Nginx Amplify config analysis and warnings/recommendations

pamamolf · Oct 13, 2017

Please fill in any relevant information that applies to you:

CentOS Version: CentOS 7 64bit

Centmin Mod Version Installed: 123.09beta01

Nginx Version Installed: 1.13.6

PHP Version Installed: 7.0.15

MariaDB MySQL Version Installed:10.1.21

When was last time updated Centmin Mod code base ? : just now

Hello

I just test Nginx amplify on a very old Centminmod server (may miss some latest edits on Nginx config?) and i got a few warnings and recommendations that we may need to check and adjust them?

Config analysis:

1)

Missing default.conf from /etc/nginx/conf.d
The default.conf file is missing from /etc/nginx/conf.d directory. A new nginx package may automatically add default.conf without a warning. Since your nginx.conf contains the include directive for conf.d/*.conf files, a new default.conf will be automatically read by nginx. This may result in an unpredictable nginx configuration.

Create an empty default.conf file in /etc/nginx/conf.d (or copy the original default.conf from the standard nginx package).
Click to expand...

2)

Missing default_server
Default server is the virtual server that will process requests that can’t be matched against any of the configured server_name. If none of the listen directives have the default_server parameter, the first server with a given IP/port combination becomes the default one.

Add the default_server parameter for each unique listen. For instance, if you have several servers listening on port 80, add default_server to the one that should be used for all requests that don't match any configured server_name.

Check the following file:
/usr/local/nginx/conf/conf.d/phpmyadmin_ssl.conf, line 3
Click to expand...

3)

Regex location has no regex pattern
Regex location has a valid modifier, but does not have a regex pattern.

Performance-wise it is more efficient to configure exact or prefix matching for locations that do not require regex matching. It is also less prone to errors. Please refer to the documentation describing location directive to learn more.

Check the following files:
/usr/local/nginx/conf/staticfiles.conf, line 3
/usr/local/nginx/conf/staticfiles.conf, line 3
/usr/local/nginx/conf/staticfiles.conf, line 3
Click to expand...

4)

Regex location has no anchors in regex pattern
Regex location has a regex pattern without ^ or $. This is a configuration style that is prone to errors. It may also lead to a situation when requests partially matching the regex pattern are incorrectly routed to this location.

Always use ^ or $ achor in a regex pattern.

Check the following files:
/usr/local/nginx/conf/staticfiles.conf, line 3
/usr/local/nginx/conf/staticfiles.conf, line 4
/usr/local/nginx/conf/staticfiles.conf, line 3
/usr/local/nginx/conf/staticfiles.conf, line 4
/usr/local/nginx/conf/staticfiles.conf, line 3
/usr/local/nginx/conf/staticfiles.conf, line 4
Click to expand...

5)

Regex location is case-insensitive
Regex location is configured for case-insensitive matching. Using case-insensitive matching for incoming user requests is error-prone and should be generally avoided.

Use the case-sensitive regex ~ modifier instead of ~* to prevent handling of undesired requests.

Check the following files:
/usr/local/nginx/conf/autoprotect/mydomain.com/autoprotect-mydomain.com.conf, line 10
/usr/local/nginx/conf/staticfiles.conf, line 19
/usr/local/nginx/conf/staticfiles.conf, line 19
/usr/local/nginx/conf/staticfiles.conf, line 27
/usr/local/nginx/conf/staticfiles.conf, line 10
/usr/local/nginx/conf/staticfiles.conf, line 27
/usr/local/nginx/conf/staticfiles.conf, line 43
/usr/local/nginx/conf/staticfiles.conf, line 43
/usr/local/nginx/conf/staticfiles.conf, line 10
/usr/local/nginx/conf/staticfiles.conf, line 19
/usr/local/nginx/conf/staticfiles.conf, line 27
/usr/local/nginx/conf/staticfiles.conf, line 43
/usr/local/nginx/conf/staticfiles.conf, line 10
Click to expand...

6)

Missing listen directive from a virtual server
Listen directive is missing from the server block. The default configuration is to listen on port 80 (and on port 8080 if nginx is run in unprivileged mode). To avoid misconfiguration, it is best to always explicitly specify the port the server should listen on.

Add an exact listen directive to the server block instead of relying on the default configuration.

Check the following file:
/usr/local/nginx/conf/conf.d/mydomain.com.conf, line 10
Click to expand...

========================================================

/usr/local/nginx/conf/conf.d/phpmyadmin_ssl.conf, line 3

listen 443 ssl http2;
Click to expand...

/usr/local/nginx/conf/conf.d/mydomain.com.conf, line 10

server {
Click to expand...

/usr/local/nginx/conf/staticfiles.conf

# prepare for letsencrypt
# Letsencrypt - Letsencrypt SSL certificate on Centmin Mod Nginx HTTP/2
location ~ /.well-known {
location ~ /.well-known/acme-challenge/(.*) {
more_set_headers "Content-Type: text/plain";
}
}

location ~* \.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso)$ {
gzip_static off;
#add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
access_log off;
expires 30d;
break;
}

location ~* \.(js)$ {
#add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
access_log off;
expires 30d;
break;
}

location ~* \.(css)$ {
#add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
access_log off;
expires 30d;
break;
}

# location ~* \.(html|htm|txt)$ {
#add_header Pragma public;
#add_header Cache-Control "public, must-revalidate, proxy-revalidate";
#access_log off;
#expires 1d;
#break;
#}

location ~* \.(eot|svg|ttf|woff)$ {
#add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
access_log off;
expires 30d;
break;
}
Click to expand...

eva2000 · Oct 13, 2017

1 and 2 can be ignored doesn't apply to centmin mod nginx structure while i could update default templates for 6

3, 4 and 5 probably need to be fixed up though some of nginx.com blog articles also use same examples heh

pamamolf · Oct 13, 2017

It will be great to verify the correct format and adjust templates

pamamolf · Oct 14, 2017

I think also that changes should be done for Let's encrypt and phpmyadmin templates .....

Log in / Register

Forums

Want to subscribe to topics you're interested in?

Nginx Amplify config analysis and warnings/recommendations

pamamolf Well-Known Member

eva2000 Administrator Staff Member

pamamolf Well-Known Member

pamamolf Well-Known Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

Nginx Amplify config analysis and warnings/recommendations

pamamolf Well-Known Member

eva2000 Administrator Staff Member

pamamolf Well-Known Member

pamamolf Well-Known Member

.