[root@ ~]# nginx -T nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful # configuration file /etc/nginx/nginx.conf: user nginx; worker_processes auto; #error_log /var/log/nginx/error.log; error_log syslog:server=syslog.domain.org:12302 debug; pid /run/nginx.pid; include /usr/share/nginx/modules/*.conf; events { worker_connections 1024; } http { log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; log_format graylog2_format '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for" '; access_log syslog:server=syslog.domain.org:12301 graylog2_format; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"; #ssl_ecdh_curve secp384r1; ssl_dhparam /etc/nginx/dhparam.pem; ssl_session_cache shared:SSL:10m; ssl_session_timeout 60m; ssl_session_tickets off; charset utf-8; server_tokens off; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 15; send_timeout 10; client_body_timeout 12; client_header_timeout 12; types_hash_max_size 2048; gzip on; #gzip_static on; gzip_comp_level 4; gzip_min_length 1400; gzip_vary on; gzip_proxied expired no-cache no-store private auth; gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript; include /etc/nginx/mime.types; default_type application/octet-stream; include /etc/nginx/conf.d/*.conf; server { listen 80 default_server; listen [::]:80 default_server; server_name _; root /usr/share/nginx/html; log_not_found off; include /etc/nginx/default.d/*.conf; location / { } error_page 404 /404.html; location = /40x.html { } error_page 500 502 503 504 /50x.html; location = /50x.html { } } } # configuration file /etc/nginx/mime.types: types { text/html html htm shtml; text/css css; text/xml xml; image/gif gif; image/jpeg jpeg jpg; application/javascript js; application/atom+xml atom; application/rss+xml rss; text/mathml mml; text/plain txt; text/vnd.sun.j2me.app-descriptor jad; text/vnd.wap.wml wml; text/x-component htc; image/png png; image/svg+xml svg svgz; image/tiff tif tiff; image/vnd.wap.wbmp wbmp; image/webp webp; image/x-icon ico; image/x-jng jng; image/x-ms-bmp bmp; application/font-woff woff; application/java-archive jar war ear; application/json json; application/mac-binhex40 hqx; application/msword doc; application/pdf pdf; application/postscript ps eps ai; application/rtf rtf; application/vnd.apple.mpegurl m3u8; application/vnd.google-earth.kml+xml kml; application/vnd.google-earth.kmz kmz; application/vnd.ms-excel xls; application/vnd.ms-fontobject eot; application/vnd.ms-powerpoint ppt; application/vnd.oasis.opendocument.graphics odg; application/vnd.oasis.opendocument.presentation odp; application/vnd.oasis.opendocument.spreadsheet ods; application/vnd.oasis.opendocument.text odt; application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; application/vnd.wap.wmlc wmlc; application/x-7z-compressed 7z; application/x-cocoa cco; application/x-java-archive-diff jardiff; application/x-java-jnlp-file jnlp; application/x-makeself run; application/x-perl pl pm; application/x-pilot prc pdb; application/x-rar-compressed rar; application/x-redhat-package-manager rpm; application/x-sea sea; application/x-shockwave-flash swf; application/x-stuffit sit; application/x-tcl tcl tk; application/x-x509-ca-cert der pem crt; application/x-xpinstall xpi; application/xhtml+xml xhtml; application/xspf+xml xspf; application/zip zip; application/octet-stream bin exe dll; application/octet-stream deb; application/octet-stream dmg; application/octet-stream iso img; application/octet-stream msi msp msm; audio/midi mid midi kar; audio/mpeg mp3; audio/ogg ogg; audio/x-m4a m4a; audio/x-realaudio ra; video/3gpp 3gpp 3gp; video/mp2t ts; video/mp4 mp4; video/mpeg mpeg mpg; video/quicktime mov; video/webm webm; video/x-flv flv; video/x-m4v m4v; video/x-mng mng; video/x-ms-asf asx asf; video/x-ms-wmv wmv; video/x-msvideo avi; } # configuration file /etc/nginx/conf.d/default.conf: server { listen 80; server_name localhost; #charset koi8-r; #access_log /var/log/nginx/host.access.log main; location / { root /usr/share/nginx/html; index index.html index.htm; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } # proxy the PHP scripts to Apache listening on 127.0.0.1:80 # #location ~ \.php$ { # proxy_pass http://127.0.0.1; #} # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 # #location ~ \.php$ { # root html; # fastcgi_pass 127.0.0.1:9000; # fastcgi_index index.php; # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; # include fastcgi_params; #} # deny access to .htaccess files, if Apache's document root # concurs with nginx's one # #location ~ /\.ht { # deny all; #} } # configuration file /etc/nginx/conf.d/cluster.conf: upstream cluster { server localhost:8443; server s2.domain.com:8443 backup; server s3.domain.com:8443 backup; } server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name domain.com domain.net; ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem; index index.php; add_header Strict-Transport-Security "max-age=31536000; includeSubdomains"; location /favicon.ico { access_log off; log_not_found off; } location / { proxy_pass https://cluster; proxy_redirect off; proxy_pass_request_headers on; proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504; proxy_connect_timeout 2; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } } upstream php-fpm { server unix:/var/run/php-fpm.sock; } server { listen 8443 ssl http2; listen [::]:8443 ssl http2; server_name domain.com; root /var/www/website; ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem; index index.php; location /.git/ { allow 192.168.1.0/24; allow 192.168.2.0/24; allow 192.168.3.0/24; deny all; } location ~* /\.well-known/.*$ { root /var/www/website; } location ~* /.*/img/.*\.(gif|png|jpg)$ { access_log off; rewrite ^/.*/img/(.*)$ /img/$1 break; expires max; add_header Pragma public; add_header Cache-Control "public"; } location ~* /.*/static/.*$ { access_log off; rewrite ^/.*/static/(.*)$ /static/$1 break; expires max; add_header Pragma public; add_header Cache-Control "public"; } location ~* /.*/.*\.php$ { rewrite ^/(.*)/(.*\.php)$ /controller.php?account=$1&page=$2 break; try_files $uri =404; fastcgi_pass php-fpm; fastcgi_index index.php; fastcgi_intercept_errors on; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } location ~* /.*/$ { rewrite ^/(.*)/$ /controller.php?account=$1&page=index.php break; try_files $uri =404; fastcgi_pass php-fpm; fastcgi_index index.php; fastcgi_intercept_errors on; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } location ~* /.*/.*$ { rewrite ^/(.*)/(.*)/(.*)$ /tool/$2/$3 break; rewrite ^/(.*)/(.*)$ /tool/$2 break; } location ~* .*\.php$ { try_files $uri =404; fastcgi_pass php-fpm; fastcgi_index index.php; fastcgi_intercept_errors on; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } location ~* ^\/.*[^/]$ { return 301 https://$host$request_uri/; } location / { return 301 https://domain.net; } } server { listen 8443 ssl http2; listen [::]:8443 ssl http2; server_name domain.net; root /var/www/website; ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem; index index.php; location /style.css { rewrite /style.css /tool/style.css; } location ~* .*\.php$ { try_files $uri =404; fastcgi_pass php-fpm; fastcgi_index index.php; fastcgi_intercept_errors on; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } } server { listen 80; listen [::]:80; listen 443 ssl http2; listen [::]:443 ssl http2; server_name www.domain.com; ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem; return 301 https://domain.com$request_uri; } server { listen 80; listen [::]:80; listen 443 ssl http2; listen [::]:443 ssl http2; server_name www.domain.net; ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem; return 301 https://domain.net$request_uri; } server { listen 80; listen [::]:80; server_name domain.com domain.net; return 301 https://$host$request_uri; } # configuration file /etc/nginx/fastcgi_params: fastcgi_param QUERY_STRING $query_string; fastcgi_param REQUEST_METHOD $request_method; fastcgi_param CONTENT_TYPE $content_type; fastcgi_param CONTENT_LENGTH $content_length; fastcgi_param SCRIPT_NAME $fastcgi_script_name; fastcgi_param REQUEST_URI $request_uri; fastcgi_param DOCUMENT_URI $document_uri; fastcgi_param DOCUMENT_ROOT $document_root; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param REQUEST_SCHEME $scheme; fastcgi_param HTTPS $https if_not_empty; fastcgi_param GATEWAY_INTERFACE CGI/1.1; fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; fastcgi_param REMOTE_ADDR $remote_addr; fastcgi_param REMOTE_PORT $remote_port; fastcgi_param SERVER_ADDR $server_addr; fastcgi_param SERVER_PORT $server_port; fastcgi_param SERVER_NAME $server_name; # PHP only, required if PHP was built with --enable-force-cgi-redirect fastcgi_param REDIRECT_STATUS 200;