pkg_add nginx
Create sites directory: mkdir /etc/nginx/sites
Create dummy certificate:
openssl req -nodes -x509 -newkey rsa:4096 -keyout /etc/ssl/dummy.key -out /etc/ssl/dummy.pem -days 3650 -subj '/CN=dummy'
Nginx base config:
cat <<EOF> /etc/nginx/nginx.conf
worker_processes 1;
worker_rlimit_nofile 1024;
events {
worker_connections 800;
}
http {
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve 'X25519:secp384r1:secp521r1';
ssl_ciphers 'AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256:AEAD-AES128-GCM-SHA256:ECDHE+AESGCM+AES256:ECDHE+CHACHA20:ECDHE+AESGCM+AES128';
ssl_session_cache shared:SSL:10m;
etag off;
charset UTF-8;
include mime.types;
default_type application/octet-stream;
server_tokens off;
include /etc/nginx/sites/*;
access_log /var/www/logs/access.log;
error_log /var/www/logs/error.log;
}
EOF
cat <<EOF> /etc/nginx/sites/default
server {
listen 80 default_server;
location / {
return 403;
}
access_log off;
}
server {
listen 443 ssl http2 default_server;
location / {
return 403;
}
access_log off;
ssl_certificate /etc/ssl/dummy.pem;
ssl_certificate_key /etc/ssl/dummy.key;
}
EOF
cat <<EOF> /var/www/htdocs/robots.txt
User-agent: *
Disallow: /
EOF
server {
listen 80;
server_name example.com;
location /.well-known/acme-challenge {
alias /acme;
}
location / {
return 301 https://example.com$request_uri;
}
}
server {
listen 443 ssl http2;
server_name example.com;
root /var/www/htdocs/;
ssl_certificate /etc/ssl/example.com.fullchain.pem;
ssl_certificate_key /etc/ssl/private/example.com.key;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'none';media-src 'self';frame-ancestors 'none'";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
access_log /var/www/logs/example_com_access.log;
error_log /var/www/logs/example_com_error.log;
location /robots.txt {
alias /var/www/htdocs/robots.txt;
}
}
To enable the maintenance mode, change set $maintenance off; to on.
Create maintenance config:
cat <<'EOF'> /etc/nginx/maintenance.conf
set $maintenance off;
error_page 502 /__maintenance;
error_page 503 /__maintenance;
error_page 504 /__maintenance;
if ($maintenance = on) {
return 503;
}
location /__maintenance {
root /var/www/htdocs;
rewrite ^ /maintenance.html break;
}
EOF
Create maintenance page:
cat <<EOF> /var/www/htdocs/maintenance.html
<!doctype html>
<html>
<head>
<title>Site Maintenance</title>
<style>
body { text-align: center; padding: 150px; font: 20px Helvetica, sans-serif; color: #333; }
article { display: block; text-align: left; width: 650px; margin: 0 auto; }
h1 { font-size: 50px; }
</style>
</head>
<body>
<article>
<h1>We will be back soon!</h1>
<p>Sorry for the inconvenience but we are performing some maintenance at the moment. We will be back online shortly!</p>
<p>The Team</p>
</article>
</body>
</html>
EOF
Add this to any page that should have a maintenance mode:
include /etc/nginx/maintenance.conf;
Create error config:
cat <<EOF> /etc/nginx/error.conf
error_page 400 /__error;
error_page 500 /__error;
location /__error {
root /var/www/htdocs;
rewrite ^ /error.html break;
}
EOF
Create error page:
cat <<EOF> /var/www/htdocs/error.html
<!doctype html>
<html>
<head>
<title>Error</title>
<style>
body { text-align: center; padding: 150px; font: 20px Helvetica, sans-serif; color: #333; }
article { display: block; text-align: left; width: 650px; margin: 0 auto; }
h1 { font-size: 50px; }
</style>
</head>
<body>
<article>
<h1>Something went wrong.</h1>
<p>Sorry for the inconvenience but it seems you managed to break something. Please try again in a few minutes.</p>
<p>The Team</p>
</article>
</body>
</html>
EOF
Add this to any page that should have a custom error page:
include /etc/nginx/error.conf;