Nginx - Reverse Proxy

Proxy server

server {
    listen       80;
    server_name  proxy.com;

    location / {
        auth_basic "Restricted Content";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass https://destination.com;
    }
}

Load balancing

http {
    upstream myapp1 {
        server srv1.example.com;
        server srv2.example.com;
        server srv3.example.com;
    }

    server {
        listen 80;

        location / {
            proxy_pass http://myapp1;
        }
    }
}

How To Create a SSL Certificate on nginx for Ubuntu 12.04

Step One—Create a Directory for the Certificate
The SSL certificate has 2 parts main parts: the certificate itself and the public key. To make all of the relevant files easy to access, we should create a directory to store them in:

sudo mkdir /etc/nginx/ssl

We will perform the next few steps within the directory:

cd /etc/nginx/ssl

Step Two—Create the Server Key and Certificate Signing Request
Start by creating the private server key. During this process, you will be asked to enter a specific passphrase. Be sure to note this phrase carefully, if you forget it or lose it, you will not be able to access the certificate.

sudo openssl genrsa -des3 -out server.key 1024

Follow up by creating a certificate signing request:

sudo openssl req -new -key server.key -out server.csr

This command will prompt terminal to display a lists of fields that need to be filled in.

The most important line is "Common Name". Enter your official domain name here or, if you don't have one yet, your site's IP address. Leave the challenge password and optional company name blank.

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:New York
Locality Name (eg, city) []:NYC
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Awesome Inc
Organizational Unit Name (eg, section) []:Dept of Merriment
Common Name (e.g. server FQDN or YOUR name) []:example.com                 
Email Address []:webmaster@awesomeinc.com

Step Three—Remove the Passphrase
We are almost finished creating the certificate. However, it would serve us to remove the passphrase. Although having the passphrase in place does provide heightened security, the issue starts when one tries to reload nginx. In the event that nginx crashes or needs to reboot, you will always have to re-enter your passphrase to get your entire web server back online.


Use this command to remove the password:

sudo cp server.key server.key.org

sudo openssl rsa -in server.key.org -out server.key

Step Four— Sign your SSL Certificate
Your certificate is all but done, and you just have to sign it.


Keep in mind that you can specify how long the certificate should remain valid by changing the 365 to the number of days you prefer. As it stands this certificate will expire after one year.

sudo openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

You are now done making your certificate.

Step Five—Set Up the Certificate

Now we have all of the required components of the finished certificate.The next thing to do is to set up the virtual hosts to display the new certificate.
Let's create new file with the same default text and layout as the standard virtual host file. You can replace "example" in the command with whatever name you prefer:

sudo nano /etc/nginx/sites-available/example

Scroll down to the bottom of the file and find the section that begins with this:

# HTTPS server
server {
  listen 443;
  server_name example.com;

  root /usr/share/nginx/www;
  index index.html index.htm;
  
  ssl on;
  ssl_certificate /etc/nginx/ssl/server.crt;
  ssl_certificate_key /etc/nginx/ssl/server.key;
}

sudo service nginx restart

Refs https://www.digitalocean.com/community/articles/how-to-create-a-ssl-certificate-on-nginx-for-ubuntu-12-04

Solving “502 Bad Gateway” with nginx & php-fpm

After upgrading php-fpm, my PHP-based sites were returning “502 Bad Gateway” errors. Here’s how I managed to solve it.

Check to make sure that php-fpm is running with

ps auxww | grep php

– if you can’t see any php-fpm processes in the output, then you may need to re-install php-fpm. If php-fpm is running okay, then skip this first step.

sudo apt-get remove php5 php5-cgi php5-fpm

sudo apt-get install php5 php5-cgi php5-fpm

The thing to notice here is that the order in which you install the packages is important. In the past I have found that installing them in the wrong order causes the packages to be configured incorrectly.

Next, get php-fpm to listen on the correct host/port. In /etc/php5/fpm/pool.d/www.conf change the following line from:

listen = /var/run/php5-fpm.sock

To:

listen = 127.0.0.1:9000

Restart php-fpm with

sudo /etc/init.d/php5-fpm restart

and everything should work normally again.

server {
        listen 80;
        server_name your_domain.com;
        root /your_document_root;
        index index.php;
        access_log  /your_document_root/logs/access_log;
        error_log  /your_document_root/logs/error_log;



        location / {
                if (!-e $request_filename) {
                        rewrite ^(.*)$ /index.php last;
                        break;
                 }
        }

    location ~ \.php$ {
        include fastcgi_params;
        try_files $uri =404;
        fastcgi_pass  127.0.0.1:9000;
        # fastcgi_pass  unix:/var/run/php5-fpm.sock;
        fastcgi_param SCRIPT_FILENAME /your_document_root$fastcgi_script_name;
        fastcgi_index  index.php;
    }
}

Ref: http://wildlyinaccurate.com/solving-502-bad-gateway-with-nginx-php-fpm

Ruby on Rails + Slim & Nginx + Unicorn

The first, you must install Ruby and Rails for your computer.
Deploy website on Nginx & Unicorn

Install Nginx

$ sudo apt-get install nginx

Setup virtual host for Nginx. Open file /etc/nginx/sites-available/your_domain.name and add below lines:

server {
        listen 80;
        server_name your_domain.name;
        root /document_root;
        index index.php;
        #access_log  /var/nginx/access.log
}

Install Unicorn

$ gem install unicorn

Setup Unicorn to process request for Ruby Application on Nginx. Continue add more below lines into setup files of nginx

upstream unicorn {
  server unix:/tmp/unicorn.hello.sock fail_timeout=0;
}

server {
  listen 80 default deferred;
  server_name hello.jp;
  root /home/taind/svn/demo/hello;

  try_files $uri/index.html $uri @unicorn;
  location @unicorn {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_pass http://unicorn;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 4G;
  keepalive_timeout 10;
}

Add a boot loader file file Unicorn in document_root/config/unicorn.rb

root = "/home/taind/svn/demo/hello"
working_directory root
pid "#{root}/tmp/pids/unicorn.pid"
stderr_path "#{root}/log/unicorn.log"
stdout_path "#{root}/log/unicorn.log"

listen "/tmp/unicorn.hello.sock"
worker_processes 2
timeout 30

# Force the bundler gemfile environment variable to
# reference the capistrano "current" symlink
before_exec do |_|
  ENV["BUNDLE_GEMFILE"] = File.join(root, 'Gemfile')
end

After finish all above steps, you just start Nginx and Unicorn
Start Nginx

$ service nginx start

Start Unicorn

unicorn_rails -c document_root/config/unicorn.rb -D

Setup Slim template
How to start?
Install Slim as a gem:

$ gem install slim

Include Slim in your Gemfile with gem 'slim' or require it with require 'slim'. That's it! Now, just use the .slim extension and you're good to go.