apt install -y nginx
Nginx base config:
rm /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default
cat <<EOF> /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 800;
}
http {
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve X25519:secp384r1:secp521r1;
ssl_ciphers 'AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256:AEAD-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256';
etag off;
charset UTF-8;
include mime.types;
default_type application/octet-stream;
server_tokens off;
include /etc/nginx/sites-enabled/*;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
}
EOF
cat <<EOF> /var/www/html/robots.txt
User-agent: *
Disallow: /
EOF
server {
listen 80;
server_name example.com;
location /.well-known/acme-challenge {
alias /acme;
}
location / {
return 301 https://example.com$request_uri;
}
}
server {
listen 443 ssl http2;
server_name example.com;
root /var/www/html/;
ssl_certificate /etc/ssl/example.com.fullchain.pem;
ssl_certificate_key /etc/ssl/private/example.com.key;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'none';media-src 'self';frame-ancestors 'none'";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
access_log /var/log/nginx/example_com_access.log;
error_log /var/log/nginx/example_com_error.log;
location /robots.txt {
alias /var/www/html/robots.txt;
}
}
To enable the maintenance mode, change set $maintenance off; to on.
Create maintenance config:
cat <<'EOF'> /etc/nginx/maintenance.conf
set $maintenance off;
error_page 502 @maintenance;
error_page 503 @maintenance;
error_page 504 @maintenance;
if ($maintenance = on) {
return 503;
}
location @maintenance {
root /var/www/html;
rewrite ^ /maintenance.html break;
}
EOF
Create maintenance page:
cat <<EOF> /var/www/html/maintenance.html
<!doctype html>
<html>
<head>
<title>Site Maintenance</title>
<style>
body { text-align: center; padding: 150px; font: 20px Helvetica, sans-serif; color: #333; }
article { display: block; text-align: left; width: 650px; margin: 0 auto; }
h1 { font-size: 50px; }
</style>
</head>
<body>
<article>
<h1>We will be back soon!</h1>
<p>Sorry for the inconvenience but we are performing some maintenance at the moment. We will be back online shortly!</p>
<p>The Team</p>
</article>
</body>
</html>
EOF
Add this to any page that should have a maintenance mode:
include /etc/nginx/maintenance.conf;
Create error config:
cat <<EOF> /etc/nginx/error.conf
error_page 400 @error;
error_page 500 @error;
location @error {
root /var/www/html;
rewrite ^ /error.html break;
}
EOF
Create error page:
cat <<EOF> /var/www/html/error.html
<!doctype html>
<html>
<head>
<title>Error</title>
<style>
body { text-align: center; padding: 150px; font: 20px Helvetica, sans-serif; color: #333; }
article { display: block; text-align: left; width: 650px; margin: 0 auto; }
h1 { font-size: 50px; }
</style>
</head>
<body>
<article>
<h1>Something went wrong.</h1>
<p>Sorry for the inconvenience but it seems you managed to break something. Please try again in a few minutes.</p>
<p>The Team</p>
</article>
</body>
</html>
EOF
Add this to any page that should have a custom error page:
include /etc/nginx/error.conf;