GoWiki | openbsd

# OpenBSD nginx

## Install

```
pkg_add nginx
```

## Config

Create sites directory: `mkdir /etc/nginx/sites`

Create dummy certificate:

```
openssl req -nodes -x509 -newkey rsa:4096 -keyout /etc/ssl/dummy.key -out /etc/ssl/dummy.pem -days 3650 -subj '/CN=dummy'
```

Nginx base config:

```
cat <<EOF> /etc/nginx/nginx.conf
worker_processes 1;
worker_rlimit_nofile 1024;
events {
  worker_connections 800;
}
http {
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ecdh_curve 'X25519:secp384r1:secp521r1';
  ssl_ciphers 'AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256:AEAD-AES128-GCM-SHA256:ECDHE+AESGCM+AES256:ECDHE+CHACHA20:ECDHE+AESGCM+AES128';
  ssl_session_cache shared:SSL:10m;

etag off;
  charset UTF-8;
  include mime.types;
  default_type application/octet-stream;
  server_tokens off;
  include /etc/nginx/sites/*;

access_log /var/www/logs/access.log;
  error_log /var/www/logs/error.log;
}
EOF
```

## Default Server

```
cat <<EOF> /etc/nginx/sites/default
server {
  listen 80 default_server;
  location / {
    return 403;
  }
  access_log off;
}
server {
  listen 443 ssl http2 default_server;
  location / {
    return 403;
  }
  access_log off;
  ssl_certificate /etc/ssl/dummy.pem;
  ssl_certificate_key /etc/ssl/dummy.key;
}
EOF
```

## Robots

```
cat <<EOF> /var/www/htdocs/robots.txt
User-agent: *
Disallow: /
EOF
```

## vHost

```
server {
  listen 80;
  server_name example.com;
  location /.well-known/acme-challenge {
    alias /acme;
  }
  location / {
    return 301 https://example.com$request_uri;
  }
}
server {
  listen 443 ssl http2;
  server_name example.com;
  root /var/www/htdocs/;

ssl_certificate /etc/ssl/example.com.fullchain.pem;
  ssl_certificate_key /etc/ssl/private/example.com.key;
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header Content-Security-Policy "default-src 'none';media-src 'self';frame-ancestors 'none'";
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

access_log /var/www/logs/example_com_access.log;
  error_log /var/www/logs/example_com_error.log;

location /robots.txt {
    alias /var/www/htdocs/robots.txt;
  }
}
```

## Maintenance

To enable the maintenance mode, change `set $maintenance off;` to `on`.

Create maintenance config:

```
cat <<'EOF'> /etc/nginx/maintenance.conf
set $maintenance off;
error_page 502 /__maintenance;
error_page 503 /__maintenance;
error_page 504 /__maintenance;
if ($maintenance = on) {
  return 503;
}
location /__maintenance {
  root /var/www/htdocs;
  rewrite ^ /maintenance.html break;
}
EOF
```

Create maintenance page:

```
cat <<EOF> /var/www/htdocs/maintenance.html
<!doctype html>
<html>
<head>
  <title>Site Maintenance</title>
  <style>
    body { text-align: center; padding: 150px; font: 20px Helvetica, sans-serif; color: #333; }
    article { display: block; text-align: left; width: 650px; margin: 0 auto; }
    h1 { font-size: 50px; }
  </style>
</head>
<body>
  <article>
    <h1>We will be back soon!</h1>
    <p>Sorry for the inconvenience but we are performing some maintenance at the moment. We will be back online shortly!</p>
    <p>The Team</p>
  </article>
</body>
</html>
EOF
```

Add this to any page that should have a maintenance mode:

```
include /etc/nginx/maintenance.conf;
```

## Server Error

Create error config:

```
cat <<EOF> /etc/nginx/error.conf
error_page 400 /__error;
error_page 500 /__error;
location /__error {
  root /var/www/htdocs;
  rewrite ^ /error.html break;
}
EOF
```

Create error page:

```
cat <<EOF> /var/www/htdocs/error.html
<!doctype html>
<html>
<head>
  <title>Error</title>
  <style>
    body { text-align: center; padding: 150px; font: 20px Helvetica, sans-serif; color: #333; }
    article { display: block; text-align: left; width: 650px; margin: 0 auto; }
    h1 { font-size: 50px; }
  </style>
</head>
<body>
  <article>
    <h1>Something went wrong.</h1>
    <p>Sorry for the inconvenience but it seems you managed to break something. Please try again in a few minutes.</p>
    <p>The Team</p>
  </article>
</body>
</html>
EOF
```

Add this to any page that should have a custom error page:

```
include /etc/nginx/error.conf;
```