Nginx Configuration for Web Apps

# Install from official Nginx repo (latest stable)
curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo gpg --dearmor \
    -o /usr/share/keyrings/nginx-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/ubuntu $(lsb_release -cs) nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list

sudo apt update && sudo apt install nginx -y

# Verify and start
nginx -v
sudo systemctl enable --now nginx
sudo systemctl status nginx

# Create repo file
sudo tee /etc/yum.repos.d/nginx.repo <<'EOF'
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
EOF

sudo yum install nginx -y
sudo systemctl enable --now nginx

server {
    listen 80;
    listen [::]:80;               # IPv6

    server_name example.com www.example.com;

    root /var/www/example.com/public;
    index index.html index.htm;

    # Serve static files, 404 for missing assets
    location / {
        try_files $uri $uri/ =404;
    }

    # Cache static assets aggressively
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # Deny access to hidden files (.git, .env)
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Custom error pages
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;

    # Logging
    access_log /var/log/nginx/example.com.access.log;
    error_log  /var/log/nginx/example.com.error.log warn;
}

server {
    listen 80;
    server_name myapp.com www.myapp.com;

    root /var/www/myapp/public;
    index index.php index.html;

    # Laravel: route all requests through index.php
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # Pass PHP files to PHP-FPM
    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;

        # Increase timeouts for long-running requests
        fastcgi_read_timeout 300;
        fastcgi_send_timeout 300;
    }

    # Block access to sensitive Laravel files
    location ~ /\.(env|git|htaccess) {
        deny all;
    }

    # Serve storage files (public disk)
    location /storage {
        alias /var/www/myapp/storage/app/public;
        try_files $uri $uri/ =404;
    }

    client_max_body_size 64M;    # Allow large file uploads
}

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

# Obtain and install certificate (Nginx plugin handles everything)
sudo certbot --nginx -d example.com -d www.example.com

# Test auto-renewal
sudo certbot renew --dry-run

# Redirect all HTTP → HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    # Certificates (set by certbot)
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Modern TLS settings (A+ on SSL Labs)
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    # Session resumption (performance)
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    # OCSP stapling (faster cert validation for clients)
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
    resolver 1.1.1.1 8.8.8.8 valid=300s;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    root /var/www/example.com/public;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

upstream app_cluster {
    # Least connections: routes to server with fewest active connections
    least_conn;

    # Three backend nodes
    server 10.0.1.10:3000 weight=3;   # Primary, receives 3x traffic
    server 10.0.1.11:3000 weight=2;   # Secondary
    server 10.0.1.12:3000 weight=1;   # Tertiary (smaller instance)

    # Backup server: only used if all primaries are down
    server 10.0.1.13:3000 backup;

    # Health check params
    # max_fails: mark server down after N failures
    # fail_timeout: how long to mark it as down, then retry
    server 10.0.1.14:3000 max_fails=3 fail_timeout=30s;

    # Keep alive connections to backends
    keepalive 64;
}

server {
    listen 443 ssl http2;
    server_name app.example.com;

    location / {
        proxy_pass http://app_cluster;
        proxy_http_version 1.1;
        proxy_set_header Connection "";    # Required for keepalive upstream
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Match worker count to CPU cores
worker_processes auto;

# Maximum open files per worker (must be >= worker_connections)
worker_rlimit_nofile 65535;

events {
    # Max simultaneous connections per worker
    worker_connections 4096;

    # Accept all queued connections at once (multi_accept on)
    multi_accept on;

    # Use Linux's most efficient I/O method
    use epoll;
}

http {
    # ── Basics ───────────────────────────────────────────
    sendfile           on;    # Kernel-level file transfer (bypasses userspace)
    tcp_nopush         on;    # Send headers in one packet (works with sendfile)
    tcp_nodelay        on;    # Disable Nagle for low-latency
    keepalive_timeout  65;
    keepalive_requests 1000;
    types_hash_max_size 2048;
    server_tokens      off;   # Hide Nginx version from response headers

    # ── MIME Types ───────────────────────────────────────
    include      /etc/nginx/mime.types;
    default_type application/octet-stream;

    # ── Buffers ──────────────────────────────────────────
    client_body_buffer_size    128k;
    client_max_body_size       10m;
    client_header_buffer_size  1k;
    large_client_header_buffers 4 16k;
    output_buffers             1 32k;
    postpone_output            1460;

    # ── Gzip Compression ─────────────────────────────────
    gzip              on;
    gzip_vary         on;
    gzip_proxied      any;
    gzip_comp_level   6;      # 1 (fastest) to 9 (best compression); 6 is a good balance
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        application/xml
        application/rss+xml
        image/svg+xml
        font/woff2;

    # ── Open File Cache ───────────────────────────────────
    # Cache file descriptors to avoid repeated stat() syscalls
    open_file_cache          max=200000 inactive=20s;
    open_file_cache_valid    30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors   on;

    # ── Logging ───────────────────────────────────────────
    access_log /var/log/nginx/access.log combined buffer=512k flush=1m;
    error_log  /var/log/nginx/error.log warn;

    include /etc/nginx/conf.d/*.conf;
}

server {
    # ── Restrict HTTP Methods ─────────────────────────────
    if ($request_method !~ ^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$ ) {
        return 405;
    }

    # ── Block Common Exploits ─────────────────────────────
    # Block SQL injection attempts in query string
    if ($query_string ~* "union.*select|insert.*into|drop.*table") {
        return 403;
    }

    # Block requests with invalid characters in URI
    if ($request_uri ~* "[;|`&\$]") {
        return 400;
    }

    # ── Geo Blocking (requires ngx_http_geoip2_module) ────
    # geo $blocked_country {
    #     default 0;
    #     CN 1;   # Block China
    #     RU 1;   # Block Russia
    # }
    # if ($blocked_country) { return 444; }  # 444 = no response

    # ── Deny Bot User Agents ──────────────────────────────
    if ($http_user_agent ~* (scrapy|python-requests|libwww-perl|nikto|sqlmap)) {
        return 403;
    }

    # ── Limit Request Size ────────────────────────────────
    client_max_body_size 10m;
    client_body_timeout  10s;
    client_header_timeout 10s;
    send_timeout         10s;

    # ── Buffer Overflow Protection ────────────────────────
    client_body_buffer_size    1k;
    client_header_buffer_size  1k;
    large_client_header_buffers 2 1k;
}