Install Nginx as a Reverse Proxy on Fedora 27

[wirestyle22]

@JaredBusch This is from the Nginx website under pitfalls and common mistakes. I read that return's are much faster than rewrites due to not needing to evaluate RegEx(?) which is why you see return listed as a better option. I know you use rewrite and there's a lot you know that I don't so I was just wondering why that is your preference

[Alex Sage]

@jaredbusch said in Install Nginx as a Reverse Proxy on Fedora 27:

certbot --nginx -n --email [email protected] --agree-tos --domains nc.domain.com

Adding --redirect tells certbot to redirect http to https.

[wirestyle22]

@aaronstuder said in Install Nginx as a Reverse Proxy on Fedora 27:

@jaredbusch said in Install Nginx as a Reverse Proxy on Fedora 27:

certbot --nginx -n --email [email protected] --agree-tos --domains nc.domain.com

Adding --redirect tells certbot to redirect http to https.

I had no idea you could do this

[Alex Sage]

@wirestyle22 You learn something new everyday! This is what I learned

[wirestyle22]

@aaronstuder Can you paste the edit to the server block? I'd like to see what it looks like after --redirect is run

[Alex Sage]

@wirestyle22

server {
        client_max_body_size 40M;
        server_name domain.com;

        location / {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass http://10.157.95.208:80;
                proxy_redirect off;
        }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem; # m$
    ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem; #$
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

server {
    if ($host = domain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        server_name domain.com;
    return 404; # managed by Certbot


}

[Obsolesce]

@aaronstuder Hmm, looks like mine but I didn't use the --redirect.

[Alex Sage]

@obsolesce Maybe you adding it manually?

[wirestyle22]

It's standard. Only part you shouldn't have is the commented out parts.

[JaredBusch]

@wirestyle22 said in Install Nginx as a Reverse Proxy on Fedora 27:

@JaredBusch This is from the Nginx website under pitfalls and common mistakes. I read that return's are much faster than rewrites due to not needing to evaluate RegEx(?) which is why you see return listed as a better option. I know you use rewrite and there's a lot you know that I don't so I was just wondering why that is your preference

I updated the OP to reflect this.

Using the return 301 https://$host$request_uri; style.

[brandon220]

What is a good "size" for a VM that is strictly a reverse proxy? Would 20Gb be sufficient as it is not storing any data other than log files?

[wirestyle22]

@brandon220 said in Install Nginx as a Reverse Proxy on Fedora 27:

What is a good "size" for a VM that is strictly a reverse proxy? Would 20Gb be sufficient as it is not storing any data other than log files?

Yes. 15-20 GB is enough to run with a minimal install.

[scottalanmiller]

@brandon220 said in Install Nginx as a Reverse Proxy on Fedora 27:

What is a good "size" for a VM that is strictly a reverse proxy? Would 20Gb be sufficient as it is not storing any data other than log files?

Likely just fine. I use 24GB for small servers like this. And 32GB for the big ones.

[scottalanmiller]

I thin provision, so a little extra is no problem for me.

[wirestyle22]

@scottalanmiller Yeah, thin provisioning makes sense for something like this for sure

[coliver]

@wirestyle22 said in Install Nginx as a Reverse Proxy on Fedora 27:

@scottalanmiller Yeah, thin provisioning makes sense for something like this for sure

For almost everything thin provisioning makes sense. I'm sure there is an exception to the rule but I can't think of one off the top of my head.

[black3dynamite]

@coliver said in Install Nginx as a Reverse Proxy on Fedora 27:

@wirestyle22 said in Install Nginx as a Reverse Proxy on Fedora 27:

@scottalanmiller Yeah, thin provisioning makes sense for something like this for sure

For almost everything thin provisioning makes sense. I'm sure there is an exception to the rule but I can't think of one off the top of my head.

Databases?

[scottalanmiller]

@black3dynamite said in Install Nginx as a Reverse Proxy on Fedora 27:

@coliver said in Install Nginx as a Reverse Proxy on Fedora 27:

@wirestyle22 said in Install Nginx as a Reverse Proxy on Fedora 27:

@scottalanmiller Yeah, thin provisioning makes sense for something like this for sure

For almost everything thin provisioning makes sense. I'm sure there is an exception to the rule but I can't think of one off the top of my head.

Databases?

That would generally be it. HOWEVER, I normally put my DB on thin provisioning and have a separate, dedicated storage just for the data (DB files) which is thick provisioned.

Or if on Scale, the main storage gets a low HEAT score and the dedicated DB files gets set to 11.

[coliver]

@scottalanmiller said in Install Nginx as a Reverse Proxy on Fedora 27:

Or if on Scale, the main storage gets a low HEAT score and the dedicated DB files gets set to 11.

[JaredBusch]

@scottalanmiller said in Install Nginx as a Reverse Proxy on Fedora 27:

@black3dynamite said in Install Nginx as a Reverse Proxy on Fedora 27:

@coliver said in Install Nginx as a Reverse Proxy on Fedora 27:

@wirestyle22 said in Install Nginx as a Reverse Proxy on Fedora 27:

@scottalanmiller Yeah, thin provisioning makes sense for something like this for sure

For almost everything thin provisioning makes sense. I'm sure there is an exception to the rule but I can't think of one off the top of my head.

Databases?

That would generally be it. HOWEVER, I normally put my DB on thin provisioning and have a separate, dedicated storage just for the data (DB files) which is thick provisioned.

Or if on Scale, the main storage gets a low HEAT score and the dedicated DB files gets set to 11.

It depends on how much your database grows. Then provisioning is still just fine if the database size is fairly stable