Category: Nginx

Tested in Nginx 1.10 / PHP-FPM 5.6

By default php-fpm shows “File not found” when someone try to request a php file that doesn’t exist. If you use php-fpm in nginx with fastcgi for using custom errors just configure this in nginx.conf:

fastcgi_intercept_errors on;

Tested in Ubuntu 14 / Nginx 1.11

If you use a custom port to serve SSL and you want to force a secure connection redirecting from http to https, a solution is use error_page directive with code 497:

server {

        listen 8080 ssl;

        root /usr/share/nginx/mydomain;
        index index.html index.php;

        ssl_certificate /etc/ssl/certs/mydomain.com.crt;
        ssl_certificate_key /etc/ssl/private/mydomain.com.key;

        error_page 497  https://$host:$server_port$request_uri;

        ...

}

Don’t forget to reload nginx:

~ $ /etc/init.d/nginx reload

Tested on Debian 7 / NGINX 1.10

You can watch the nginx connections stats compiling nginx with the option http_stub_status_module:

~ $ ./configure --sbin-path=/usr/local/sbin --prefix=/etc/nginx --conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx.pid --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --with-http_ssl_module --with-http_addition_module --with-pcre-jit --with-http_stub_status_module

Make and install:

~ $ make && make install

Now add this to the section server in the vhost config:

location /nginx_status {
                stub_status on;
                access_log off;
                allow x.x.x.x;
                deny all;
        }

Where x.x.x.x is your IP address. Also you can protect URL by http auth:

location /nginx_status {
                stub_status on;
                access_log off;
                auth_basic "Auth required";
                auth_basic_user_file /etc/nginx/htpasswd;
        }

Generate password file:

~ $ htpasswd -c /etc/nginx/htpasswd administrator
New password: 
Re-type new password: 
Adding password for user administrator
~ $ cat /etc/nginx/htpasswd
administrator:$apr1$kpTScFHe$A8W0.xtVq.gfiCY/9SdO71

Then reload nginx:

~ $ /etc/init.d/nginx reload

On load http://mydomain.com/nginx_status you will see:

Active connections: 2 
server accepts handled requests
 xxx yyy zzz 
Reading: 0 Writing: 2 Waiting: 0

Where:

mydomain.com: is your domain
xxx: total accepted connections
yyy: total handled connections
zzz: total handled requests

Tested on Debian 7 / NGINX 1.10

When a web server is working behind a proxy, ha-proxy, varnish, or any web server in proxy mode, by default in the log file, you see the IP of proxy server not the real client IP, this can be a trouble for making statistics for example.

Usually you can configure the proxy server for making forwarding of the client IP by X-Forwarded-For header, for example in varnish4 you can do it so:

req.http.X-Forwarded-For = client.ip;

But it’s not enough because is still necessary modify the configuration in the destination web server.

Nginx can be configured to show the client IP but for do it we need to compile from the sources. At this article the workaround is for Debian 7.

First, install the development libraries needed:

~ $ apt-get install libpcre3-dev libgeoip-dev libssl-dev libc6 libpcre3 zlib1g lsb-base

Second, download sources from the official site and unpack files, then run configure with the desirable options, for our case we need with-http_realip_module option:

~ $ ./configure --sbin-path=/usr/local/sbin --prefix=/etc/nginx --conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx.pid --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_geoip_module --with-pcre-jit

Make:

~ $ make

And install:

~ $ make install

Finally add next configuration to nginx.conf file inside http block, where x.x.x.x is the proxy server IP:

set_real_ip_from x.x.x.x;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

And restart nginx:

~ $ /etc/init.d/nginx restart