Chapter 8: Configuring Nginx and Apache
8.8 Useful everyday configurations
Friends, these small configs are useful every day – the www redirect, the HTTPS redirect, hiding the version, the upload limit, a password and compression. Copy from here whenever you need them.
मित्रांनो, हे छोटे छोटे कॉन्फिग्स रोज कामाला येतात – www redirect, HTTPS redirect, व्हर्जन लपवणं, अपलोड limit, पासवर्ड आणि compression. गरज असेल तेव्हा इथून कॉपी करा.
दोस्तों, ये छोटे-छोटे कॉन्फ़िग्स रोज़ काम आते हैं – www redirect, HTTPS redirect, वर्ज़न छुपाना, अपलोड limit, पासवर्ड और compression. ज़रूरत हो तब यहाँ से कॉपी करो.
Redirect www to the main domain (or the reverse)
server {
listen 80;
server_name www.example.com;
return 301 http://example.com$request_uri;
}
<VirtualHost *:80>
ServerName www.example.com
Redirect permanent / http://example.com/
</VirtualHost>
Redirect HTTP to HTTPS
Certbot adds this automatically. By hand, it's return 301 https://$host$request_uri; (Nginx) or Redirect permanent / https://example.com/ (Apache) in the port-80 block.
Hide version numbers
# Nginx: inside http { } of nginx.conf
server_tokens off;
# Apache (AL2023/CentOS): new file /etc/httpd/conf.d/security.conf
ServerTokens Prod
ServerSignature Off
# Apache (Ubuntu): edit /etc/apache2/conf-available/security.conf (already enabled)
Check with curl -I http://localhost. The Server: header should show only nginx or Apache.
Increase the upload limit
client_max_body_size 20M; (Nginx, in http or server). For PHP apps, also raise upload_max_filesize and post_max_size in php.ini.
Password-protect a folder (basic auth)
sudo yum install -y httpd-tools # Ubuntu: sudo apt install -y apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd admin
location /admin/ {
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
}
(Apache equivalent inside <Directory>: AuthType Basic, AuthName "Restricted", AuthUserFile /etc/httpd/.htpasswd, Require valid-user.) Use this only together with HTTPS, because basic auth passwords are only base64-encoded.
Enable compression
# Nginx, inside http { }
gzip on;
gzip_types text/css application/javascript application/json image/svg+xml;
Apache: sudo a2enmod deflate on Ubuntu. On AL2023/CentOS, mod_deflate is loaded by default, so just add AddOutputFilterByType DEFLATE text/html text/css application/javascript.
Ravindra Bagale's Tip
Many students use basic auth over plain HTTP. Remember: the basic auth password only travels as base64, not encrypted – so never use it without HTTPS. And after server_tokens off;, check the Server: header with curl -I.
Ravindra Bagale's Tip – मराठी
खूप students basic auth HTTP वरच वापरतात. लक्षात ठेवा: basic auth चा password फक्त base64 मध्ये जातो, encrypted नाही – म्हणून HTTPS शिवाय कधीच वापरू नका. आणि server_tokens off; नंतर curl -I ने Server: header check करा.
Ravindra Bagale's Tip – हिंदी
बहुत students basic auth HTTP पर ही इस्तेमाल करते हैं. याद रखो: basic auth का password सिर्फ base64 में जाता है, encrypted नहीं – इसलिए HTTPS के बिना कभी इस्तेमाल मत करो. और server_tokens off; के बाद curl -I से Server: header check करो.
Lab
Chala, curl -I http://localhost madhla Server: header liha, mag server_tokens off; (Apache: ServerTokens Prod, ServerSignature Off) lava, test karun reload kara, aani parat curl -I ne version gela ka te bagha.