NGINX - nginx.conf Dosyası

nginx komutu

-g seçeneği

Set global configuration directives anlamına gelir.

Örnek

Docker içinde nginx daemon gibi çalışmamalıdır. Bunun için şöyle yaparız. Böylece ön planda çalışır

nginx.exe -g daemon off

-s seçeneği

Send signal to the master process anlamına gelir.

Örnek

nginx sunucusunu durdurmak için Task Manager' dan öldürmeye gerek yok. Şöyle yaparız

nginx.exe -s quit

nginx.conf Yolu

Windows'ta bu dosya şuna benzer bir yerde.

C:\nginx-1.15.1\conf\nginx.conf

Directive Çeşitleri

Açıklaması şöyle. İki çeşit directive var

1. Simple Directive : listen 80 gibidir

2. Block Directive {...} şeklindedir. Örneğin http{...} bir block directive

The configuration file consists of directives that form the modules or contexts. There are two kinds of directives: simple directives and block directives. A simple directive has names and parameters separated by a space and ends with a semicolon like this listen 80; . A block directive is the same but has additional information and surrounded by braces like this { listen 80; root /usr/share/nginx/html; }.

worker_process Directive

Açıklaması şöyle.

NGINX processes are divided into one master process and several worker processes. The master process takes care of evaluating configuration and maintaining worker processes and the worker processes take care of actual requests. We can define the number of worker processes in the configuration file ...

http Block

http scope içinde sadece http trafiği ile ilgilenilir ve birden fazla server açılabilir.
Örnek - Tek react uygulaması

Şöyle yaparız. Root Dosya "html/index.html" dosyasıdır

worker_process 1;

events { 
  worker_connections 1024;
}

http {
  include mime.types
  default_type application/octet-stream
  sendfile on;
  server {
    listen 80;
    server_name localhost;
    location / {
      root html;
      try_file $uri /index.html;
    }
    location = /50x.html {
      root html;
    }
  }
}

Örnek - İki react uygulaması

Şöyle yaparız. Burada farklı portları dinleyen iki tane react uygulaması var

worker_process 1;

events { 
  worker_connections 1024;
}

http {
  include mime.types
  default_type application/octet-stream
  sendfile on;
  keepalive_timeout 65;
  server {
    listen 8080;
    server_name localhost;
    location / {
      root html;
      try_file $uri /index.html;
    }
    location = /50x.html {
      root html;
    }
  }
  server {
    listen 8081;
    server_name localhost;
    location / {
      root htmldemo;
      try_file $uri /index.html;
    }
    location = /50x.html {
      root htmldemo;
    }
  }
}

Örnek

Http load balancer için şöyle yaparız.

http {
  server {
    listen 0.0.0.0:443 ssl;
    include /etc/nginx/snippets/letsencrypt.conf;
    root /var/www/html;
    server_name XXXX;

    location / {
        proxy_pass http://rancher_servers_http;
    }
    location /.well-known/carddav {
      proxy_pass http://$host:$server_port/remote.php/dav;
    }
    location /.well-known/caldav {
      proxy_pass http://$host:$server_port/remote.php/dav;
    }
  }

  server {
    listen 80 default_server;
    listen [::]:80 default_server;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/letsencrypt;
    }
    root /var/www/html;
    server_name xxxx;

    location / {
        proxy_pass http://rancher_servers_http;
    }
  }
}

http/include mime.types

Açıklaması şöyle.

We should include this directive in the nginx.conf file otherwise all the styles are rendered as plain text in the browser.

http/server/access_log seçeneği

Örnek

Şöyle yaparız

# nginx.conf
http {
  server {
    listen              443 ssl;
    server_name         myapp.com;
    charset utf-8;
    access_log off;
   
    location / {
      proxy_pass http://myapp:8080;
    }
  }
}
events { worker_connections 1024; }

http/server/charset seçeneği

utf-8 verilir.

Örnek

Şöyle yaparız

#nginx.conf
http {
  server {
    listen              443 ssl;
    server_name         myapp.com;
    ssl_certificate     /etc/letsencrypt/live/myapp.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/myapp.com/privkey.pem;   
    charset utf-8;
    access_log off;
    location / {
      proxy_pass http://myapp:8080;
    }
  }
}
events { worker_connections 1024; }

http/server/listen seçeneği
Dinlenilecek port numaraları belirtilir. Birden fazla numara verilebilir.

Örneğin reverse proxy olarak kullanıyorsak dışarıdan gelen trafiği dinleyen ve içeriden gelen trafiği dinleyen iki tane port gerekir.

Örnek
Şöyle yaparız.

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;

    index index.html index.htm index.nginx-debian.html;

    server_name _;

    location / {
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            try_files $uri $uri/ =404;
    }

}

http/server/gzip seçeneği

Örnek

Şöyle yaparız

server {
  listen 80;
  server_name localhost;

  gzip              on;
  gzip_comp_level   2;
  gzip_min_length   1024;
  gzip_vary         on;
  gzip_proxied      expired no-cache no-store private auth;
  gzip_types        application/x-javascript application/javascript application/xml
                    application/json text/xml text/css text$
  ...
}

http/server/location seçeneği
Açıklaması şöyle

(none): If no modifiers are present, the location is interpreted as a prefix match. This means that the location given will be matched against the beginning of the request URI to determine a match.

=: If an equal sign is used, this block will be considered a match if the request URI exactly matches the location given.

~: If a tilde modifier is present, this location will be interpreted as a case-sensitive regular expression match.

~*: If a tilde and asterisk modifier is used, the location block will be interpreted as a case-insensitive regular expression match.

^~: If a carat and tilde modifier is present, and if this block is selected as the best non-regular expression match, regular expression matching will not take place.

Örnek
Şöyle yaparız. /root altındaki hrer şeye 404 döndürülür. Ancak ^~ ile belirtilen adres ve altındaki her şeye cevap verilir

http {
  server {
    listen 80;
    server_name rtmp.example.com;

    location ^~ /.well-known/acme-challenge/ {
      root /var/www/letsencrypt;
    }
    location / {
      return 404;
    }
  }
}

http/server/location/root seçeneği

Kendi diskimizdeki başlangıç dizinini yerini temsil eder.

http/server/location/proxy_pass seçeneği

HTTP Proxy yazısına taşıdım

http/server/server_name seçeneği
Aynı bilgisayarda koşan "virtual server" lar için kullanılır. 

Örnek
reverse proxy için şöyle yaparız. / altındaki her şeye cevap verilir.

server {
  server_name device1.example.com;
  location / {
    proxy_pass http://192.168.0.1:80;
  }
}
server {
  server_name device2.example.com;
  location / {
    proxy_pass http://192.168.0.2:80;
  }
}
server {
  server_name device3.example.com;
  location / {
    proxy_pass http://192.168.0.3:80;
  }
}

http/server/ssl seçenekler
- ssl_certificate ile sertifika dosyası

- ssl_certificate_key ile private key dosyası belirtilir.

Örnek
Şöyle yaparız.

server {
  listen 443 ssl;
  listen 8080;

  ssl_certificate /etc/asterisk/certs/example.crt;
  ssl_certificate_key /etc/asterisk/certs/example.key;
  ssl_session_timeout 5m;
  ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers  HIGH:!aNULL:!MD5;
  ssl_prefer_server_ciphers on;


  location / {

    # prevents 502 bad gateway error
    proxy_buffers 8 32k;
    proxy_buffer_size 64k;

    # redirect all HTTP traffic to localhost:8000;
    proxy_pass http://${GATEWAY}:8000;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    #proxy_set_header X-NginX-Proxy true;
    # enables WS support
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 999999999;
  }
}

Açıklaması şöyle

The above example nginx.conf adds uses a certificate file named example.crt and a key file named example.key. Any certificate key-pair from a trusted source will work. Simply needs to be placed in a safe location that is accessible to NGINX. The acceptable protocols are explicitly set using the ssl_protocols directive, and the allowed ciphers are set with the ssl_ciphers directive. The two proxy_set_header directives are the ones responsible for upgrading the connection. Also, since WS and WSS connections support only HTTP 1.1, another directive called proxy_http_version sets the HTTP version to 1.1.