Nginx + https

Nginx+httpsの適用を試みる

1.Nginxのインストール

sudo apt-get install nginx

2.nginxサーバブロックの設定

$ sudo vi /etc/nginx/nginx.conf

include /etc/nginx/sites-enabled/*.conf; // sites-enabled 디렉토리에서 서버 블록을 찾도록 지시
server_names_hash_bucket_size 64; // 도메인이름 분석하는데 할당되는 메모리 양

3.サーバブロックファイルの作成

sudo vi /etc/nginx/sites-available/도메인이름(프로토콜 제외).conf
ex)sudo vi /etc/nginx/sites-available/juhyeon.shop.conf



//서버 블록에 아래 내용 입력
server {
  listen  80;
  server_name 도메인이름;

  location / {
    root  /var/www/html; //vsftpd 홈디렉토리
    index  index.html index.htm index.nginx-debian.html;
    try_files $uri $uri/ =404; 
  }

  error_page  500 502 503 504  /50x.html;
  location = /50x.html {
    root  /usr/share/nginx/html;
  }
}

4.サーバブロックファイルのアクティブ化

sudo ln -s /etc/nginx/sites-available/도메인.conf /etc/nginx/sites-enabled/도메인.conf

5.nginxコマンドのクリーンアップ

$ sudo systemctl restart nginx

$ sudo ls /var/log/nginx // access.log error.log
$ sudo tail -f /var/log/nginx/access.log

로그 확인시 맨 밑줄로 이동하고 싶으면 대문자 G를 누르면 된다.
반대로 맨 위로 이동시 소문자 gg 를 누르면 된다.

6.httpsの適用

upstream app {
       server 52.79.227.179:3000;
       #localhost:3000;
} //여기 서버 주소 여러개 입력시 로드 밸런싱이 적용된다.

#limit_req_zone $request_uri zone=MYZONE:10m rate=30r/m;
#limit_req_zone $binary_remote_addr zone=zone_one:10m rate=30r/m;
limit_req_zone $binary_remote_addr zone=zone_one:10m rate=600r/m;
server {
    server_name juhyeon.shop www.juhyeon.shop;

  #13.125.157.182 http://13.125.157.182;
  #location /post/{
  #  proxy_pass http://app;
  #}


    location / {
  #  limit_req zone=MYZONE;
  #  root  /var/www/html;
      limit_req zone=zone_one burst=5;
      proxy_pass http://app;
      proxy_redirect off;
  #  index  index.html index.htm index.nginx-debian.html;
  #  try_files $uri $uri/ =404;
    }

  #location ~ /.well-known {
  #        allow all;
  #}

    error_page  500 502 503 504  /50x.html;
    location = /50x.html {
      root  /usr/share/nginx/html;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/juhyeon.shop/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/juhyeon.shop/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
   ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = www.juhyeon.shop) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = juhyeon.shop) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen  80;
    server_name juhyeon.shop www.juhyeon.shop;
    return 404; # managed by Certbot
}