Ravindra BagaleCourses & study guides मराठी Track your progress

Chapter 8: Configuring Nginx and Apache

Common Mistakes I See Students Make

By Last updated:

Friends, these config mistakes are costly on a live server – a single typo takes the site down. Read them once, and remember this list before every change.

  • Changing DocumentRoot but not the matching <Directory>, then getting 403.
  • Saving backups as site.conf.bak.conf or site-old.conf in conf.d, which loads the same site twice (conflicting server name warning).
  • Forgetting the symlink on Ubuntu Nginx, or linking with a relative path that points nowhere (ls -l sites-enabled shows broken links in red).
  • Writing server_name with http://, like server_name http://example.com;. Only the bare host name belongs there.
  • Pointing the web root at /home/ec2-user/site and changing home permissions to 777.
  • Opening a new port in the config but not in the security group.
  • Disabling SELinux instead of using semanage fcontext / semanage port.
  • Restarting without nginx -t and taking the site down with a typo.

Each mistake with what you see

Q. Backup saved as site.conf.bak.conf
nginx loads both files and you see conflicting server name "example.com" on 0.0.0.0:80, ignored. Name backups .bak, or keep them outside conf.d.

Q. http:// inside server_name
Requests never match, and you see the default site. Use only server_name example.com;.

Q. chmod 777 on home folders
It works, but anyone on the server can change your site. Use the correct owner and 755/644 instead.

Q. Disabling SELinux
It works, but you have removed a protection layer. Use semanage fcontext and restorecon.

Similar config mistakes in other stacks

Tomcat

Leaving the manager app reachable with default or weak users. Restrict it to localhost or remove it.

Spring Boot

Exposing all actuator endpoints. Expose only health and info.

Django

DEBUG=True with an empty ALLOWED_HOSTS.

Express

No reverse proxy, so the Node port is opened directly to the internet.

Laravel

nginx root set to the project folder instead of public/, which can expose .env.

ASP.NET Core

Development environment in production, which shows detailed error pages.

MongoDB / Redis

bindIp 0.0.0.0 or bind 0.0.0.0 without authentication.

Before-every-change checklist

  1. Backup named .bak, outside conf.d or with a non-.conf name.
  2. Only the host name in server_name.
  3. Correct owner, 755 for folders and 644 for files. Never 777.
  4. The new port is opened in the security group, from the right source only.
  5. SELinux fixed with semanage and restorecon, never disabled.
  6. nginx -t or configtest passes before reload.

Global example: many public outage reports from large providers list a configuration change as the trigger. The teams that recover quickly are the ones with a backup and a tested rollback, exactly as above.

Everyday: a cook tastes before serving, every time, even for a dish he has made a thousand times.

Beginner questions I get in class

Q. Why does nginx -t pass but the site still shows the old content?
You may not have reloaded, or the browser is caching. Use curl -I to check.

Key terms

  • server_name: The host names a server block answers to.
  • listen: The port (and IP) a block binds to.
  • default_server: The fallback block for a port.
  • Options -Indexes: The Apache setting that turns off directory listing.
  • semanage fcontext: Sets SELinux labels for a path.
  • limit_req: nginx request rate limiting.

Mini case study

Suppose we are a junior cloud engineer at a Bengaluru e-commerce startup (sample data). The team runs a PHP admin, a Node.js storefront API and a Python report job on two EC2 instances. Using this chapter, you write a one-page runbook: which service listens where, how to test and reload each one, which logs to read, and which ports are public (only 80 and 443, plus 22 from the office IP). New team members can then fix most problems on their own.

Recap

  • Small config slips cause big outages or leaks.
  • Test, use least privilege, keep things private by default.