GoWiki | k8s

# Nginx

## Install

```
apt install -y nginx
```

## Config

Nginx base config:

```
rm /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default

cat <<EOF> /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
  worker_connections 800;
}
http {
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ecdh_curve X25519:secp384r1:secp521r1;
  ssl_ciphers 'AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256:AEAD-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256';

etag off;
  charset UTF-8;
  include mime.types;
  default_type application/octet-stream;
  server_tokens off;
  include /etc/nginx/sites-enabled/*;

access_log /var/log/nginx/access.log;
  error_log /var/log/nginx/error.log;
}
EOF
```

## Robots

```
cat <<EOF> /var/www/html/robots.txt
User-agent: *
Disallow: /
EOF
```

## vHost

```
server {
  listen 80;
  server_name example.com;
  location /.well-known/acme-challenge {
    alias /acme;
  }
  location / {
    return 301 https://example.com$request_uri;
  }
}
server {
  listen 443 ssl http2;
  server_name example.com;
  root /var/www/html/;

ssl_certificate /etc/ssl/example.com.fullchain.pem;
  ssl_certificate_key /etc/ssl/private/example.com.key;
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header Content-Security-Policy "default-src 'none';media-src 'self';frame-ancestors 'none'";
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

access_log /var/log/nginx/example_com_access.log;
  error_log /var/log/nginx/example_com_error.log;

location /robots.txt {
    alias /var/www/html/robots.txt;
  }
}
```

## Maintenance

To enable the maintenance mode, change `set $maintenance off;` to `on`.

Create maintenance config:

```
cat <<'EOF'> /etc/nginx/maintenance.conf
set $maintenance off;
error_page 502 @maintenance;
error_page 503 @maintenance;
error_page 504 @maintenance;
if ($maintenance = on) {
  return 503;
}
location @maintenance {
  root /var/www/html;
  rewrite ^ /maintenance.html break;
}
EOF
```

Create maintenance page:

```
cat <<EOF> /var/www/html/maintenance.html
<!doctype html>
<html>
<head>
  <title>Site Maintenance</title>
  <style>
    body { text-align: center; padding: 150px; font: 20px Helvetica, sans-serif; color: #333; }
    article { display: block; text-align: left; width: 650px; margin: 0 auto; }
    h1 { font-size: 50px; }
  </style>
</head>
<body>
  <article>
    <h1>We will be back soon!</h1>
    <p>Sorry for the inconvenience but we are performing some maintenance at the moment. We will be back online shortly!</p>
    <p>The Team</p>
  </article>
</body>
</html>
EOF
```

Add this to any page that should have a maintenance mode:

```
include /etc/nginx/maintenance.conf;
```

## Server Error

Create error config:

```
cat <<EOF> /etc/nginx/error.conf
error_page 400 @error;
error_page 500 @error;
location @error {
  root /var/www/html;
  rewrite ^ /error.html break;
}
EOF
```

Create error page:

```
cat <<EOF> /var/www/html/error.html
<!doctype html>
<html>
<head>
  <title>Error</title>
  <style>
    body { text-align: center; padding: 150px; font: 20px Helvetica, sans-serif; color: #333; }
    article { display: block; text-align: left; width: 650px; margin: 0 auto; }
    h1 { font-size: 50px; }
  </style>
</head>
<body>
  <article>
    <h1>Something went wrong.</h1>
    <p>Sorry for the inconvenience but it seems you managed to break something. Please try again in a few minutes.</p>
    <p>The Team</p>
  </article>
</body>
</html>
EOF
```

Add this to any page that should have a custom error page:

```
include /etc/nginx/error.conf;
```