Table of Contents

Create Config File nginx.conf on Server.

Location:

Linux:
AWS: /home/ec2-user/nginx/nginx.conf

Process

Create nginx directory(Path: /home/ec2-user/nginx)
1. mkdir nginx && chmod 775 -R nginx
Create nginx.conf file (Path: /home/ec2-user/nginx/nginx.conf)
1. vi nginx.conf
press i to insert information
Attache below information
press esc to exit edit
write :wq to sava and exit

nginx.conf

...

Table of Contents

...

nginx.conf 설정

vi 편집기로 열기

vi /etc/nginx/nginx.conf

기본 설정 파일

Expand

title	nginx.conf

Code Block

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush

'"$http_user_agent" "$http_x_forwarded_for"'

on;
    tcp_nodelay

access_log

/var/log/nginx/access.log

main;

on;

sendfile

   keepalive_timeout   65;

on;

types_hash_max_size 2048;

tcp_nopush

  include

on;

tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; include /etc

/etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

index index.html index.htm; server

server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        server_name

localhost

_;
        root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
        }

# redirect server error pages to the static page

/40x.html


        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;

#

redirect

server

error

pages

to

the

static

location

page

= /50x.html {
        }

error_page

500

502

503

504

/50x.html;

  
# Settings for a TLS enabled server.
#
#

location

=

/50x.html

server {
#        listen

}

443 ssl http2 default_server;
#

Create Config File jenkins.conf on Server.

Location: /home/ec2-user/nginx/conf.d/jenkins.conf

Choice Option

When creating jenkins.conf, there is 3 option like below:

For 80 port(Http) only.
For 80(Http) & 443(https) port.
[Recommend] For 80(Http) redirect 443(https) when access 80 toward 443 automatically.

Process

Create conf.d directory(Path: /home/ec2-user/nginx/conf.d)
1. mkdir conf.d
Create jenkins.conf file (Path: /home/ec2-user/nginx/conf.d/jenkins.conf)
1. vi jenkins.conf
press i to insert information
Attache below information
edit server_name using domain
1. ex) server_name jenkins.justten.io;
edit proxy_pass using docker gateway or localhost
1. ex) docker gateway: proxy_pass http://172.17.0.1:9000;
  1. how to find docker gateway
    1. write: docker inspect nginx
    2. check networks → gateway
      Image Removed
2. ex) localhost(default): proxy_pass http://localhost:9000;
Press esc to exit edit
Write :wq to save and exit

For 80 port(Http) only

Attach below information on the jenkins.conf

jenkins.conf

Code Block

server {
    listen       80 ;
    server_name  jenkins.justten.io;
    charset utf-8;
    rewrite_log  on;
    client_max_body_size 50M;
    location / {
        proxy_pass http://172.17.0.1:9000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-Proto http;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_connect_timeout 300;
        proxy_send_timeout 300;
        proxy_read_timeout 300;
        send_timeout 300;
    }

}

For 80(Http) & 443(https) port

attached listen 443; blow 80 port.

jenkins.conf

Code Block

server {
    listen       80;
    listen       443;
    server_name  jenkins.justten.io;
    charset utf-8;
    rewrite_log  on;
    client_max_body_size 50M;
    location / {
        proxy_pass http://172.17.0.1:9000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-Proto http;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_connect_timeout 300;
        proxy_send_timeout 300;
        proxy_read_timeout 300;
        send_timeout 300;
    }

}

For 80(Http) redirect 443(https)

To redirect 443 port from 80, attach blow on nignx.conf:

Code Block

server { listen 80; listen 443; server_name jenkins.justten.io; charset utf-8; rewrite_log on; client_max_body_size 50M; location / { proxy_pass http://172.17.0.1:9000; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-Proto http; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_connect_timeout 300; proxy_send_timeout 300; proxy_read_timeout 300;

    listen       [::]:443 ssl http2 default_server;
#

send

server_

timeout

name

300

_;
#

}

    root

if

($http_x_forwarded_proto

=

"http")

{

   /usr/share/nginx/html;
#
#

return

301 https://$server_name$request_uri;

ssl_certificate "/etc/pki/nginx/server.crt";
#

}

AWS Certificate Manager’s SSL

set : listen 443

if use other ssl, go to

https://ionsdp.atlassian.net/wiki/spaces/ICE3/pages/621707375/Nginx+install+on+Docker#Openssl
set: listen 443 ssl

jenkins.conf

Code Block

server {

ssl_certificate_key "/etc/pki/nginx/private/server.key";
#

listen

80

ssl_session_cache shared:SSL:1m;
#

listen

    ssl_session_timeout

443

10m;
#

server_name

jenkins.justten.io; charset utf-8;

 ssl_ciphers HIGH:!aNULL:!MD5;
#        ssl_prefer_

session

server_

timeout

ciphers

5m

on;
#
#

rewrite_log

on;

  # Load

client_max_body_size 50M; location / {

configuration files for the default server block.
#

proxy_pass http://172.17.0.1:9000;

include /etc/nginx/default.d/*.conf;
#
#

proxy_http_version 1.1;

location / {
#

proxy_set_header

Upgrade $http_upgrade;

}
#
#

proxy

error_

set_header

page

Connection 'upgrade';

404 /404.html;
#

proxy_set_header

Host

$host;

 location = /40x.html {
#

proxy_cache_bypass $http_upgrade;

    }
#
#

proxy_set_header

X-Forwarded-Host

$host;

 error_page 500 502 503 504 /50x.html;
#

proxy_set_header

X-Forwarded-Server

$host;

        location

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

= /50x.html {
#        }
#

proxy_connect_timeout

300;

  }

}

...

gzip 압축 설정

Code Block

# enable gzip compression

proxy_send_timeout 300gzip on;
gzip_disable "MSIE [1-6]\."; //IE 대응
gzip_vary on;
 proxygzip_readmin_timeoutlength  30010240;
gzip_buffers     16 8k;
 sendgzip_timeoutproxied 300any;
gzip_comp_level 6; // compress }level 설정(1~10)
gzip_http_version   location ~ /\.ht {
     1.1;
// 압축할 파일 형식 설정
gzip_types   deny all;   text/html  }
    if ($http_x_forwarded_proto = "http") {
        return    301 https://$server_name$request_uri;
    }
}

Run Nginx

Run Nginx container in Docker:

Code Block
docker run --restart="always" -d --name nginx \ -p 80:80 -p 443:443 \ -v ~/nginx/nginx.conf:/etc/nginx/nginx.conf \ -v ~/nginx/log:/var/log/nginx \ -v ~/nginx/conf.d/:/etc/nginx/conf.d/ \ nginx:latest

p ( set port)
d (run container in background and print container ID)
-v (volume config files above to container)
--name ( set name to the container)

SSL

To use 443, have to preset ssl file

Amazon Certificate manager

Create SSL on ACM.

https://aws.amazon.com/certificate-manager

...

To Check whether operating SSL on 443 port or not

Access the server

Click Lock icon on address area

...

Openssl

Edit host

sudo vi /etc/hosts
Attach gateway information
- 172.17.0.1 justten.io

...

Create a folder on nginx folder(parh: /home/ec2-uesr/nginx/ssl)

mkdir ssl

Create a key file(parh: /home/ec2-uesr/nginx/ssl/{host_name}.key)

{host_name}.key is jenkins.key
- openssl genrsa -out {host_name}.key 2048

Create csr file(parh: /home/ec2-uesr/nginx/ssl/{host_name}.csr)

openssl req -new -key {host_name}.key -out {host_name}.csr

Create crt file(parh: /home/ec2-uesr/nginx/ssl/{host_name}.csr)

openssl x509 -req -days 365 -in {host_name}.csr -signkey {host_name}.key -out {host_name}.crt

Copy into folder & apply crt file

sudo cp {host_name}.crt /etc/pki/ca-trust/source/anchors/

sudo update-ca-trust enable

sudo update-ca-trust extract

docker restart

sudo service docker restart

Create Auth(parh: /home/ec2-user/nginx/ssl/.htpasswd)

install htpasswd

yum install htpasswd

id: htpasswd -c .htpasswd system

pw: dkdldhs!QAZ(default)

pull docker registry to using config without setting inside docker image

Code Block
docker run --restart="always" -d --name docker-registry \ -v /tmp/registry:/tmp/registry \ registry

jenikins.conf amendment

Code Block

server {application/x-javascript text/css application/javascript text/javascript text/plain application/json application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/xml font/eot font/opentype font/otf image/svg+xml text/xml application/xml ;

#end gzip configuration

동작확인

크롬에서 해당 서버 접속
개발자 도구 → Response Headers
content-encoding: gzip으로 설정되었는지 확인

...

기본 설정 파일

Expand

title	nginx.conf

Code Block

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80 default_server;

listen

    listen

443

ssl;

server_name {host_name}.justten.io

[::]:80 default_server;

charset

utf-8;

   server_name

ssl_session

timeout 5m

ssl

on;

   root

ssl_certificate

/etc/ssl/{host_name}.crt;

ssl_certificate_key

 /usr/

etc

share/

ssl/{host_name}.key

nginx/html;

rewrite_log

on;

  # Load

client_max_body_size 50M; location / {

configuration files for the default server block.

proxy_pass http://docker-registry:5000

include /etc/nginx/default.d/*.conf;

proxy_http_version 2;

location / {

proxy_set_header

Upgrade

$http_upgrade;

proxy

error_

set_header

page

Connection 'upgrade';

404 /404.html;

proxy_set_header

Host

$host;

     location = /40x.html {

proxy_cache_bypass

$http_upgrade;

proxy_set_header

X-Forwarded-Host

$host;

      error_page 500 502

proxy_set_header X-Forwarded-Server $host

503 504 /50x.html;

proxy_set_header

X-Forwarded-For

$proxy_add_x_forwarded_for;

  location = /50x.html {

proxy_connect_timeout

300;

   }
    }

proxy_send_timeout

300;

   
# Settings for a TLS

proxy_read_timeout 300;

enabled server.
#
#    server {
#

send_timeout

300;

      listen

auth_basic

   443 ssl http2 default_server;
#

"Restricted";

   listen

auth_basic_user_file /etc/ssl/.htpasswd;

 [::]:443 ssl http2 default_server;
#

}

    server_name

if

($http_x_forwarded_proto = "http") {

_;
#        root

return

301 https://$server_name$request_uri;

 /usr/share/nginx/html;
#
#

}

 ssl_certificate "/etc/pki/nginx/server.crt";
#

location

~ /\.ht {

ssl_certificate_key "/etc/pki/nginx/private/server.key";
#

deny all; } }

login docker

docker login {host_name}.justten.io

nignx.conf optimization

AWS t2.large spec: CPU 2 core, RAM 8 GB

CPU: Dual-core

worker_processes 2;

Ram up to 8GB

worker_rlimit_nofile 8192;

worker_priority: Range: -10 ~ 20

worker_priority 0;

Simultaneous connection

Code Block
events { multi_accept off; worker_connections 1024; }

nginx.conf(Location: home/ec2-user/nginx/nginx.conf)

Code Block

worker_processes 2; worker_rlimit_nofile 8192; worker_priority 0; worker_cpu_affinity 0001 0010 0100 1000; # Simultaneous connection events { multi_accept off;

ssl_session_cache shared:SSL:1m;
#        ssl_session_timeout  10m;
#        ssl_ciphers HIGH:!aNULL:!MD5;
#        ssl_prefer_server_ciphers on;
#
#        # Load configuration files for the default server block.
#        include /etc/nginx/default.d/*.conf;
#
#        location / {
#        }
#
#        error_page 404 /404.html;
#

worker_connections

1024; }

Image Removed

gzip to Compress

install

to make web site loading fast, using compress. gzip is one of the best popular compresses which already includes Nginx module.

(path: /home/ec2-user/nginx/nginx.conf/)

Code Block

# enable gzip compression gzip on; gzip_disable "MSIE [1-6]\."; gzip_vary on; gzip_min_length 10240; gzip_buffers

 location = /40x.html {
#        }
#
#

16

8k;

gzip

error_

proxied

page

any; gzip_comp_level 6; gzip_http_version 1.1; gzip_types

500 502 503 504 /50x.html;
#

text/html

application/x-javascript

text/css

application/javascript

text/javascript text/plain application/json application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/xml font/eot font/opentype font/otf image/svg+xml text/xml application/xml ; #end gzip configuration

check working

Response Headers → content-encoding

...

Enable Http2

install

Attach http2 on config file(path: /home/ec2-user/nginx/conf.d/jenkins.conf/)

listen 443 http2

...

if use SSL inside the server

listen 443 ssl http2

working tetst

https://tools.keycdn.com/http2-test

...

Reference

install Http2 as a nginx latest version

https://ma.ttias.be/enable-http2-in-nginx/

HTTP/1.1 vs HTTP/2: What's the Difference?

...

 location = /50x.html {
#        }
#    }

}

...

정적 리소스 캐싱 Path 설정

...

nignx.conf 성능 튜닝

리눅스 CPU와 Ram 스펙에 따라 설정 변경

AWS t2.large spec: CPU 2 core, RAM 8 GB

CPU: Dual-core

worker_processes 2;

Ram up to 8GB

worker_rlimit_nofile 8192;

worker_priority: Range: -10 ~ 20

worker_priority 0;

Simultaneous connection

Code Block
events { multi_accept off; worker_connections 1024; }

Expand

title	nginx.conf(Location: home/ec2-user/nginx/nginx.conf)

Code Block
worker_processes 2; worker_rlimit_nofile 8192; worker_priority 0; worker_cpu_affinity 0001 0010 0100 1000; # Simultaneous connection events { multi_accept off; worker_connections 1024; }

Image Added

...

Versions Compared

Old Version 1

New Version Current

Key

Create Config File nginx.conf on Server.

Process

nginx.conf 설정

vi 편집기로 열기

기본 설정 파일

Create Config File jenkins.conf on Server.

Choice Option

Process

For 80 port(Http) only

For 80(Http) & 443(https) port

For 80(Http) redirect 443(https)

gzip 압축 설정

Run Nginx

SSL

Amazon Certificate manager

Openssl

동작확인

기본 설정 파일

nignx.conf optimization

gzip to Compress

install

check working

Enable Http2

install

working tetst

Reference

정적 리소스 캐싱 Path 설정

nignx.conf 성능 튜닝

리눅스 CPU와 Ram 스펙에 따라 설정 변경

Page Comparison

Versions Compared

Old Version 1

New Version Current

Key

Create Config File nginx.conf on Server.

Process

nginx.conf 설정

vi 편집기로 열기

기본 설정 파일

Create Config File jenkins.conf on Server.

Choice Option

Process

For 80 port(Http) only

For 80(Http) & 443(https) port

For 80(Http) redirect 443(https)

gzip 압축 설정

Run Nginx

SSL

Amazon Certificate manager

Openssl

동작확인

기본 설정 파일

nignx.conf optimization

gzip to Compress

install

check working

Enable Http2

install

working tetst

Reference

정적 리소스 캐싱 Path 설정

nignx.conf 성능 튜닝

리눅스 CPU와 Ram 스펙에 따라 설정 변경