## https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
  ## to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
  ## Strict Transport Security header for enhanced security. See
  ## http://www.chromium.org/sts. Enables HTTP to HTTPS redirects via browser level.
  set $hsts "max-age=31536000";
  add_header Strict-Transport-Security $hsts;
  ## Inheritance Rules for add_header Directives
  ## Because this 'server' block contains another 'add_header' directive,
  ## we must redeclare the 'add_header' from 'http' context
  include utils/mod_header.conf;

  return 301 $scheme://www.{DOM}$request_uri;
}

## HTTPS (Main server).
server {
  listen XXX.XXX.XXX.XXX:443 ssl http2; ## IPv4
  listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl http2; ## IPv6
  server_name www.{DOM};

  ## Access and error logs.
  #access_log /var/log/virtualmin/{DOM}_nginx_access_log;
  access_log off;
  log_not_found off;
  error_log  /var/log/virtualmin/{DOM}_nginx_error_log error;

  ## Config to enable HSTS (HTTP Strict Transport Security)
  ## https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
  ## to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
  ## Strict Transport Security header for enhanced security. See
  ## http://www.chromium.org/sts. Enables HTTP to HTTPS redirects via browser level.
  set $hsts "max-age=31536000";
  add_header Strict-Transport-Security $hsts;
  ## Inheritance Rules for add_header Directives
  ## Because this 'server' block contains another 'add_header' directive,
  ## we must redeclare the 'add_header' from 'http' context
  include utils/mod_header.conf;

  ## Filesystem root of the site and index.
  root {HOME};
  index index.php;

  ## Configuration for Drupal.
  include apps/drupal/core.conf;

  ## Installation handling. If an already installed site there's
  ## no need to touch it. Uncomment the line below if you want to
  ## enable Drupal install PHP script and comment out after
  ## installation. Note that there's a basic auth in front as
  ## secondary line of defense.
  #include apps/drupal/drupal_install.conf;

  ## Configuration for updating the site via update.php and running
  ## cron externally. Uncomment the line below if you want to
  ## enable Drupal xmlrpc, update and cron PHP script
  #include apps/drupal/drupal_cron_update.conf;

  ## Support for upload progress bar. Configurations differ for
  ## Drupal 6 and Drupal 7.
  #include apps/drupal/drupal_upload_progress.conf;

  ## Including the php-fpm status and ping pages config.
  #include utils/service/php_fpm_status_vhost.conf;

  ## Including the Nginx stub status page for having stats about
  ## Nginx activity: http://wiki.nginx.org/HttpStubStatusModule.
  #include utils/nginx_status_vhost.conf;

  {TARGETED_SERVER_CONFIG}
}

100

101

102

103

104

105

106

## Nginx configuration for {DOM}.

## Redirect HTTP to HTTPS.

server {

listen XXX.XXX.XXX.XXX:80; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:80; ## IPv6

server_name {DOM} www.{DOM};

set $nossl 0;

if ($request_uri ~* /.well-known/acme-challenge/.+) {

## Override redirection to HTTPS

set $nossl 1;

}

if ($nossl = 0){

## Redirect to HTTPS.

return 301 https://$server_name$request_uri;

}

## Allow Let's Encrypt to access the temporary file

location /.well-known/acme-challenge {

root /var/www/letsencrypt;

}

## HTTPS (Redirect domain with prefixed www sub-domain).

server {

listen XXX.XXX.XXX.XXX:443 ssl; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl; ## IPv6

server_name {DOM};

## Access and error logs.

#access_log /var/log/virtualmin/{DOM}_nginx_access_log;

access_log off;

log_not_found off;

error_log /var/log/virtualmin/{DOM}_nginx_error_log error;

## Config to enable HSTS (HTTP Strict Transport Security)

## https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security

## to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping

## Strict Transport Security header for enhanced security. See

## http://www.chromium.org/sts. Enables HTTP to HTTPS redirects via browser level.

set $hsts "max-age=31536000";

add_header Strict-Transport-Security $hsts;

## Inheritance Rules for add_header Directives

## Because this 'server' block contains another 'add_header' directive,

## we must redeclare the 'add_header' from 'http' context

include utils/mod_header.conf;

return 301 $scheme://www.{DOM}$request_uri;

}

## HTTPS (Main server).

server {

listen XXX.XXX.XXX.XXX:443 ssl http2; ## IPv4

listen [XXXX:XXXX::XXXX:XXXX:XXXX:XXXX]:443 ssl http2; ## IPv6

server_name www.{DOM};

## Access and error logs.

#access_log /var/log/virtualmin/{DOM}_nginx_access_log;

access_log off;

log_not_found off;

error_log /var/log/virtualmin/{DOM}_nginx_error_log error;

## Config to enable HSTS (HTTP Strict Transport Security)

## https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security

## to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping

## Strict Transport Security header for enhanced security. See

## http://www.chromium.org/sts. Enables HTTP to HTTPS redirects via browser level.

set $hsts "max-age=31536000";

add_header Strict-Transport-Security $hsts;

## Inheritance Rules for add_header Directives

## Because this 'server' block contains another 'add_header' directive,

## we must redeclare the 'add_header' from 'http' context

include utils/mod_header.conf;

## Filesystem root of the site and index.

root {HOME};

index index.php;

## Configuration for Drupal.

include apps/drupal/core.conf;

## Installation handling. If an already installed site there's

## no need to touch it. Uncomment the line below if you want to

## enable Drupal install PHP script and comment out after

## installation. Note that there's a basic auth in front as

## secondary line of defense.

#include apps/drupal/drupal_install.conf;

## Configuration for updating the site via update.php and running

## cron externally. Uncomment the line below if you want to

## enable Drupal xmlrpc, update and cron PHP script

#include apps/drupal/drupal_cron_update.conf;

## Support for upload progress bar. Configurations differ for

## Drupal 6 and Drupal 7.

#include apps/drupal/drupal_upload_progress.conf;

## Including the php-fpm status and ping pages config.

#include utils/service/php_fpm_status_vhost.conf;

## Including the Nginx stub status page for having stats about

## Nginx activity: http://wiki.nginx.org/HttpStubStatusModule.

#include utils/nginx_status_vhost.conf;

{TARGETED_SERVER_CONFIG}

}

Note: Replace all the occurrence of XXX.XXX.XXX.XXX with your server’s IPv4 address and XXXX:XXXX::XXXX:XXXX:XXXX:XXXX with your server’s IPv6 address.

The two scripts above /etc/nginx/sites-available/template.conf and /etc/nginx/sites-available/template_ssl.conf will be used by the Virtualmin to generate Nginx configuration for your website virtual host when created using Virtualmin. By default, these configurations utilizes the use of Drush for site maintenance. If you wanted the original Drupal behavior in installing new site, uncomment the line:

include apps/drupal/drupal_install.conf;

1	include apps/drupal/drupal_install.conf;

For original Drupal cron and update behavior, uncomment the line:

include apps/drupal/drupal_cron_update.conf;

1	include apps/drupal/drupal_cron_update.conf;

Note: This uses Basic Authentication so it will challenge you for password.

If you are not using Virtualmin, you can use the following bash script to create Nginx configuration for your website virtual host. Create the file /etc/nginx/sites-available/buildsitesconf.sh and add the following to it:

#!/bin/bash

SITES=('yourwebsite.com' 'yourotherwebsite.com')
SITEHOME='/home/drupal/public_html'
for SITEDOM in "${SITES[@]}"
do
  sed "s/{DOM}/$SITEDOM/g" template.conf > buffer.conf
  sed "s/{HOME}/$SITEHOME/g" buffer.conf > "prod/${SITEDOM}.conf"
  
  sed "s/{DOM}/$SITEDOM/g" template_ssl.conf > buffer.conf
  sed "s/{HOME}/$SITEHOME/g" buffer.conf > "prod/${SITEDOM}_ssl.conf"

  if [ -f "targeted_server_config/${SITEDOM}.conf" ]
  then
    sed "s/{TARGETED_SERVER_CONFIG}/include sites-available/targeted_server_config/${SITEDOM}.conf;/g" "prod/${SITEDOM}.conf" > buffer.conf
    cat buffer.conf > "prod/${SITEDOM}.conf"
    sed "s/{TARGETED_SERVER_CONFIG}/include sites-available/targeted_server_config/${SITEDOM}.conf;/g" "prod/${SITEDOM}_ssl.conf" > buffer.conf
    cat buffer.conf > "prod/${SITEDOM}_ssl.conf"
  else
    sed "s/{TARGETED_SERVER_CONFIG}//g" "prod/${SITEDOM}.conf" > buffer.conf
    cat buffer.conf > "prod/${SITEDOM}.conf"
    sed "s/{TARGETED_SERVER_CONFIG}//g" "prod/${SITEDOM}_ssl.conf" > buffer.conf
    cat buffer.conf > "prod/${SITEDOM}_ssl.conf"
  fi
done
rm -f buffer.conf

#!/bin/bash

SITES=('yourwebsite.com' 'yourotherwebsite.com')

SITEHOME='/home/drupal/public_html'

for SITEDOM in "${SITES[@]}"

sed "s/{DOM}/$SITEDOM/g" template.conf > buffer.conf

sed "s/{HOME}/$SITEHOME/g" buffer.conf > "prod/${SITEDOM}.conf"

sed "s/{DOM}/$SITEDOM/g" template_ssl.conf > buffer.conf

sed "s/{HOME}/$SITEHOME/g" buffer.conf > "prod/${SITEDOM}_ssl.conf"

if [ -f "targeted_server_config/${SITEDOM}.conf" ]

then

sed "s/{TARGETED_SERVER_CONFIG}/include sites-available/targeted_server_config/${SITEDOM}.conf;/g" "prod/${SITEDOM}.conf" > buffer.conf

cat buffer.conf > "prod/${SITEDOM}.conf"

sed "s/{TARGETED_SERVER_CONFIG}/include sites-available/targeted_server_config/${SITEDOM}.conf;/g" "prod/${SITEDOM}_ssl.conf" > buffer.conf

cat buffer.conf > "prod/${SITEDOM}_ssl.conf"

else

sed "s/{TARGETED_SERVER_CONFIG}//g" "prod/${SITEDOM}.conf" > buffer.conf

cat buffer.conf > "prod/${SITEDOM}.conf"

sed "s/{TARGETED_SERVER_CONFIG}//g" "prod/${SITEDOM}_ssl.conf" > buffer.conf

cat buffer.conf > "prod/${SITEDOM}_ssl.conf"

done

rm -f buffer.conf

Note: Replace the 'yourwebsite.com' 'yourotherwebsite.com' with your own website domains and '/home/drupal/public_html' with your websites’ root path (eg. if your websites’ root path is /var/www then change it to '/var/www').

Make it executable:

chmod +x /etc/nginx/sites-available/buildsitesconf.sh

1	chmod +x /etc/nginx/sites-available/buildsitesconf.sh

When you executed this script, it will generate non-SSL and SSL versions of Nginx configuration for your website virtual hosts that you defined at /etc/nginx/sites-available/buildsitesconf.sh. The generated Nginx configuration will be saved at /etc/nginx/sites-available/prod.

To enable a non-SSL version virtual host Nginx configuration, just create a soft link of this configuration file from /etc/nginx/sites-available/prod to /etc/nginx/sites-enabled example:

ln -s /etc/nginx/sites-available/prod/yourwebsite.com.conf /etc/nginx/sites-enabled/yourwebsite.com.conf

1	ln -s /etc/nginx/sites-available/prod/yourwebsite.com.conf /etc/nginx/sites-enabled/yourwebsite.com.conf

… or if SSL version is desired:

ln -s /etc/nginx/sites-available/prod/yourwebsite_ssl.com.conf /etc/nginx/sites-enabled/yourwebsite_ssl.com.conf

1	ln -s /etc/nginx/sites-available/prod/yourwebsite_ssl.com.conf /etc/nginx/sites-enabled/yourwebsite_ssl.com.conf

This is easy and good approach to disable and enable a virtual host.

The /etc/nginx/sites-available/prod folder will be used by the /etc/nginx/sites-available/template.conf and /etc/nginx/sites-available/template_ssl.conf scripts as container for the generated Nginx configuration of your website virtual host.

The /etc/nginx/sites-available/admin folder will be used for Admin UI Nginx configurations like:

The /etc/nginx/sites-available/targeted_server_config folder will be used by the /etc/nginx/sites-available/template.conf and /etc/nginx/sites-available/template_ssl.conf scripts to look for the filename that will match the domain under process. e.g. if the template script processing the domain “webfoobar.com”, it will look for a filename “webfoobar.com.conf” and this should only contain your custom Nginx configuration for “webfoobar.com” domain in server context. Domains that don’t have custom Nginx configuration need not to create file under this folder.

Lets populate /etc/nginx/map:Create the file /etc/nginx/map/php_fpm_status_allowed_hosts.conf and add the following to it:

## Configuration of php-fpm status and ping pages. Here we define the
## allowed hosts using the Geo Module. http://wiki.nginx.org/HttpGeoModule

geo $dont_show_fpm_status {
  default 1;
  127.0.0.1 0; # allow on the loopback
  192.168.1.0/24 0; # allow on an internal network
}

## Configuration of php-fpm status and ping pages. Here we define the

## allowed hosts using the Geo Module. http://wiki.nginx.org/HttpGeoModule

geo $dont_show_fpm_status {

default 1;

127.0.0.1 0; # allow on the loopback

192.168.1.0/24 0; # allow on an internal network

}

Create the file /etc/nginx/map/nginx_status_allowed_hosts.conf and add the following to it:

## Configuration of nginx stub status page. Here we define the
## allowed hosts using the Geo Module. http://wiki.nginx.org/HttpGeoModule

geo $dont_show_nginx_status {
  default 1;
  127.0.0.1 0; # allow on the loopback
  192.168.1.0/24 0; # allow on an internal network
}

## Configuration of nginx stub status page. Here we define the

## allowed hosts using the Geo Module. http://wiki.nginx.org/HttpGeoModule

geo $dont_show_nginx_status {

default 1;

127.0.0.1 0; # allow on the loopback

192.168.1.0/24 0; # allow on an internal network

}

Create the file /etc/nginx/map/hotlinking_protection_allowed_hosts.conf and add the following to it:

## Hotlinking protection for images. Include it in any context you
## want. Adjust the list of allowed referrers to your liking.

valid_referers none blocked
  www.yahoo.com
  www.google.com
  webfoobar.com
  www.webfoobar.com
  ## Add your domains here;

if ($invalid_referer) {
  return 200 "No image hotlinking allowed!n";
}

## Hotlinking protection for images. Include it in any context you

## want. Adjust the list of allowed referrers to your liking.

valid_referers none blocked

www.yahoo.com

www.google.com

webfoobar.com

www.webfoobar.com

## Add your domains here;

if ($invalid_referer) {

return 200 "No image hotlinking allowed!n";

}

Create the file /etc/nginx/map/drupal_external_cache.conf and add the following to it:

## Testing if we should be serving content from cache or not. This is
## needed for any Drupal setup that uses an external cache.

## Let Ajax calls go through.
map $uri $no_cache_ajax {
  default 0;
  /system/ajax 1;
}

## Test Boost session cookie being present. If there is, then no
## caching is to be done.
map $http_cookie $no_boost_cache_cookie {
  default 0;
  ~DRUPAL_UID 1;
  #~nocache=1 1; # Custom logged in/out indicator
}
## Boost URI watch list
map $request_uri $no_boost_cache_uri {
  default 0;
  ~*^/(admin|cache|misc|modules|sites|system|openid|themes|node/add|comment/reply)|(/(edit|user|user/(login|password|register)))$ 1;
}
## Combine both results to get the cache bypassing mapping.
map $no_boost_cache_cookie$no_boost_cache_uri $no_boost_cache {
  default 1;
  00 0;
}

## Testing for the session cookie being present. If there is, then no
## caching is to be done. Note that this is for someone using either
## Drupal 7 pressflow or stock Drupal 6 core with no_anon
## (https://drupal.org/project/no_anon).
map $http_cookie $no_cache_cookie {
  default 0;
  ~SESS 1; # PHP session cookie
  #~nocache=1 1; # Custom logged in/out indicator
}

## Combine both results to get the cache bypassing mapping.
map $no_cache_ajax$no_cache_cookie $no_auth_cache {
  default 1;
  00 0;
}

## Cache bypassing mapping (auth).
map $no_cache_ajax $no_cache {
  default 0;
  1 1;
}

## Set a cache_uid variable for authenticated users.
map $http_cookie $cache_uid {
  default nil;
  ~SESS[[:alnum:]]+=(?[[:graph:]]+) $session_id;
}

## Testing if we should be serving content from cache or not. This is

## needed for any Drupal setup that uses an external cache.

## Let Ajax calls go through.

map $uri $no_cache_ajax {

default 0;

/system/ajax 1;

}

## Test Boost session cookie being present. If there is, then no

## caching is to be done.

map $http_cookie $no_boost_cache_cookie {

default 0;

~DRUPAL_UID 1;

#~nocache=1 1; # Custom logged in/out indicator

}

## Boost URI watch list

map $request_uri $no_boost_cache_uri {

default 0;

}

## Combine both results to get the cache bypassing mapping.

map $no_boost_cache_cookie$no_boost_cache_uri $no_boost_cache {

default 1;

00 0;

}

## Testing for the session cookie being present. If there is, then no

## caching is to be done. Note that this is for someone using either

## Drupal 7 pressflow or stock Drupal 6 core with no_anon

## (https://drupal.org/project/no_anon).

map $http_cookie $no_cache_cookie {

default 0;

~SESS 1; # PHP session cookie

#~nocache=1 1; # Custom logged in/out indicator

}

## Combine both results to get the cache bypassing mapping.

map $no_cache_ajax$no_cache_cookie $no_auth_cache {

default 1;

00 0;

}

## Cache bypassing mapping (auth).

map $no_cache_ajax $no_cache {

default 0;

1 1;

}

## Set a cache_uid variable for authenticated users.

map $http_cookie $cache_uid {

default nil;

~SESS[[:alnum:]]+=(?[[:graph:]]+) $session_id;

}

Note: You can also use the Method 1 mentioned here: Methods to disable Nginx cache when user is authenticated in Drupal as I find it more reliable indicator for user status: anonymous or authenticated.

Create the file /etc/nginx/map/cron_allowed_hosts.conf and add the following to it:

## Configuration file for specifying which hosts can invoke Drupal's
## cron. This only applies if you're not using drush to run cron.

geo $not_allowed_cron {
  default 1;
  ## Add your set of hosts.
  127.0.0.1 0; # allow the localhost
  192.168.1.0/24 0; # allow on an internal network
}

## Configuration file for specifying which hosts can invoke Drupal's

## cron. This only applies if you're not using drush to run cron.

geo $not_allowed_cron {

default 1;

## Add your set of hosts.

127.0.0.1 0; # allow the localhost

192.168.1.0/24 0; # allow on an internal network

}

Create the file /etc/nginx/map/block_http_methods.conf and add the following to it:

## This file contains a map directive that is used to block the
## invocation of HTTP methods. Out of the box it allows for HEAD, GET and POST.

map $request_method $not_allowed_method {
  default 1;
  GET 0;
  HEAD 0;
  POST 0;
}

## This file contains a map directive that is used to block the

## invocation of HTTP methods. Out of the box it allows for HEAD, GET and POST.

map $request_method $not_allowed_method {

default 1;

GET 0;

HEAD 0;

POST 0;

}

Create the file /etc/nginx/map/x_forwarded_proto.conf and add the following to it:

## Support the X-Forwarded-Proto header for fastcgi.
map $http_x_forwarded_proto $fastcgi_https {
  default $https;
  http '';
  https on;
}

## Support the X-Forwarded-Proto header for fastcgi.

map $http_x_forwarded_proto $fastcgi_https {

default $https;

http '';

https on;

}

Create the file /etc/nginx/map/blacklist.conf and add the following to it:

## This file implements a blacklist for certain user agents and
## referrers. It's a first line of defence. It must be included
## inside a http block.

## Add here all user agents that are to be blocked.
map $http_user_agent $bad_bot {
  default 0;
  ~*^Lynx 0; # Let Lynx go through
  libwww-perl                      1;
  ~*(?i)(360Spider|80legs|Abonti|Aboundex|^AIBOT|^Alexibot|almaden|^Anarchie|^ASPSeek|^asterias|^attach|^autoemailspider|^BackWeb|Baiduspider|^Bandit|^BatchFTP|BBBike|^BackDoorBot|^Bigfoot|^Black.Hole|^BlackWidow|^BlowFish|^Bot mailto:craftbot@yahoo.com|^BotALot|^Buddy|^BuiltBotTough|^Bullseye|^bumblebee|^BunnySlippers|^Cegbfeieh|^CheeseBot|^CherryPicker|^ChinaClaw|^CICC|Cogentbot|^Collector|^Copier|^CopyRightCheck|^cosmos|CPython|^Crescent|^Custo|^DA|^DIIbot|^DISCo|^DISCo Pump|^Download Demon|^Download Wonder|^Downloader|^Drip|^DSurf15a|^eCatch|^EasyDL/2.99|^EirGrabber|email|^EmailCollector|^EmailSiphon|^EmailWolf|^Express WebPictures|^ExtractorPro|^EyeNetIE|facebookexternalhit|^FileHound|^FlashGet|FlipboardProxy|FrontPage|^GetRight|^GetSmart|^GetWeb!|^gigabaz|^Go!Zilla|^Go!Zilla|^Go-Ahead-Got-It|^gotit|^Grabber|^GrabNet|^Grafula|^grub-client|^HMView|htmlparser|^HTTrack|^httpdown|.*httrack.*|^ia_archiver|^Image Stripper|^Image Sucker|^Indy*Library|Indy Library|^InterGET|^InternetLinkagent|^Internet Ninja|^InternetSeer.com|^Iria|^Java|^JBH*agent|^JetCar|^JOC Web Spider|JikeSpider|^JustView|^larbin|^LeechFTP|^LexiBot|^lftp|libwww|^Link*Sleuth|^likse|^Link|^LinkWalker|^Mag-Net|^Magnet|^Mass Downloader|mediawords|MegaIndex|^Memo|MetaURI|^Microsoft.URL|^MIDown tool|^Mirror|^Mister PiX|MJ12bot|Mozilla/4.0|^Mozilla.*Indy|^Mozilla.*NEWT|^Mozilla*MSIECrawler|^MS FrontPage*|^MSFrontPage|^MSIECrawler|msnbot|^MSProxy|^Navroad|^NearSite|^NetAnts|^NetMechanic|^NetSpider|^Net Vampire|^NetZIP|^NICErsPRO|^Ninja|^Octopus|^Offline Explorer|^Offline Navigator|^Openfind|OpenLinkProfiler|^PageGrabber|^Papa Foto|^pavuk|^pcBrowser|^Ping|^PingALink|Pixray|^Pockey|proximic|^psbot|^Pump|^QRVA|^RealDownload|^Reaper|^Recorder|^ReGet|^Scooter|^Seeker|^Siphon|^sitecheck.internetseer.com|Siteimprove|^SiteSnagger|^SlySearch|^SmartDownload|^Snake|Sosospider|^SpaceBison|spbot|Spinn3r|^sproose|^Stripper|^Sucker|^SuperBot|^SuperHTTP|^Surfbot|^Szukacz|^tAkeOut|^Teleport Pro|Twitterbot|^URLSpiderPro|^Vacuum|^VoidEYE|^Web Image Collector|^Web Sucker|^WebAuto|^[Ww]eb[Bb]andit|^webcollage|^WebCopier|^Web Downloader|^WebEMailExtrac.*|^WebFetch|^WebGo IS|^WebHook|^WebLeacher|^WebMiner|^WebMirror|^WebReaper|^WebSauger|^Website|^Website eXtractor|^Website Quester|^Webster|^WebStripper|WebWhacker|^WebZIP|^Wget|^Whacker|^Widow|^WWWOFFLE|^x-Tractor|^Xaldon WebSpider|^Xenu|^Zeus.*Webster|^Zeus|ZmEu) 1;
}

## Add here all referrers that are to blocked.
map $http_referer $bad_referer {
  default 0;
  ~(?i)(adult|babes|click|diamond|forsale|girl|jewelry|love|nudit|organic|poker|porn|poweroversoftware|sex|teen|webcam|zippo|casino|replica|en.savefrom.net|7makemoneyonline.com|acunetix-referrer.com|adcash.com|bithack.ru|buttons-for-website.com|cenokos.ru|cenoval.ru|cityadspix.com|darodar.com|econom.co|edakgfvwql.ru|gobongo.info|iedit.ilovevitaly.com|ilovevitaly.com|ilovevitaly.co|ilovevitaly.info|ilovevitaly.org|ilovevitaly.ru|iskalko.ru|luxup.ru|make-money-online.7makemoneyonline.com|maps.ilovevitaly.com|myftpupload.com|savefrom.net|savetubevideo.com|screentoolkit.com|semalt.com|seoexperimenty.ru|shopping.ilovevitaly.ru|slftsdybbg.ru|socialseet.ru|srecorder.com|st3.cwl.yahoo.com|superiends.org|vodkoved.ru|websocial.me|ykecwqlixx.ru|yougetsignal.com|priceg.com|responsinator.com|o-o-6-o-o.ru|o-o-8-o-o.ru) 1;
}

## Add here all hosts that should be spared any referrer checking.
geo $bad_referer {
  ## Add your set of hosts.
  127.0.0.1 0;
  192.168.1.0/24 0;
}

## This file implements a blacklist for certain user agents and

## referrers. It's a first line of defence. It must be included

## inside a http block.

## Add here all user agents that are to be blocked.

map $http_user_agent $bad_bot {

default 0;

~*^Lynx 0; # Let Lynx go through

libwww-perl 1;

}

## Add here all referrers that are to blocked.

map $http_referer $bad_referer {

default 0;

}

## Add here all hosts that should be spared any referrer checking.

geo $bad_referer {

## Add your set of hosts.

127.0.0.1 0;

192.168.1.0/24 0;

}

Lets populate /etc/nginx/lib:Create the file /etc/nginx/lib/win-utf and add the following to it:

## This map is not a full windows-1251  utf8 map: it does not
## contain Serbian and Macedonian letters.  If you need a full map,
## use contrib/unicode2nginx/win-utf map instead.

charset_map  windows-1251  utf-8 {
  82  E2809A ; ## single low-9 quotation mark

  84  E2809E ; ## double low-9 quotation mark
  85  E280A6 ; ## ellipsis
  86  E280A0 ; ## dagger
  87  E280A1 ; ## double dagger
  88  E282AC ; ## euro
  89  E280B0 ; ## per mille

  91  E28098 ; ## left single quotation mark
  92  E28099 ; ## right single quotation mark
  93  E2809C ; ## left double quotation mark
  94  E2809D ; ## right double quotation mark
  95  E280A2 ; ## bullet
  96  E28093 ; ## en dash
  97  E28094 ; ## em dash

  99  E284A2 ; ## trade mark sign

  A0  C2A0 ;   ##  
  A1  D18E ;   ## capital Byelorussian short U
  A2  D19E ;   ## small Byelorussian short u

  A4  C2A4 ;   ## currency sign
  A5  D290 ;   ## capital Ukrainian soft G
  A6  C2A6 ;   ## borken bar
  A7  C2A7 ;   ## section sign
  A8  D081 ;   ## capital YO
  A9  C2A9 ;   ## (C)
  AA  D084 ;   ## capital Ukrainian YE
  AB  C2AB ;   ## left-pointing double angle quotation mark
  AC  C2AC ;   ## not sign
  AD  C2AD ;   ## soft hypen
  AE  C2AE ;   ## (R)
  AF  D087 ;   ## capital Ukrainian YI

  B0  C2B0 ;   ## °
  B1  C2B1 ;   ## plus-minus sign
  B2  D086 ;   ## capital Ukrainian I
  B3  D196 ;   ## small Ukrainian i
  B4  D291 ;   ## small Ukrainian soft g
  B5  C2B5 ;   ## micro sign
  B6  C2B6 ;   ## pilcrow sign
  B7  C2B7 ;   ## ·
  B8  D191 ;   ## small yo
  B9  E28496 ; ## numero sign
  BA  D194 ;   ## small Ukrainian ye
  BB  C2BB ;   ## right-pointing double angle quotation mark

  BF  D197 ;   ## small Ukrainian yi

  C0  D090 ;   ## capital A
  C1  D091 ;   ## capital B
  C2  D092 ;   ## capital V
  C3  D093 ;   ## capital G
  C4  D094 ;   ## capital D
  C5  D095 ;   ## capital YE
  C6  D096 ;   ## capital ZH
  C7  D097 ;   ## capital Z
  C8  D098 ;   ## capital I
  C9  D099 ;   ## capital J
  CA  D09A ;   ## capital K
  CB  D09B ;   ## capital L
  CC  D09C ;   ## capital M
  CD  D09D ;   ## capital N
  CE  D09E ;   ## capital O
  CF  D09F ;   ## capital P

  D0  D0A0 ;   ## capital R
  D1  D0A1 ;   ## capital S
  D2  D0A2 ;   ## capital T
  D3  D0A3 ;   ## capital U
  D4  D0A4 ;   ## capital F
  D5  D0A5 ;   ## capital KH
  D6  D0A6 ;   ## capital TS
  D7  D0A7 ;   ## capital CH
  D8  D0A8 ;   ## capital SH
  D9  D0A9 ;   ## capital SHCH
  DA  D0AA ;   ## capital hard sign
  DB  D0AB ;   ## capital Y
  DC  D0AC ;   ## capital soft sign
  DD  D0AD ;   ## capital E
  DE  D0AE ;   ## capital YU
  DF  D0AF ;   ## capital YA

  E0  D0B0 ;   ## small a
  E1  D0B1 ;   ## small b
  E2  D0B2 ;   ## small v
  E3  D0B3 ;   ## small g
  E4  D0B4 ;   ## small d
  E5  D0B5 ;   ## small ye
  E6  D0B6 ;   ## small zh
  E7  D0B7 ;   ## small z
  E8  D0B8 ;   ## small i
  E9  D0B9 ;   ## small j
  EA  D0BA ;   ## small k
  EB  D0BB ;   ## small l
  EC  D0BC ;   ## small m
  ED  D0BD ;   ## small n
  EE  D0BE ;   ## small o
  EF  D0BF ;   ## small p

  F0  D180 ;   ## small r
  F1  D181 ;   ## small s
  F2  D182 ;   ## small t
  F3  D183 ;   ## small u
  F4  D184 ;   ## small f
  F5  D185 ;   ## small kh
  F6  D186 ;   ## small ts
  F7  D187 ;   ## small ch
  F8  D188 ;   ## small sh
  F9  D189 ;   ## small shch
  FA  D18A ;   ## small hard sign
  FB  D18B ;   ## small y
  FC  D18C ;   ## small soft sign
  FD  D18D ;   ## small e
  FE  D18E ;   ## small yu
  FF  D18F ;   ## small ya
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

## This map is not a full windows-1251 utf8 map: it does not

## contain Serbian and Macedonian letters. If you need a full map,

## use contrib/unicode2nginx/win-utf map instead.

charset_map windows-1251 utf-8 {

82 E2809A ; ## single low-9 quotation mark

84 E2809E ; ## double low-9 quotation mark

85 E280A6 ; ## ellipsis

86 E280A0 ; ## dagger

87 E280A1 ; ## double dagger

88 E282AC ; ## euro

89 E280B0 ; ## per mille

91 E28098 ; ## left single quotation mark

92 E28099 ; ## right single quotation mark

93 E2809C ; ## left double quotation mark

94 E2809D ; ## right double quotation mark

95 E280A2 ; ## bullet

96 E28093 ; ## en dash

97 E28094 ; ## em dash

99 E284A2 ; ## trade mark sign

A0 C2A0 ; ##

A1 D18E ; ## capital Byelorussian short U

A2 D19E ; ## small Byelorussian short u

A4 C2A4 ; ## currency sign

A5 D290 ; ## capital Ukrainian soft G

A6 C2A6 ; ## borken bar

A7 C2A7 ; ## section sign

A8 D081 ; ## capital YO

A9 C2A9 ; ## (C)

AA D084 ; ## capital Ukrainian YE

AB C2AB ; ## left-pointing double angle quotation mark

AC C2AC ; ## not sign

AD C2AD ; ## soft hypen

AE C2AE ; ## (R)

AF D087 ; ## capital Ukrainian YI

B0 C2B0 ; ## °

B1 C2B1 ; ## plus-minus sign

B2 D086 ; ## capital Ukrainian I

B3 D196 ; ## small Ukrainian i

B4 D291 ; ## small Ukrainian soft g

B5 C2B5 ; ## micro sign

B6 C2B6 ; ## pilcrow sign

B7 C2B7 ; ## ·

B8 D191 ; ## small yo

B9 E28496 ; ## numero sign

BA D194 ; ## small Ukrainian ye

BB C2BB ; ## right-pointing double angle quotation mark

BF D197 ; ## small Ukrainian yi

C0 D090 ; ## capital A

C1 D091 ; ## capital B

C2 D092 ; ## capital V

C3 D093 ; ## capital G

C4 D094 ; ## capital D

C5 D095 ; ## capital YE

C6 D096 ; ## capital ZH

C7 D097 ; ## capital Z

C8 D098 ; ## capital I

C9 D099 ; ## capital J

CA D09A ; ## capital K

CB D09B ; ## capital L

CC D09C ; ## capital M

CD D09D ; ## capital N

CE D09E ; ## capital O

CF D09F ; ## capital P

D0 D0A0 ; ## capital R

D1 D0A1 ; ## capital S

D2 D0A2 ; ## capital T

D3 D0A3 ; ## capital U

D4 D0A4 ; ## capital F

D5 D0A5 ; ## capital KH

D6 D0A6 ; ## capital TS

D7 D0A7 ; ## capital CH

D8 D0A8 ; ## capital SH

D9 D0A9 ; ## capital SHCH

DA D0AA ; ## capital hard sign

DB D0AB ; ## capital Y

DC D0AC ; ## capital soft sign

DD D0AD ; ## capital E

DE D0AE ; ## capital YU

DF D0AF ; ## capital YA

E0 D0B0 ; ## small a

E1 D0B1 ; ## small b

E2 D0B2 ; ## small v

E3 D0B3 ; ## small g

E4 D0B4 ; ## small d

E5 D0B5 ; ## small ye

E6 D0B6 ; ## small zh

E7 D0B7 ; ## small z

E8 D0B8 ; ## small i

E9 D0B9 ; ## small j

EA D0BA ; ## small k

EB D0BB ; ## small l

EC D0BC ; ## small m

ED D0BD ; ## small n

EE D0BE ; ## small o

EF D0BF ; ## small p

F0 D180 ; ## small r

F1 D181 ; ## small s

F2 D182 ; ## small t

F3 D183 ; ## small u

F4 D184 ; ## small f

F5 D185 ; ## small kh

F6 D186 ; ## small ts

F7 D187 ; ## small ch

F8 D188 ; ## small sh

F9 D189 ; ## small shch

FA D18A ; ## small hard sign

FB D18B ; ## small y

FC D18C ; ## small soft sign

FD D18D ; ## small e

FE D18E ; ## small yu

FF D18F ; ## small ya

}

Create the file /etc/nginx/lib/mime.types and add the following to it:

types {
  text/html                             html htm shtml;
  text/css                              css;
  text/xml                              xml;
  image/gif                             gif;
  image/jpeg                            jpeg jpg;
  application/javascript                js;
  application/atom+xml                  atom;
  application/rss+xml                   rss;

  text/mathml                           mml;
  text/plain                            txt;
  text/vnd.sun.j2me.app-descriptor      jad;
  text/vnd.wap.wml                      wml;
  text/x-component                      htc;

  image/png                             png;
  image/tiff                            tif tiff;
  image/vnd.wap.wbmp                    wbmp;
  image/x-icon                          ico;
  image/x-jng                           jng;
  image/x-ms-bmp                        bmp;
  image/svg+xml                         svg svgz;
  image/webp                            webp;

  application/java-archive              jar war ear;
  application/json                      json;
  application/mac-binhex40              hqx;
  application/msword                    doc;
  application/pdf                       pdf;
  application/postscript                ps eps ai;
  application/rtf                       rtf;
  application/vnd.apple.mpegurl         m3u8;
  application/vnd.ms-excel              xls;
  application/vnd.ms-powerpoint         ppt;
  application/vnd.wap.wmlc              wmlc;
  application/vnd.wap.xhtml+xml         xhtml;
  application/vnd.google-earth.kml+xml  kml;
  application/vnd.google-earth.kmz      kmz;
  application/x-7z-compressed           7z;
  application/x-cocoa                   cco;
  application/x-java-archive-diff       jardiff;
  application/x-java-jnlp-file          jnlp;
  application/x-makeself                run;
  application/x-perl                    pl pm;
  application/x-pilot                   prc pdb;
  application/x-rar-compressed          rar;
  application/x-redhat-package-manager  rpm;
  application/x-sea                     sea;
  application/x-shockwave-flash         swf;
  application/x-stuffit                 sit;
  application/x-tcl                     tcl tk;
  application/x-x509-ca-cert            der pem crt;
  application/x-xpinstall               xpi;
  application/xspf+xml                  xspf;
  application/zip                       zip;

  application/vnd.oasis.opendocument.chart                   odc;
  application/vnd.oasis.opendocument.chart-template          otc;
  application/vnd.oasis.opendocument.database                odb;
  application/vnd.oasis.opendocument.formula                 odf;
  application/vnd.oasis.opendocument.formula-template       odft;
  application/vnd.oasis.opendocument.graphics                odg;
  application/vnd.oasis.opendocument.graphics-template       otg;
  application/vnd.oasis.opendocument.image                   odi;
  application/vnd.oasis.opendocument.image-template          oti;
  application/vnd.oasis.opendocument.presentation            odp;
  application/vnd.oasis.opendocument.presentation-template   otp;
  application/vnd.oasis.opendocument.spreadsheet             ods;
  application/vnd.oasis.opendocument.spreadsheet-template    ots;
  application/vnd.oasis.opendocument.text-master             otm;
  application/vnd.oasis.opendocument.text                    odt;
  application/vnd.oasis.opendocument.text-template           ott;
  application/vnd.oasis.opendocument.text-web                oth;
  application/vnd.openofficeorg.extension                    oxt;
  application/vnd.openxmlformats-officedocument.presentationml.presentation     pptx;
  application/vnd.openxmlformats-officedocument.presentationml.slideshow        ppsx;
  application/vnd.openxmlformats-officedocument.presentationml.slide            sldx;
  application/vnd.openxmlformats-officedocument.presentationml.template         potx;
  application/vnd.openxmlformats-officedocument.spreadsheetml.sheet             xlsx;
  application/vnd.openxmlformats-officedocument.spreadsheetml.template          xltx;
  application/vnd.openxmlformats-officedocument.wordprocessingml.document       docx;
  application/vnd.openxmlformats-officedocument.wordprocessingml.template       dotx;
  application/vnd.sun.xml.calc               sxc;
  application/vnd.sun.xml.calc.template      stc;
  application/vnd.sun.xml.draw               sxd;
  application/vnd.sun.xml.draw.template      std;
  application/vnd.sun.xml.impress            sxi;
  application/vnd.sun.xml.impress.template   sti;
  application/vnd.sun.xml.math               sxm;
  application/vnd.sun.xml.writer.global      sxg;
  application/vnd.sun.xml.writer             sxw;
  application/vnd.sun.xml.writer.template    stw;

  ## Mime types for web fonts. Stolen from here:
  ## http://seconddrawer.com.au/blog/ in part.
  application/x-font-ttf                ttf;
  font/opentype                         otf;
  application/vnd.ms-fontobject         eot;
  application/font-woff                 woff;

  application/octet-stream              bin exe dll;
  application/octet-stream              deb;
  application/octet-stream              dmg;
  application/octet-stream              iso img;
  application/octet-stream              msi msp msm;
  application/octet-stream              vcf;

  audio/midi                            mid midi kar;
  audio/mpeg                            mpga mpega mp2 mp3;
  audio/ogg                             ogg;
  audio/x-m4a                           m4a;
  audio/x-realaudio                     ra;
  audio/webm                            weba;

  video/3gpp                            3gpp 3gp;
  video/mp2t                            ts;
  video/mp4                             mp4;
  video/mpeg                            mpeg mpg mpe;
  video/ogg                             ogv;
  video/quicktime                       mov;
  video/webm                            webm;
  video/x-flv                           flv;
  video/x-m4v                           m4v;
  video/x-mng                           mng;
  video/x-ms-asf                        asx asf;
  video/x-ms-wmv                        wmv;
  video/x-msvideo                       avi;
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

types {

text/html html htm shtml;

text/css css;

text/xml xml;

image/gif gif;

image/jpeg jpeg jpg;

application/javascript js;

application/atom+xml atom;

application/rss+xml rss;

text/mathml mml;

text/plain txt;

text/vnd.sun.j2me.app-descriptor jad;

text/vnd.wap.wml wml;

text/x-component htc;

image/png png;

image/tiff tif tiff;

image/vnd.wap.wbmp wbmp;

image/x-icon ico;

image/x-jng jng;

image/x-ms-bmp bmp;

image/svg+xml svg svgz;

image/webp webp;

application/java-archive jar war ear;

application/json json;

application/mac-binhex40 hqx;

application/msword doc;

application/pdf pdf;

application/postscript ps eps ai;

application/rtf rtf;

application/vnd.apple.mpegurl m3u8;

application/vnd.ms-excel xls;

application/vnd.ms-powerpoint ppt;

application/vnd.wap.wmlc wmlc;

application/vnd.wap.xhtml+xml xhtml;

application/vnd.google-earth.kml+xml kml;

application/vnd.google-earth.kmz kmz;

application/x-7z-compressed 7z;

application/x-cocoa cco;

application/x-java-archive-diff jardiff;

application/x-java-jnlp-file jnlp;

application/x-makeself run;

application/x-perl pl pm;

application/x-pilot prc pdb;

application/x-rar-compressed rar;

application/x-redhat-package-manager rpm;

application/x-sea sea;

application/x-shockwave-flash swf;

application/x-stuffit sit;

application/x-tcl tcl tk;

application/x-x509-ca-cert der pem crt;

application/x-xpinstall xpi;

application/xspf+xml xspf;

application/zip zip;

application/vnd.oasis.opendocument.chart odc;

application/vnd.oasis.opendocument.chart-template otc;

application/vnd.oasis.opendocument.database odb;

application/vnd.oasis.opendocument.formula odf;

application/vnd.oasis.opendocument.formula-template odft;

application/vnd.oasis.opendocument.graphics odg;

application/vnd.oasis.opendocument.graphics-template otg;

application/vnd.oasis.opendocument.image odi;

application/vnd.oasis.opendocument.image-template oti;

application/vnd.oasis.opendocument.presentation odp;

application/vnd.oasis.opendocument.presentation-template otp;

application/vnd.oasis.opendocument.spreadsheet ods;

application/vnd.oasis.opendocument.spreadsheet-template ots;

application/vnd.oasis.opendocument.text-master otm;

application/vnd.oasis.opendocument.text odt;

application/vnd.oasis.opendocument.text-template ott;

application/vnd.oasis.opendocument.text-web oth;

application/vnd.openofficeorg.extension oxt;

application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;

application/vnd.openxmlformats-officedocument.presentationml.slideshow ppsx;

application/vnd.openxmlformats-officedocument.presentationml.slide sldx;

application/vnd.openxmlformats-officedocument.presentationml.template potx;

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;

application/vnd.openxmlformats-officedocument.spreadsheetml.template xltx;

application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;

application/vnd.openxmlformats-officedocument.wordprocessingml.template dotx;

application/vnd.sun.xml.calc sxc;

application/vnd.sun.xml.calc.template stc;

application/vnd.sun.xml.draw sxd;

application/vnd.sun.xml.draw.template std;

application/vnd.sun.xml.impress sxi;

application/vnd.sun.xml.impress.template sti;

application/vnd.sun.xml.math sxm;

application/vnd.sun.xml.writer.global sxg;

application/vnd.sun.xml.writer sxw;

application/vnd.sun.xml.writer.template stw;

## Mime types for web fonts. Stolen from here:

## http://seconddrawer.com.au/blog/ in part.

application/x-font-ttf ttf;

font/opentype otf;

application/vnd.ms-fontobject eot;

application/font-woff woff;

application/octet-stream bin exe dll;

application/octet-stream deb;

application/octet-stream dmg;

application/octet-stream iso img;

application/octet-stream msi msp msm;

application/octet-stream vcf;

audio/midi mid midi kar;

audio/mpeg mpga mpega mp2 mp3;

audio/ogg ogg;

audio/x-m4a m4a;

audio/x-realaudio ra;

audio/webm weba;

video/3gpp 3gpp 3gp;

video/mp2t ts;

video/mp4 mp4;

video/mpeg mpeg mpg mpe;

video/ogg ogv;

video/quicktime mov;

video/webm webm;

video/x-flv flv;

video/x-m4v m4v;

video/x-mng mng;

video/x-ms-asf asx asf;

video/x-ms-wmv wmv;

video/x-msvideo avi;

}

Create the file /etc/nginx/lib/koi-win and add the following to it:

charset_map  koi8-r  windows-1251 {
  80  88 ; ## euro

  95  95 ; ## bullet

  9A  A0 ; ##  

  9E  B7 ; ## ·

  A3  B8 ; ## small yo
  A4  BA ; ## small Ukrainian ye

  A6  B3 ; ## small Ukrainian i
  A7  BF ; ## small Ukrainian yi

  AD  B4 ; ## small Ukrainian soft g
  AE  A2 ; ## small Byelorussian short u

  B0  B0 ; ## °

  B3  A8 ; ## capital YO
  B4  AA ; ## capital Ukrainian YE

  B6  B2 ; ## capital Ukrainian I
  B7  AF ; ## capital Ukrainian YI

  B9  B9 ; ## numero sign

  BD  A5 ; ## capital Ukrainian soft G
  BE  A1 ; ## capital Byelorussian short U

  BF  A9 ; ## (C)

  C0  FE ; ## small yu
  C1  E0 ; ## small a
  C2  E1 ; ## small b
  C3  F6 ; ## small ts
  C4  E4 ; ## small d
  C5  E5 ; ## small ye
  C6  F4 ; ## small f
  C7  E3 ; ## small g
  C8  F5 ; ## small kh
  C9  E8 ; ## small i
  CA  E9 ; ## small j
  CB  EA ; ## small k
  CC  EB ; ## small l
  CD  EC ; ## small m
  CE  ED ; ## small n
  CF  EE ; ## small o

  D0  EF ; ## small p
  D1  FF ; ## small ya
  D2  F0 ; ## small r
  D3  F1 ; ## small s
  D4  F2 ; ## small t
  D5  F3 ; ## small u
  D6  E6 ; ## small zh
  D7  E2 ; ## small v
  D8  FC ; ## small soft sign
  D9  FB ; ## small y
  DA  E7 ; ## small z
  DB  F8 ; ## small sh
  DC  FD ; ## small e
  DD  F9 ; ## small shch
  DE  F7 ; ## small ch
  DF  FA ; ## small hard sign

  E0  DE ; ## capital YU
  E1  C0 ; ## capital A
  E2  C1 ; ## capital B
  E3  D6 ; ## capital TS
  E4  C4 ; ## capital D
  E5  C5 ; ## capital YE
  E6  D4 ; ## capital F
  E7  C3 ; ## capital G
  E8  D5 ; ## capital KH
  E9  C8 ; ## capital I
  EA  C9 ; ## capital J
  EB  CA ; ## capital K
  EC  CB ; ## capital L
  ED  CC ; ## capital M
  EE  CD ; ## capital N
  EF  CE ; ## capital O

  F0  CF ; ## capital P
  F1  DF ; ## capital YA
  F2  D0 ; ## capital R
  F3  D1 ; ## capital S
  F4  D2 ; ## capital T
  F5  D3 ; ## capital U
  F6  C6 ; ## capital ZH
  F7  C2 ; ## capital V
  F8  DC ; ## capital soft sign
  F9  DB ; ## capital Y
  FA  C7 ; ## capital Z
  FB  D8 ; ## capital SH
  FC  DD ; ## capital E
  FD  D9 ; ## capital SHCH
  FE  D7 ; ## capital CH
  FF  DA ; ## capital hard sign
}

100

101

charset_map koi8-r windows-1251 {

80 88 ; ## euro

95 95 ; ## bullet

9A A0 ; ##

9E B7 ; ## ·

A3 B8 ; ## small yo

A4 BA ; ## small Ukrainian ye

A6 B3 ; ## small Ukrainian i

A7 BF ; ## small Ukrainian yi

AD B4 ; ## small Ukrainian soft g

AE A2 ; ## small Byelorussian short u

B0 B0 ; ## °

B3 A8 ; ## capital YO

B4 AA ; ## capital Ukrainian YE

B6 B2 ; ## capital Ukrainian I

B7 AF ; ## capital Ukrainian YI

B9 B9 ; ## numero sign

BD A5 ; ## capital Ukrainian soft G

BE A1 ; ## capital Byelorussian short U

BF A9 ; ## (C)

C0 FE ; ## small yu

C1 E0 ; ## small a

C2 E1 ; ## small b

C3 F6 ; ## small ts

C4 E4 ; ## small d

C5 E5 ; ## small ye

C6 F4 ; ## small f

C7 E3 ; ## small g

C8 F5 ; ## small kh

C9 E8 ; ## small i

CA E9 ; ## small j

CB EA ; ## small k

CC EB ; ## small l

CD EC ; ## small m

CE ED ; ## small n

CF EE ; ## small o

D0 EF ; ## small p

D1 FF ; ## small ya

D2 F0 ; ## small r

D3 F1 ; ## small s

D4 F2 ; ## small t

D5 F3 ; ## small u

D6 E6 ; ## small zh

D7 E2 ; ## small v

D8 FC ; ## small soft sign

D9 FB ; ## small y

DA E7 ; ## small z

DB F8 ; ## small sh

DC FD ; ## small e

DD F9 ; ## small shch

DE F7 ; ## small ch

DF FA ; ## small hard sign

E0 DE ; ## capital YU

E1 C0 ; ## capital A

E2 C1 ; ## capital B

E3 D6 ; ## capital TS

E4 C4 ; ## capital D

E5 C5 ; ## capital YE

E6 D4 ; ## capital F

E7 C3 ; ## capital G

E8 D5 ; ## capital KH

E9 C8 ; ## capital I

EA C9 ; ## capital J

EB CA ; ## capital K

EC CB ; ## capital L

ED CC ; ## capital M

EE CD ; ## capital N

EF CE ; ## capital O

F0 CF ; ## capital P

F1 DF ; ## capital YA

F2 D0 ; ## capital R

F3 D1 ; ## capital S

F4 D2 ; ## capital T

F5 D3 ; ## capital U

F6 C6 ; ## capital ZH

F7 C2 ; ## capital V

F8 DC ; ## capital soft sign

F9 DB ; ## capital Y

FA C7 ; ## capital Z

FB D8 ; ## capital SH

FC DD ; ## capital E

FD D9 ; ## capital SHCH

FE D7 ; ## capital CH

FF DA ; ## capital hard sign

}

Create the file /etc/nginx/lib/koi-utf and add the following to it:

## This map is not a full koi8-r  utf8 map: it does not contain
## box-drawing and some other characters.  Besides this map contains
## several koi8-u and Byelorussian letters which are not in koi8-r.
## If you need a full and standard map, use contrib/unicode2nginx/koi-utf
## map instead.

charset_map  koi8-r  utf-8 {
  80  E282AC ; ## euro

  95  E280A2 ; ## bullet

  9A  C2A0 ;   ##  

  9E  C2B7 ;   ## ·

  A3  D191 ;   ## small yo
  A4  D194 ;   ## small Ukrainian ye

  A6  D196 ;   ## small Ukrainian i
  A7  D197 ;   ## small Ukrainian yi

  AD  D291 ;   ## small Ukrainian soft g
  AE  D19E ;   ## small Byelorussian short u

  B0  C2B0 ;   ## °

  B3  D081 ;   ## capital YO
  B4  D084 ;   ## capital Ukrainian YE

  B6  D086 ;   ## capital Ukrainian I
  B7  D087 ;   ## capital Ukrainian YI

  B9  E28496 ; ## numero sign

  BD  D290 ;   ## capital Ukrainian soft G
  BE  D18E ;   ## capital Byelorussian short U

  BF  C2A9 ;   ## (C)

  C0  D18E ;   ## small yu
  C1  D0B0 ;   ## small a
  C2  D0B1 ;   ## small b
  C3  D186 ;   ## small ts
  C4  D0B4 ;   ## small d
  C5  D0B5 ;   ## small ye
  C6  D184 ;   ## small f
  C7  D0B3 ;   ## small g
  C8  D185 ;   ## small kh
  C9  D0B8 ;   ## small i
  CA  D0B9 ;   ## small j
  CB  D0BA ;   ## small k
  CC  D0BB ;   ## small l
  CD  D0BC ;   ## small m
  CE  D0BD ;   ## small n
  CF  D0BE ;   ## small o

  D0  D0BF ;   ## small p
  D1  D18F ;   ## small ya
  D2  D180 ;   ## small r
  D3  D181 ;   ## small s
  D4  D182 ;   ## small t
  D5  D183 ;   ## small u
  D6  D0B6 ;   ## small zh
  D7  D0B2 ;   ## small v
  D8  D18C ;   ## small soft sign
  D9  D18B ;   ## small y
  DA  D0B7 ;   ## small z
  DB  D188 ;   ## small sh
  DC  D18D ;   ## small e
  DD  D189 ;   ## small shch
  DE  D187 ;   ## small ch
  DF  D18A ;   ## small hard sign

  E0  D0AE ;   ## capital YU
  E1  D090 ;   ## capital A
  E2  D091 ;   ## capital B
  E3  D0A6 ;   ## capital TS
  E4  D094 ;   ## capital D
  E5  D095 ;   ## capital YE
  E6  D0A4 ;   ## capital F
  E7  D093 ;   ## capital G
  E8  D0A5 ;   ## capital KH
  E9  D098 ;   ## capital I
  EA  D099 ;   ## capital J
  EB  D09A ;   ## capital K
  EC  D09B ;   ## capital L
  ED  D09C ;   ## capital M
  EE  D09D ;   ## capital N
  EF  D09E ;   ## capital O

  F0  D09F ;   ## capital P
  F1  D0AF ;   ## capital YA
  F2  D0A0 ;   ## capital R
  F3  D0A1 ;   ## capital S
  F4  D0A2 ;   ## capital T
  F5  D0A3 ;   ## capital U
  F6  D096 ;   ## capital ZH
  F7  D092 ;   ## capital V
  F8  D0AC ;   ## capital soft sign
  F9  D0AB ;   ## capital Y
  FA  D097 ;   ## capital Z
  FB  D0A8 ;   ## capital SH
  FC  D0AD ;   ## capital E
  FD  D0A9 ;   ## capital SHCH
  FE  D0A7 ;   ## capital CH
  FF  D0AA ;   ## capital hard sign
}

100

101

102

103

104

105

106

107

## This map is not a full koi8-r utf8 map: it does not contain

## box-drawing and some other characters. Besides this map contains

## several koi8-u and Byelorussian letters which are not in koi8-r.

## If you need a full and standard map, use contrib/unicode2nginx/koi-utf

## map instead.

charset_map koi8-r utf-8 {

80 E282AC ; ## euro

95 E280A2 ; ## bullet

9A C2A0 ; ##

9E C2B7 ; ## ·

A3 D191 ; ## small yo

A4 D194 ; ## small Ukrainian ye

A6 D196 ; ## small Ukrainian i

A7 D197 ; ## small Ukrainian yi

AD D291 ; ## small Ukrainian soft g

AE D19E ; ## small Byelorussian short u

B0 C2B0 ; ## °

B3 D081 ; ## capital YO

B4 D084 ; ## capital Ukrainian YE

B6 D086 ; ## capital Ukrainian I

B7 D087 ; ## capital Ukrainian YI

B9 E28496 ; ## numero sign

BD D290 ; ## capital Ukrainian soft G

BE D18E ; ## capital Byelorussian short U

BF C2A9 ; ## (C)

C0 D18E ; ## small yu

C1 D0B0 ; ## small a

C2 D0B1 ; ## small b

C3 D186 ; ## small ts

C4 D0B4 ; ## small d

C5 D0B5 ; ## small ye

C6 D184 ; ## small f

C7 D0B3 ; ## small g

C8 D185 ; ## small kh

C9 D0B8 ; ## small i

CA D0B9 ; ## small j

CB D0BA ; ## small k

CC D0BB ; ## small l

CD D0BC ; ## small m

CE D0BD ; ## small n

CF D0BE ; ## small o

D0 D0BF ; ## small p

D1 D18F ; ## small ya

D2 D180 ; ## small r

D3 D181 ; ## small s

D4 D182 ; ## small t

D5 D183 ; ## small u

D6 D0B6 ; ## small zh

D7 D0B2 ; ## small v

D8 D18C ; ## small soft sign

D9 D18B ; ## small y

DA D0B7 ; ## small z

DB D188 ; ## small sh

DC D18D ; ## small e

DD D189 ; ## small shch

DE D187 ; ## small ch

DF D18A ; ## small hard sign

E0 D0AE ; ## capital YU

E1 D090 ; ## capital A

E2 D091 ; ## capital B

E3 D0A6 ; ## capital TS

E4 D094 ; ## capital D

E5 D095 ; ## capital YE

E6 D0A4 ; ## capital F

E7 D093 ; ## capital G

E8 D0A5 ; ## capital KH

E9 D098 ; ## capital I

EA D099 ; ## capital J

EB D09A ; ## capital K

EC D09B ; ## capital L

ED D09C ; ## capital M

EE D09D ; ## capital N

EF D09E ; ## capital O

F0 D09F ; ## capital P

F1 D0AF ; ## capital YA

F2 D0A0 ; ## capital R

F3 D0A1 ; ## capital S

F4 D0A2 ; ## capital T

F5 D0A3 ; ## capital U

F6 D096 ; ## capital ZH

F7 D092 ; ## capital V

F8 D0AC ; ## capital soft sign

F9 D0AB ; ## capital Y

FA D097 ; ## capital Z

FB D0A8 ; ## capital SH

FC D0AD ; ## capital E

FD D0A9 ; ## capital SHCH

FE D0A7 ; ## capital CH

FF D0AA ; ## capital hard sign

}

Lets populate /etc/nginx/key:Generate DH parameters file with 2048 bit long safe prime:

openssl dhparam 2048 -out /etc/nginx/key/dh_param.pem

1

openssl dhparam 2048 -out /etc/nginx/key/dh_param.pem

Generate HTTP Authentication:

htpasswd /etc/nginx/key/.htpasswd-users admin chown apache. /etc/nginx/key/.htpasswd-users

1
2

htpasswd /etc/nginx/key/.htpasswd-users admin
chown apache. /etc/nginx/key/.htpasswd-users

This command will prompt password for the new user with the name admin.

Lets populate /etc/nginx/apps:Create the file /etc/nginx/drupal/static_files_handler.conf and add the following to it:

## Pagespeed optimized resources that returns 404, redirect to original resource
location ~* (.+)/x(.+),(.+).pagespeed.[.-_[:alnum:]]+$ {
  ## Handle resources with query string and Pagespeed optimized resources with
  ## file name prefixed with x (eg. xMyImage.png,qitok=qwer.pagespeed.asdf.webp)
  error_page 404 = @orig-resource;
  set $orig_resource_uri $1/$2?$3;
  try_files $uri $uri/ $orig_resource_uri;
}
location ~* (.+),(.+).pagespeed.[.-_[:alnum:]]+$ {
  ## Handle resources with query string
  error_page 404 = @orig-resource;
  set $orig_resource_uri $1?$2;
  try_files $uri $uri/ $orig_resource_uri;
}
location ~* (.+)/x(.+).pagespeed.[.-_[:alnum:]]+$ {
  ## Handle Pagespeed optimized resources with file name prefixed with x
  ## (eg. xMyImage.png.pagespeed.asdf.webp)
  error_page 404 = @orig-resource;
  set $orig_resource_uri $1/$2;
  try_files $uri $uri/ $orig_resource_uri;
}
location ~* (.+).pagespeed.[.-_[:alnum:]]+$ {
  ## Default handler
  error_page 404 = @orig-resource;
  set $orig_resource_uri $1;
  try_files $uri $uri/ $orig_resource_uri;
}

## Regular private file serving.
location ^~ /system/files/ {
  include utils/service/php_pass.conf;

  ## For not signalling a 404 in the error log whenever the
  ## system/files directory is accessed add the line below.
  ## Note that the 404 is the intended behaviour.
  log_not_found off;
}

## Trying to access private files directly returns a 404.
location ^~ /sites/[.-[:alnum:]]+/files/private/ {
  internal;
}
location ^~ /sites/[.-[:alnum:]]+/private/ {
  internal;
}

## Support for the file_force module
## https://drupal.org/project/file_force.
location ^~ /system/files_force/ {
  include utils/service/php_pass.conf;

  ## For not signalling a 404 in the error log whenever the
  ## system/files directory is accessed add the line below.
  ## Note that the 404 is the intended behaviour.
  log_not_found off;
}

## If accessing an image generated by Drupal 6 imagecache, serve it
## directly if available, if not relay the request to Drupal to (re)generate
## the image.
location ~* /imagecache/ {
  ## Image hotlinking protection. If you want hotlinking
  ## protection for your images uncomment the following line.
  include map/hotlinking_protection_allowed_hosts.conf;

  access_log off;
  expires 30d;
  try_files $uri $uri/ @drupal;
}

## Drupal 7 generated image handling, i.e., imagecache in core. See:
## https://drupal.org/node/371374.
location ~* /files/styles/ {
  ## Image hotlinking protection. If you want hotlinking
  ## protection for your images uncomment the following line.
  include map/hotlinking_protection_allowed_hosts.conf;

  access_log off;
  expires 30d;
  try_files $uri $uri/ @drupal;
}

## Advanced Aggregation module CSS/JS
## support. https://drupal.org/project/advagg.
location ~ ^/sites/[.-[:alnum:]]+/files/advagg_(?:css|js)/ {
  location ~* (?:css|js)[_-[:alnum:]]+.(?:css|js)(.gz)?$ {
    access_log off;
    expires max;
    gzip_static on;
    add_header ETag '';
    add_header Accept-Ranges '';
    ## Set a far future Cache-Control header to 52 weeks and add no-transform
    ## to make Pagespeed bypass these CSS/JS optimized by advagg module
    add_header Cache-Control 'max-age=31449600, no-transform, public';
    ## Inheritance Rules for add_header Directives
    ## Because this 'server' block contains another 'add_header' directive,
    ## we must redeclare the 'add_header' from 'http' context
    include utils/mod_header.conf;
    add_header Strict-Transport-Security $hsts;

    try_files $uri $uri/ @drupal;
  }
}

## All static files will be served directly.
location ~* ^.+.(?:css|cur|json|js|jpe?g|gif|htc|ico|png|txt|otf|ttf|eot|woff|svg|webp|webm|zip|gz|tar|rar)$ {
  access_log off;
  expires 30d;
  ## No need to bleed constant updates. Send the all shebang in one
  ## fell swoop.
  tcp_nodelay off;
  ## Set the OS file cache.
  open_file_cache max=3000 inactive=120s;
  open_file_cache_valid 45s;
  open_file_cache_min_uses 2;
  open_file_cache_errors off;
  try_files $uri $uri/ @cache;
}

## PDFs and powerpoint files handling.
location ~* ^.+.(?:pdf|pptx?)$ {
  access_log off;
  expires 30d;
  ## No need to bleed constant updates. Send the all shebang in one
  ## fell swoop.
  tcp_nodelay off;
  try_files $uri $uri/ @drupal;
}

## MP3 and Ogg/Vorbis files are served using AIO when supported. Your OS must support it.
location ~ ^/sites/[.-[:alnum:]]+/files/audio/mp3 {
  location ~* .*.mp3$ {
    access_log off;
    directio 4k; ## for XFS
    ## If you're using ext3 or similar uncomment the line below and comment the above.
    #directio 512; ## for ext3 or similar (block alignments)
    tcp_nopush off;
    aio on;
    output_buffers 1 2M;
    try_files $uri $uri/ @drupal;
  }
}

location ~ ^/sites/[.-[:alnum:]]+/files/audio/ogg {
  location ~* .*.ogg$ {
    access_log off;
    directio 4k; # for XFS
    ## If you're using ext3 or similar uncomment the line below and comment the above.
    #directio 512; ## for ext3 or similar (block alignments)
    tcp_nopush off;
    aio on;
    output_buffers 1 2M;
    try_files $uri $uri/ @drupal;
  }
}

## Pseudo streaming of FLV files:
## http://wiki.nginx.org/HttpFlvStreamModule.
## If pseudo streaming isn't working, try to comment
## out in nginx.conf line with:
## add_header X-Frame-Options SAMEORIGIN;
location ~ ^/sites/[.-[:alnum:]]+/files/video/flv {
  location ~* .*.flv$ {
    access_log off;
    flv;
    try_files $uri $uri/ @drupal;
  }
}

## Pseudo streaming of H264/AAC files. This requires an Nginx
## version greater or equal to 1.0.7 for the stable branch and
## greater or equal to 1.1.3 for the development branch.
## Cf. http://nginx.org/en/docs/http/ngx_http_mp4_module.html.
location ~ ^/sites/[.-[:alnum:]]+/files/video/mp4 { # videos
  location ~* .*.(?:mp4|mov)$ {
    access_log off;
    mp4;
    mp4_buffer_size 1M;
    mp4_max_buffer_size 5M;
    try_files $uri $uri/ @drupal;
  }
}

location ~ ^/sites/[.-[:alnum:]]+/files/audio/m4a { # audios
  location ~* .*.m4a$ {
    access_log off;
    mp4;
    mp4_buffer_size 1M;
    mp4_max_buffer_size 5M;
    try_files $uri $uri/ @drupal;
  }
}

## Advanced Help module makes each module provided README available.
location ^~ /help/ {
  location ~* ^/help/[^/]*/README.txt$ {
    access_log off;
    include utils/service/php_pass.conf;
  }
}

## Replicate the Apache  directive of Drupal standard
## .htaccess. Disable access to any code files. Return a 404 to curtail
## information disclosure. Hide also the text files.
location ~* ^(?:.+.(?:htaccess|gitignore|txt|engine|inc|info|install|make|module|profile|test|po|sh|.*sql|test|theme|twig|tpl(?:.php)?|xtmpl|yml)(~|.sw[op]|.bak|.orig|.save)?$|^(/.(?!well-known).*|/code-style.pl|/Entries.*|/Repository|/Root|/Tag|/Template|/composer.(json|lock))$|^#.*#$|/.*.php(.sw[op]|.bak|.orig|.save)+)$ {
  return 404;
}

## Disallow access to .bzr, .git, .hg, .svn, .cvs directories:
## return 404 as not to disclose information.
location ^~ /.bzr {
  return 404;
}
location ^~ /.git {
  return 404;
}
location ^~ /.hg {
  return 404;
}
location ^~ /.svn {
  return 404;
}
location ^~ /.cvs {
  return 404;
}

## Disallow access to patches directory.
location ^~ /patches {
  return 404;
}

## Disallow access to drush backup directory.
location ^~ /backup {
  return 404;
}

## Disable access logs for robots.txt.
location = /robots.txt {
  access_log off;
  ## Add support for the robotstxt module
  ## https://drupal.org/project/robotstxt.
  try_files $uri $uri/ @drupal;
}

## RSS feed support.
location = /rss.xml {
  try_files $uri $uri/ @drupal;
}

## XML Sitemap support.
location = /sitemap.xml {
  try_files $uri $uri/ @drupal;
}

## Support for favicon. Return an 1x1 transparent GIF if it
## doesn't exist.
location = /favicon.ico {
  expires 30d;
  try_files /favicon.png @empty;
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

## Pagespeed optimized resources that returns 404, redirect to original resource

location ~* (.+)/x(.+),(.+).pagespeed.[.-_[:alnum:]]+$ {

## Handle resources with query string and Pagespeed optimized resources with

## file name prefixed with x (eg. xMyImage.png,qitok=qwer.pagespeed.asdf.webp)

error_page 404 = @orig-resource;

set $orig_resource_uri $1/$2?$3;

try_files $uri $uri/ $orig_resource_uri;

}

location ~* (.+),(.+).pagespeed.[.-_[:alnum:]]+$ {

## Handle resources with query string

error_page 404 = @orig-resource;

set $orig_resource_uri $1?$2;

try_files $uri $uri/ $orig_resource_uri;

}

location ~* (.+)/x(.+).pagespeed.[.-_[:alnum:]]+$ {

## Handle Pagespeed optimized resources with file name prefixed with x

## (eg. xMyImage.png.pagespeed.asdf.webp)

error_page 404 = @orig-resource;

set $orig_resource_uri $1/$2;

try_files $uri $uri/ $orig_resource_uri;

}

location ~* (.+).pagespeed.[.-_[:alnum:]]+$ {

## Default handler

error_page 404 = @orig-resource;

set $orig_resource_uri $1;

try_files $uri $uri/ $orig_resource_uri;

}

## Regular private file serving.

location ^~ /system/files/ {

include utils/service/php_pass.conf;

## For not signalling a 404 in the error log whenever the

## system/files directory is accessed add the line below.

## Note that the 404 is the intended behaviour.

log_not_found off;

}

## Trying to access private files directly returns a 404.

location ^~ /sites/[.-[:alnum:]]+/files/private/ {

internal;

}

location ^~ /sites/[.-[:alnum:]]+/private/ {

internal;

}

## Support for the file_force module

## https://drupal.org/project/file_force.

location ^~ /system/files_force/ {

include utils/service/php_pass.conf;

## For not signalling a 404 in the error log whenever the

## system/files directory is accessed add the line below.

## Note that the 404 is the intended behaviour.

log_not_found off;

}

## If accessing an image generated by Drupal 6 imagecache, serve it

## directly if available, if not relay the request to Drupal to (re)generate

## the image.

location ~* /imagecache/ {

## Image hotlinking protection. If you want hotlinking

## protection for your images uncomment the following line.

include map/hotlinking_protection_allowed_hosts.conf;

access_log off;

expires 30d;

try_files $uri $uri/ @drupal;

}

## Drupal 7 generated image handling, i.e., imagecache in core. See:

## https://drupal.org/node/371374.

location ~* /files/styles/ {

## Image hotlinking protection. If you want hotlinking

## protection for your images uncomment the following line.

include map/hotlinking_protection_allowed_hosts.conf;

access_log off;

expires 30d;

try_files $uri $uri/ @drupal;

}

## Advanced Aggregation module CSS/JS

## support. https://drupal.org/project/advagg.

location ~ ^/sites/[.-[:alnum:]]+/files/advagg_(?:css|js)/ {

location ~* (?:css|js)[_-[:alnum:]]+.(?:css|js)(.gz)?$ {

access_log off;

expires max;

gzip_static on;

add_header ETag '';

add_header Accept-Ranges '';

## Set a far future Cache-Control header to 52 weeks and add no-transform

## to make Pagespeed bypass these CSS/JS optimized by advagg module

add_header Cache-Control 'max-age=31449600, no-transform, public';

## Inheritance Rules for add_header Directives

## Because this 'server' block contains another 'add_header' directive,

## we must redeclare the 'add_header' from 'http' context

include utils/mod_header.conf;

add_header Strict-Transport-Security $hsts;

try_files $uri $uri/ @drupal;

}

## All static files will be served directly.

location ~* ^.+.(?:css|cur|json|js|jpe?g|gif|htc|ico|png|txt|otf|ttf|eot|woff|svg|webp|webm|zip|gz|tar|rar)$ {

access_log off;

expires 30d;

## No need to bleed constant updates. Send the all shebang in one

## fell swoop.

tcp_nodelay off;

## Set the OS file cache.

open_file_cache max=3000 inactive=120s;

open_file_cache_valid 45s;

open_file_cache_min_uses 2;

open_file_cache_errors off;

try_files $uri $uri/ @cache;

}

## PDFs and powerpoint files handling.

location ~* ^.+.(?:pdf|pptx?)$ {

access_log off;

expires 30d;

## No need to bleed constant updates. Send the all shebang in one

## fell swoop.

tcp_nodelay off;

try_files $uri $uri/ @drupal;

}

## MP3 and Ogg/Vorbis files are served using AIO when supported. Your OS must support it.

location ~ ^/sites/[.-[:alnum:]]+/files/audio/mp3 {

location ~* .*.mp3$ {

access_log off;

directio 4k; ## for XFS

## If you're using ext3 or similar uncomment the line below and comment the above.

#directio 512; ## for ext3 or similar (block alignments)

tcp_nopush off;

aio on;

output_buffers 1 2M;

try_files $uri $uri/ @drupal;

}

location ~ ^/sites/[.-[:alnum:]]+/files/audio/ogg {

location ~* .*.ogg$ {

access_log off;

directio 4k; # for XFS

## If you're using ext3 or similar uncomment the line below and comment the above.

#directio 512; ## for ext3 or similar (block alignments)

tcp_nopush off;

aio on;

output_buffers 1 2M;

try_files $uri $uri/ @drupal;

}

## Pseudo streaming of FLV files:

## http://wiki.nginx.org/HttpFlvStreamModule.

## If pseudo streaming isn't working, try to comment

## out in nginx.conf line with:

## add_header X-Frame-Options SAMEORIGIN;

location ~ ^/sites/[.-[:alnum:]]+/files/video/flv {

location ~* .*.flv$ {

access_log off;

flv;

try_files $uri $uri/ @drupal;

}

## Pseudo streaming of H264/AAC files. This requires an Nginx

## version greater or equal to 1.0.7 for the stable branch and

## greater or equal to 1.1.3 for the development branch.

## Cf. http://nginx.org/en/docs/http/ngx_http_mp4_module.html.

location ~ ^/sites/[.-[:alnum:]]+/files/video/mp4 { # videos

location ~* .*.(?:mp4|mov)$ {

access_log off;

mp4;

mp4_buffer_size 1M;

mp4_max_buffer_size 5M;

try_files $uri $uri/ @drupal;

}

location ~ ^/sites/[.-[:alnum:]]+/files/audio/m4a { # audios

location ~* .*.m4a$ {

access_log off;

mp4;

mp4_buffer_size 1M;

mp4_max_buffer_size 5M;

try_files $uri $uri/ @drupal;

}

## Advanced Help module makes each module provided README available.

location ^~ /help/ {

location ~* ^/help/[^/]*/README.txt$ {

access_log off;

include utils/service/php_pass.conf;

}

## Replicate the Apache directive of Drupal standard

## .htaccess. Disable access to any code files. Return a 404 to curtail

## information disclosure. Hide also the text files.

location ~* ^(?:.+.(?:htaccess|gitignore|txt|engine|inc|info|install|make|module|profile|test|po|sh|.*sql|test|theme|twig|tpl(?:.php)?|xtmpl|yml)(~|.sw[op]|.bak|.orig|.save)?$|^(/.(?!well-known).*|/code-style.pl|/Entries.*|/Repository|/Root|/Tag|/Template|/composer.(json|lock))$|^#.*#$|/.*.php(.sw[op]|.bak|.orig|.save)+)$ {

return 404;

}

## Disallow access to .bzr, .git, .hg, .svn, .cvs directories:

## return 404 as not to disclose information.

location ^~ /.bzr {

return 404;

}

location ^~ /.git {

return 404;

}

location ^~ /.hg {

return 404;

}

location ^~ /.svn {

return 404;

}

location ^~ /.cvs {

return 404;

}

## Disallow access to patches directory.

location ^~ /patches {

return 404;

}

## Disallow access to drush backup directory.

location ^~ /backup {

return 404;

}

## Disable access logs for robots.txt.

location = /robots.txt {

access_log off;

## Add support for the robotstxt module

## https://drupal.org/project/robotstxt.

try_files $uri $uri/ @drupal;

}

## RSS feed support.

location = /rss.xml {

try_files $uri $uri/ @drupal;

}

## XML Sitemap support.

location = /sitemap.xml {

try_files $uri $uri/ @drupal;

}

## Support for favicon. Return an 1x1 transparent GIF if it

## doesn't exist.

location = /favicon.ico {

expires 30d;

try_files /favicon.png @empty;

}

Create the file /etc/nginx/drupal/php_handler.conf and add the following to it:

## PHP handler

include utils/service/php_pass.conf;
include utils/service/microcache_auth.conf;
#include utils/service/microcache.conf;

## PHP handler

include utils/service/php_pass.conf;

include utils/service/microcache_auth.conf;

#include utils/service/microcache.conf;

We have two options here: microcache_auth.conf which uses the Nginx cache for anonymous users only and microcache.conf which uses the Nginx cache for both anonymous and authenticated users. The microcache_auth.conf is enabled by default. Select between the two according to your requirements.

Create the file /etc/nginx/drupal/named_location.conf and add the following to it:

## Restrict access to the strictly necessary PHP files. Reducing the
## scope for exploits. Handling of PHP code and the Drupal event loop.
location @drupal {
  include apps/drupal/php_handler.conf;

  ## Filefield Upload progress
  ## https://drupal.org/project/filefield_nginx_progress support
  ## through the NginxUploadProgress modules.
  #track_uploads uploads 60s;
}

## We define a named location for the Boost cache.
location @cache {
  include apps/drupal/boost.conf;
  ## We try each boost URI in succession, if every one of them
  ## fails then hand it to Drupal.
  try_files /cache/normal/$host${uri}_${args}.html /cache/normal/$host${uri}_${args}.xml /cache/normal/$host${uri}_${args}.json /cache/normal/$host${uri}_${args}.html.gz /cache/normal/$host${uri}_${args}.xml.gz /cache/normal/$host${uri}_${args}.json.gz /cache/perm/$host${uri}_.css /cache/perm/$host${uri}_.js /cache/$host/0$uri.html /cache/$host/0${uri}/index.html @drupal;
}

## Return an in memory 1x1 transparent GIF.
location @empty {
  expires 30d;
  empty_gif;
}

## Redirect Pagespeed optimized resources that returns 404 to
## original resource.
location @orig-resource {
  return 302 $scheme://$server_name$orig_resource_uri;
}

## Restrict access to the strictly necessary PHP files. Reducing the

## scope for exploits. Handling of PHP code and the Drupal event loop.

location @drupal {

include apps/drupal/php_handler.conf;

## Filefield Upload progress

## https://drupal.org/project/filefield_nginx_progress support

## through the NginxUploadProgress modules.

#track_uploads uploads 60s;

}

## We define a named location for the Boost cache.

location @cache {

include apps/drupal/boost.conf;

## We try each boost URI in succession, if every one of them

## fails then hand it to Drupal.

try_files /cache/normal/$host${uri}_${args}.html /cache/normal/$host${uri}_${args}.xml /cache/normal/$host${uri}_${args}.json /cache/normal/$host${uri}_${args}.html.gz /cache/normal/$host${uri}_${args}.xml.gz /cache/normal/$host${uri}_${args}.json.gz /cache/perm/$host${uri}_.css /cache/perm/$host${uri}_.js /cache/$host/0$uri.html /cache/$host/0${uri}/index.html @drupal;

}

## Return an in memory 1x1 transparent GIF.

location @empty {

expires 30d;

empty_gif;

}

## Redirect Pagespeed optimized resources that returns 404 to

## original resource.

location @orig-resource {

return 302 $scheme://$server_name$orig_resource_uri;

}

Create the file /etc/nginx/drupal/drupal_upload_progress.conf and add the following to it:

## Drupal 7 configuration for the Nginx Upload Progress module:
## https://github.com/masterzen/nginx-upload-progress-module
## This requires the Filefield Nginx Progress module:
## https://drupal.org/project/filefield_nginx_progress.

## The Nginx module wants ?X-Progress-ID query parameter so
## that it report the progress of the upload through a GET
## request. But the drupal form element makes use of clean
## URLs in the POST.

location ~ (?.*)/x-progress-id:(?d*) {
  rewrite ^ $upload_form_uri?X-Progress-ID=$upload_id;
}

## Now the above rewrite must be matched by a location that
## activates it and references the above defined upload
## tracking zone.
location ^~ /progress {
  upload_progress_json_output;
  report_uploads uploads;
}

## Drupal 7 configuration for the Nginx Upload Progress module:

## https://github.com/masterzen/nginx-upload-progress-module

## This requires the Filefield Nginx Progress module:

## https://drupal.org/project/filefield_nginx_progress.

## The Nginx module wants ?X-Progress-ID query parameter so

## that it report the progress of the upload through a GET

## request. But the drupal form element makes use of clean

## URLs in the POST.

location ~ (?.*)/x-progress-id:(?d*) {

rewrite ^ $upload_form_uri?X-Progress-ID=$upload_id;

}

## Now the above rewrite must be matched by a location that

## activates it and references the above defined upload

## tracking zone.

location ^~ /progress {

upload_progress_json_output;

report_uploads uploads;

}

Create the file /etc/nginx/drupal/drupal_install.conf and add the following to it:

## Directives for installing drupal. This is for drupal 6 and 7.
location = /install.php {
  auth_basic "Restricted Access"; # auth realm
  auth_basic_user_file key/.htpasswd-users; # htpasswd file
  include apps/drupal/php_handler.conf;
}

## This is for drupal 8.
location = /core/install.php {
  auth_basic "Restricted Access"; # auth realm
  auth_basic_user_file key/.htpasswd-users; # htpasswd file
  include apps/drupal/php_handler.conf;
}

## Directives for installing drupal. This is for drupal 6 and 7.

location = /install.php {

auth_basic "Restricted Access"; # auth realm

auth_basic_user_file key/.htpasswd-users; # htpasswd file

include apps/drupal/php_handler.conf;

}

## This is for drupal 8.

location = /core/install.php {

auth_basic "Restricted Access"; # auth realm

auth_basic_user_file key/.htpasswd-users; # htpasswd file

include apps/drupal/php_handler.conf;

}

Create the file /etc/nginx/drupal/drupal_cron_update.conf and add the following to it:

## Configuration file for Drupal if you're not using drush to update your site
## or run cron.

## XMLRPC. Comment out if not enabled.
location = /xmlrpc.php {
  include apps/drupal/php_handler.conf;
}

## Restrict cron access to a specific host.
location = /cron.php {
  ## If not allowed to run cron then issue a 404 and redirect to the
  ## site root.
  if ($not_allowed_cron) {
    return 404 /;
  }
  include apps/drupal/php_handler.conf;
}

## Run the update from the web interface with Drupal 7.
location = /authorize.php {
  include apps/drupal/php_handler.conf;
}

location = /update.php {
  auth_basic "Restricted Access"; # auth realm
  auth_basic_user_file key/.htpasswd-users; # htpasswd file
  include apps/drupal/php_handler.conf;
}

## Configuration file for Drupal if you're not using drush to update your site

## or run cron.

## XMLRPC. Comment out if not enabled.

location = /xmlrpc.php {

include apps/drupal/php_handler.conf;

}

## Restrict cron access to a specific host.

location = /cron.php {

## If not allowed to run cron then issue a 404 and redirect to the

## site root.

if ($not_allowed_cron) {

return 404 /;

}

include apps/drupal/php_handler.conf;

}

## Run the update from the web interface with Drupal 7.

location = /authorize.php {

include apps/drupal/php_handler.conf;

}

location = /update.php {

auth_basic "Restricted Access"; # auth realm

auth_basic_user_file key/.htpasswd-users; # htpasswd file

include apps/drupal/php_handler.conf;

}

Create the file /etc/nginx/drupal/core.conf and add the following to it:

## Nginx configuration for Drupal

## Common Nginx configuration for server context
include apps/drupal/common_server_context.conf;

## Named location
include apps/drupal/named_location.conf;

## The 'default' location.
location / {
  ## Drupal generated static files
  include apps/drupal/static_files_handler.conf;

  try_files $uri $uri/ @cache;
}

## Drupal index.
location = /index.php {
  include apps/drupal/boost.conf;
  ## We try each boost URI in succession, if every one of them
  ## fails then hand it to Drupal.
  try_files /cache/normal/$host/_${args}.html /cache/normal/$host/_${args}.html.gz /cache/$host/0.html /cache/$host/0/index.html @drupal;
}

## Boost stats.
location = /boost_stats.php {
  include apps/drupal/php_handler.conf;
}

## PHP scipt to log all catch paths
location = /sites/all/logcatchall.php {
  include apps/drupal/php_handler.conf;
}

## Uncomment the line below if you want to enable basic auth for
## access to all /admin URIs. Note that this provides much better
## protection if use HTTPS. Since it can easily be eavesdropped if you
## use HTTP.
#include apps/drupal/admin_basic_auth.conf;

## Any other attempt to access PHP files returns a 404.
location ~* ^.+.php$ {
  return 404;
}

## Nginx configuration for Drupal

## Common Nginx configuration for server context

include apps/drupal/common_server_context.conf;

## Named location

include apps/drupal/named_location.conf;

## The 'default' location.

location / {

## Drupal generated static files

include apps/drupal/static_files_handler.conf;

try_files $uri $uri/ @cache;

}

## Drupal index.

location = /index.php {

include apps/drupal/boost.conf;

## We try each boost URI in succession, if every one of them

## fails then hand it to Drupal.

try_files /cache/normal/$host/_${args}.html /cache/normal/$host/_${args}.html.gz /cache/$host/0.html /cache/$host/0/index.html @drupal;

}

## Boost stats.

location = /boost_stats.php {

include apps/drupal/php_handler.conf;

}

## PHP scipt to log all catch paths

location = /sites/all/logcatchall.php {

include apps/drupal/php_handler.conf;

}

## Uncomment the line below if you want to enable basic auth for

## access to all /admin URIs. Note that this provides much better

## protection if use HTTPS. Since it can easily be eavesdropped if you

## use HTTP.

#include apps/drupal/admin_basic_auth.conf;

## Any other attempt to access PHP files returns a 404.

location ~* ^.+.php$ {

return 404;

}

Create the file /etc/nginx/drupal/common_server_context.conf and add the following to it:

## Common to all hosts Nginx configurations for server context

## See the blacklist.conf file at the parent dir: /etc/nginx.
## Deny access based on the User-Agent header.
if ($bad_bot) {
  return 444;
}
## Deny access based on the Referer header.
if ($bad_referer) {
  return 444;
}

## Protection against illegal HTTP methods. Out of the box only HEAD,
## GET and POST are allowed.
if ($not_allowed_method) {
  return 405;
}

## Limits
## limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=60r/s + limit_req zone=req_limit_per_ip burst=5 nodelay
##    - Set shared memory as 10MB
##    - Limit requests per IP as following
##    - Set maximum requests as rate * burst in burst seconds
##      For example, maximum value is 300(=60*5) requests in 5 seconds in this case
##    - With nodelay option : Nginx would return 503 response and not handle excessive requests
##    - Without nodelay option : Nginx would wait (no 503 response) and handle excessive requests with some delay
## limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m + limit_conn conn_limit_per_ip 30
##    - Set shared memory as 10MB
##    - Limit connections per IP as 30 in this case
##    - Note that normal browser makes 2~8 connections and SPDY protocol split each connections
##    - Nginx would return 503 response if connection exceeds this value
limit_conn connlimit 32;
limit_req zone=reqlimit burst=5 nodelay;

## PageSpeed filters
## Uncomment the line below if Google PageSpeed module is present
#include apps/pagespeed/optimize.conf;

## Common to all hosts Nginx configurations for server context

## See the blacklist.conf file at the parent dir: /etc/nginx.

## Deny access based on the User-Agent header.

if ($bad_bot) {

return 444;

}

## Deny access based on the Referer header.

if ($bad_referer) {

return 444;

}

## Protection against illegal HTTP methods. Out of the box only HEAD,

## GET and POST are allowed.

if ($not_allowed_method) {

return 405;

}

## Limits

## limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=60r/s + limit_req zone=req_limit_per_ip burst=5 nodelay

## - Set shared memory as 10MB

## - Limit requests per IP as following

## - Set maximum requests as rate * burst in burst seconds

## For example, maximum value is 300(=60*5) requests in 5 seconds in this case

## - With nodelay option : Nginx would return 503 response and not handle excessive requests

## - Without nodelay option : Nginx would wait (no 503 response) and handle excessive requests with some delay

## limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m + limit_conn conn_limit_per_ip 30

## - Set shared memory as 10MB

## - Limit connections per IP as 30 in this case

## - Note that normal browser makes 2~8 connections and SPDY protocol split each connections

## - Nginx would return 503 response if connection exceeds this value

limit_conn connlimit 32;

limit_req zone=reqlimit burst=5 nodelay;

## PageSpeed filters

## Uncomment the line below if Google PageSpeed module is present

#include apps/pagespeed/optimize.conf;

Create the file /etc/nginx/drupal/boost.conf and add the following to it:

## Boost configuration
gzip_static on;

## Error page handler for the case where $no_boost_cache is 1, POST
## request or authenticated.
error_page 418 = @drupal;

## If $no_boost_cache is 1 then it means that Boost session cookie
## is present or uri has wrong dir. So serve the dynamic page.
if ($no_boost_cache) {
  return 418;
}

## No caching for POST requests.
if ($request_method = POST) {
  return 418;
}

## Now for some header tweaking. We use a date that differs
## from stock Drupal.
add_header Expires "Tue, 25 Dec 1977 03:45:00 GMT";
## We bypass all delays in the post-check and pre-check
## parameters of Cache-Control. Both set to 0.
add_header Cache-Control "must-revalidate, post-check=0, pre-check=0";
add_header X-DCache "Boost";
## Inheritance Rules for add_header Directives
## Because this 'server' block contains another 'add_header' directive,
## we must redeclare the 'add_header' from 'http' context
include utils/mod_header.conf;
add_header Strict-Transport-Security $hsts;
## Boost doesn't set a charset.
charset utf-8;

## Boost configuration

gzip_static on;

## Error page handler for the case where $no_boost_cache is 1, POST

## request or authenticated.

error_page 418 = @drupal;

## If $no_boost_cache is 1 then it means that Boost session cookie

## is present or uri has wrong dir. So serve the dynamic page.

if ($no_boost_cache) {

return 418;

}

## No caching for POST requests.

if ($request_method = POST) {

return 418;

}

## Now for some header tweaking. We use a date that differs

## from stock Drupal.

add_header Expires "Tue, 25 Dec 1977 03:45:00 GMT";

## We bypass all delays in the post-check and pre-check

## parameters of Cache-Control. Both set to 0.

add_header Cache-Control "must-revalidate, post-check=0, pre-check=0";

add_header X-DCache "Boost";

## Inheritance Rules for add_header Directives

## Because this 'server' block contains another 'add_header' directive,

## we must redeclare the 'add_header' from 'http' context

include utils/mod_header.conf;

add_header Strict-Transport-Security $hsts;

## Boost doesn't set a charset.

charset utf-8;

Populate the /etc/nginx/apps/pagespeed folder under this guide.

To enable Google PageSpeed in your Nginx configuration (make sure first that your Nginx is compiled with PageSpeed module), uncomment the line seen below at /etc/nginx/nginx.conf:

include apps/pagespeed/core.conf;

1	include apps/pagespeed/core.conf;

… also uncomment the line seen below at /etc/nginx/apps/drupal/common_server_context.conf:

include apps/pagespeed/optimize.conf;

1	include apps/pagespeed/optimize.conf;

… and uncomment the line seen below at /etc/nginx/site-available/template.conf:

pagespeed ShardDomain $scheme://$server_name $scheme://s1.{DOM},$scheme://s2.{DOM};

1	pagespeed ShardDomain $scheme://$server_name $scheme://s1.{DOM},$scheme://s2.{DOM};

To enable this Nginx reverse proxy for Apache setup, execute the following:

ln -s /etc/nginx/utils/apache /etc/nginx/utils/service

1

ln -s /etc/nginx/utils/apache /etc/nginx/utils/service

On the other hand, if PHP FPM backend is your setup, execute the following:

ln -s /etc/nginx/utils/fastcgi /etc/nginx/utils/service

1

ln -s /etc/nginx/utils/fastcgi /etc/nginx/utils/service

Set permission:

chmod -R -x /etc/nginx
chmod +x /etc/nginx/lib/ /etc/nginx/apps/ /etc/nginx/apps/drupal/ /etc/nginx/apps/pagespeed/ /etc/nginx/key/ /etc/nginx/sites-available/ /etc/nginx/sites-available/admin/ /etc/nginx/sites-available/dev/ /etc/nginx/sites-available/targeted_server_config/ /etc/nginx/sites-enabled/ /etc/nginx/utils/ /etc/nginx/utils/apache/ /etc/nginx/utils/fastcgi/ /etc/nginx/map/ /etc/nginx/

chmod -R -x /etc/nginx

chmod +x /etc/nginx/lib/ /etc/nginx/apps/ /etc/nginx/apps/drupal/ /etc/nginx/apps/pagespeed/ /etc/nginx/key/ /etc/nginx/sites-available/ /etc/nginx/sites-available/admin/ /etc/nginx/sites-available/dev/ /etc/nginx/sites-available/targeted_server_config/ /etc/nginx/sites-enabled/ /etc/nginx/utils/ /etc/nginx/utils/apache/ /etc/nginx/utils/fastcgi/ /etc/nginx/map/ /etc/nginx/

Restart Nginx:

systemctl restart nginx

1

systemctl restart nginx

Setup Nginx requirements

In this tutorial the Apache will use port 8080 and lets open this port to become accessible:

iptables -I INPUT -p tcp -m tcp --dport 8080 -j ACCEPT iptables --line -vnL service iptables save service iptables restart

1
2
3
4

iptables -I INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
iptables --line -vnL
service iptables save
service iptables restart
Create the Nginx cache path folder:

mkdir /var/cache/nginx/microcache chown apache:root /var/cache/nginx/microcache chmod 700 /var/cache/nginx/microcache

1
2
3

mkdir /var/cache/nginx/microcache
chown apache:root /var/cache/nginx/microcache
chmod 700 /var/cache/nginx/microcache

Create Nginx logrotate script:

vi /etc/logrotate.d/websites_nginx_logs.conf

1	vi /etc/logrotate.d/websites_nginx_logs.conf

Content:

/var/log/virtualmin/*nginx_access_log /var/log/virtualmin/*nginx_error_log {
  rotate 10
  missingok
  daily
  compress
  postrotate
  service httpd graceful ; sleep 5
  endscript
  sharedscripts
}

/var/log/virtualmin/*nginx_access_log /var/log/virtualmin/*nginx_error_log {

rotate 10

missingok

daily

compress

postrotate

service httpd graceful ; sleep 5

endscript

sharedscripts

}

Configure Apache

Since Nginx is reverse proxy to Apache, the IP address that Apache will get is the IP of the server and we need to correct that. Apache 2.4 and above do have mod_remoteip and we will use that module. Open mod_remoteip’s configuration file:

vi /etc/httpd/conf.d/remoteip.conf

1

vi /etc/httpd/conf.d/remoteip.conf

Add the following codes:

# mod_remoteip settings RemoteIPHeader X-Real-IP RemoteIPInternalProxy 127.0.0.1 RemoteIPInternalProxy 188.8.8.8

1
2
3
4

# mod_remoteip settings
RemoteIPHeader X-Real-IP
RemoteIPInternalProxy 127.0.0.1
RemoteIPInternalProxy 188.8.8.8

Note: change 188.8.8.8 to your server’s IP address.
Change the port of Apache:

vi /etc/httpd/conf/httpd.conf

1

vi /etc/httpd/conf/httpd.conf

Look for:

Listen 80

1

Listen 80

… and change to:

Listen 8080

1

Listen 8080
Restart Apache:

systemctl restart httpd

1

systemctl restart httpd

Configure Virtualmin

Set the virtual server template to listen to 8080. Login to Virtualmin, go to “System Settings” -> “Server Templates” -> “Default Settings” and select from the dropdown “Apache Website”. Change the “Port number for virtual hosts” from 80 to 8080. Restart webmin:

systemctl restart webmin

1

systemctl restart webmin

Lets build the script that will automate the creation of website virtual host Nginx configuration file each time Virtualmin created a new server.Create the file /usr/local/bin/virtualmin.sh and add the following to it:

#!/bin/sh

function update_nginx_conf {
  cat /etc/nginx/sites-available/${TEMPLATE_FILENAME} > $NGINX_CONF_FILE
  perl -pi -e "s#{DOM}#${VIRTUALSERVER_DOM}#g" $NGINX_CONF_FILE
  perl -pi -e "s#{HOME}#${VIRTUALSERVER_HOME}#g" $NGINX_CONF_FILE

  cat /etc/nginx/sites-available/${TEMPLATE_FILENAME_SSL} > $NGINX_CONF_FILE_SSL
  perl -pi -e "s#{DOM}#${VIRTUALSERVER_DOM}#g" $NGINX_CONF_FILE_SSL
  perl -pi -e "s#{HOME}#${VIRTUALSERVER_HOME}#g" $NGINX_CONF_FILE_SSL

  if [ -f "/etc/nginx/sites-available/targeted_server_config/${VIRTUALSERVER_DOM}.conf" ]
  then
    perl -pi -e "s#{TARGETED_SERVER_CONFIG}#include sites-available/targeted_server_config/${VIRTUALSERVER_DOM}.conf;#g" $NGINX_CONF_FILE
    perl -pi -e "s#{TARGETED_SERVER_CONFIG}#include sites-available/targeted_server_config/${VIRTUALSERVER_DOM}.conf;#g" $NGINX_CONF_FILE_SSL
  else
    perl -pi -e "s#{TARGETED_SERVER_CONFIG}##g" $NGINX_CONF_FILE
    perl -pi -e "s#{TARGETED_SERVER_CONFIG}##g" $NGINX_CONF_FILE_SSL
  fi
}

NGINX_CONF_FILENAME="${VIRTUALSERVER_DOM}.conf"
NGINX_CONF_FILE="/etc/nginx/sites-available/prod/${NGINX_CONF_FILENAME}"
NGINX_CONF_FILENAME_SSL="${VIRTUALSERVER_DOM}_ssl.conf"
NGINX_CONF_FILE_SSL="/etc/nginx/sites-available/prod/${NGINX_CONF_FILENAME_SSL}"
TEMPLATE_FILENAME=template.conf
TEMPLATE_FILENAME_SSL=template_ssl.conf

if [ "$VIRTUALSERVER_ACTION" = "CREATE_DOMAIN" ]
then
  if [ "${VIRTUALSERVER_WEB}" = "1" ]
  then
    update_nginx_conf
    if [ "${VIRTUALSERVER_SSL}" = "1" ]
    then
      ln -s $NGINX_CONF_FILE_SSL /etc/nginx/sites-enabled/${NGINX_CONF_FILENAME_SSL}
    else
      ln -s $NGINX_CONF_FILE /etc/nginx/sites-enabled/${NGINX_CONF_FILENAME}
    fi
    if [ -f "/home/${VIRTUALSERVER_USER}/etc/dav.digest.passwd" ]
    then
      cat /home/$VIRTUALSERVER_USER/etc/dav.digest.passwd >> /etc/nginx/key/.htpasswd-users
    fi
    /usr/sbin/nginx -s reload
  fi
elif [ "$VIRTUALSERVER_ACTION" = "DELETE_DOMAIN" ]
then
  if [ "${VIRTUALSERVER_WEB}" = "1" ]
  then
    rm -f /etc/nginx/sites-enabled/${VIRTUALSERVER_DOM}.conf /etc/nginx/sites-enabled/${VIRTUALSERVER_DOM}_ssl.conf
    rm -f /etc/nginx/sites-available/prod/${VIRTUALSERVER_DOM}.conf /etc/nginx/sites-available/prod/${VIRTUALSERVER_DOM}_ssl.conf
    rm -f /var/log/virtualmin/${VIRTUALSERVER_DOM}_nginx_*
    /usr/sbin/nginx -s reload
  fi
elif [ "$VIRTUALSERVER_ACTION" = "MODIFY_DOMAIN" ]
then
  if [ "${VIRTUALSERVER_WEB}" = "1" ]
  then
    if [ ! -f $NGINX_CONF_FILE ]
    then
      update_nginx_conf
    fi
  fi
  if [ "$VIRTUALSERVER_DOM" != "$VIRTUALSERVER_OLDSERVER_DOM" ]
  then
    if [ "${VIRTUALSERVER_WEB}" = "1" ]
    then
      rm -f /etc/nginx/sites-available/prod/${VIRTUALSERVER_OLDSERVER_DOM}.conf /etc/nginx/sites-available/prod/${VIRTUALSERVER_OLDSERVER_DOM}_ssl.conf
      rm -f /etc/nginx/sites-enabled/${VIRTUALSERVER_OLDSERVER_DOM}.conf /etc/nginx/sites-enabled/${VIRTUALSERVER_OLDSERVER_DOM}_ssl.conf
      update_nginx_conf
      if [ "${VIRTUALSERVER_SSL}" = "1" ]
      then
        ln -s $NGINX_CONF_FILE_SSL /etc/nginx/sites-enabled/${NGINX_CONF_FILENAME_SSL}
      else
        ln -s $NGINX_CONF_FILE /etc/nginx/sites-enabled/${NGINX_CONF_FILENAME}
      fi
    fi
  fi
  if [ "${VIRTUALSERVER_WEB}" = "1" ]
  then
    /usr/sbin/nginx -s reload
  fi
fi

#!/bin/sh

function update_nginx_conf {

cat /etc/nginx/sites-available/${TEMPLATE_FILENAME} > $NGINX_CONF_FILE

perl -pi -e "s#{DOM}#${VIRTUALSERVER_DOM}#g" $NGINX_CONF_FILE

perl -pi -e "s#{HOME}#${VIRTUALSERVER_HOME}#g" $NGINX_CONF_FILE

cat /etc/nginx/sites-available/${TEMPLATE_FILENAME_SSL} > $NGINX_CONF_FILE_SSL

perl -pi -e "s#{DOM}#${VIRTUALSERVER_DOM}#g" $NGINX_CONF_FILE_SSL

perl -pi -e "s#{HOME}#${VIRTUALSERVER_HOME}#g" $NGINX_CONF_FILE_SSL

if [ -f "/etc/nginx/sites-available/targeted_server_config/${VIRTUALSERVER_DOM}.conf" ]

then

perl -pi -e "s#{TARGETED_SERVER_CONFIG}#include sites-available/targeted_server_config/${VIRTUALSERVER_DOM}.conf;#g" $NGINX_CONF_FILE

perl -pi -e "s#{TARGETED_SERVER_CONFIG}#include sites-available/targeted_server_config/${VIRTUALSERVER_DOM}.conf;#g" $NGINX_CONF_FILE_SSL

else

perl -pi -e "s#{TARGETED_SERVER_CONFIG}##g" $NGINX_CONF_FILE

perl -pi -e "s#{TARGETED_SERVER_CONFIG}##g" $NGINX_CONF_FILE_SSL

}

NGINX_CONF_FILENAME="${VIRTUALSERVER_DOM}.conf"

NGINX_CONF_FILE="/etc/nginx/sites-available/prod/${NGINX_CONF_FILENAME}"

NGINX_CONF_FILENAME_SSL="${VIRTUALSERVER_DOM}_ssl.conf"

NGINX_CONF_FILE_SSL="/etc/nginx/sites-available/prod/${NGINX_CONF_FILENAME_SSL}"

TEMPLATE_FILENAME=template.conf

TEMPLATE_FILENAME_SSL=template_ssl.conf

if [ "$VIRTUALSERVER_ACTION" = "CREATE_DOMAIN" ]

then

if [ "${VIRTUALSERVER_WEB}" = "1" ]

then

update_nginx_conf

if [ "${VIRTUALSERVER_SSL}" = "1" ]

then

ln -s $NGINX_CONF_FILE_SSL /etc/nginx/sites-enabled/${NGINX_CONF_FILENAME_SSL}

else

ln -s $NGINX_CONF_FILE /etc/nginx/sites-enabled/${NGINX_CONF_FILENAME}

if [ -f "/home/${VIRTUALSERVER_USER}/etc/dav.digest.passwd" ]

then

cat /home/$VIRTUALSERVER_USER/etc/dav.digest.passwd >> /etc/nginx/key/.htpasswd-users

/usr/sbin/nginx -s reload

elif [ "$VIRTUALSERVER_ACTION" = "DELETE_DOMAIN" ]

then

if [ "${VIRTUALSERVER_WEB}" = "1" ]

then

rm -f /etc/nginx/sites-enabled/${VIRTUALSERVER_DOM}.conf /etc/nginx/sites-enabled/${VIRTUALSERVER_DOM}_ssl.conf

rm -f /etc/nginx/sites-available/prod/${VIRTUALSERVER_DOM}.conf /etc/nginx/sites-available/prod/${VIRTUALSERVER_DOM}_ssl.conf

rm -f /var/log/virtualmin/${VIRTUALSERVER_DOM}_nginx_*

/usr/sbin/nginx -s reload

elif [ "$VIRTUALSERVER_ACTION" = "MODIFY_DOMAIN" ]

then

if [ "${VIRTUALSERVER_WEB}" = "1" ]

then

if [ ! -f $NGINX_CONF_FILE ]

then

update_nginx_conf

if [ "$VIRTUALSERVER_DOM" != "$VIRTUALSERVER_OLDSERVER_DOM" ]

then

if [ "${VIRTUALSERVER_WEB}" = "1" ]

then

rm -f /etc/nginx/sites-available/prod/${VIRTUALSERVER_OLDSERVER_DOM}.conf /etc/nginx/sites-available/prod/${VIRTUALSERVER_OLDSERVER_DOM}_ssl.conf

rm -f /etc/nginx/sites-enabled/${VIRTUALSERVER_OLDSERVER_DOM}.conf /etc/nginx/sites-enabled/${VIRTUALSERVER_OLDSERVER_DOM}_ssl.conf

update_nginx_conf

if [ "${VIRTUALSERVER_SSL}" = "1" ]

then

ln -s $NGINX_CONF_FILE_SSL /etc/nginx/sites-enabled/${NGINX_CONF_FILENAME_SSL}

else

ln -s $NGINX_CONF_FILE /etc/nginx/sites-enabled/${NGINX_CONF_FILENAME}

if [ "${VIRTUALSERVER_WEB}" = "1" ]

then

/usr/sbin/nginx -s reload

Make the script executable:

chmod u+x /usr/local/bin/virtualmin.sh

1	chmod u+x /usr/local/bin/virtualmin.sh

Let Virtualmin know about the virtualmin.sh. Login to Virtualmin, go to “System Settings” -> “Virtualmin Configuration” and select from dropdown “Actions upon server and user creation”. Populate the “Command to run after making changes to a server” field with:

/usr/local/bin/virtualmin.sh

1

/usr/local/bin/virtualmin.sh

Fonte: https://www.webfoobar.com/node/35

Facebook Comments

Rate this post

Post Views: 372

Install Nginx

Configure Nginx

Setup Nginx requirements

Configure Apache

Configure Virtualmin

Related posts