Nginx Server For Hosting Files Ubuntu 22.04 - Revision history

imported>AwesomO: /* Transfer Files to Sharing Directory */

2023-04-17T12:26:41Z

Transfer Files to Sharing Directory

← Older revision		Revision as of 12:26, 17 April 2023
Line 719:		Line 719:

	==Transfer Files to Sharing Directory==		==Transfer Files to Sharing Directory==
			NOTE: [[Scp_only\|If you are receiving file from another server (setup server to send with script and ssh-keys), you may wish to create another account which can only receive '''scp''' to path]]

	===scp===		===scp===
	Check [[SCP_Examples\|SCP_Examples]] for more examples:<br>		Check [[SCP_Examples\|SCP_Examples]] for more examples:<br>

imported>AwesomO: /* Transfer_Files_to_Sharing_Directory */

2023-04-17T12:23:23Z

Transfer_Files_to_Sharing_Directory

← Older revision		Revision as of 12:23, 17 April 2023
Line 1,327:		Line 1,327:

	====Transfer_Files_to_Sharing_Directory====		====Transfer_Files_to_Sharing_Directory====
	[[~~Nginx_file_server~~#Transfer_Files_to_Sharing_Directory\|Same as with using certbot]]<br><br>		[[Nginx_Server_For_Hosting_Files_Ubuntu_22.04#Transfer_Files_to_Sharing_Directory\|Same as with using certbot]]<br><br>
	[[~~Nginx_file_server~~#Require_Username_and_Password_to_view_website/files_(Optional_-_Placed_here_for_educational_reasons)\|Require Username and Passwd to view files]]		[[Nginx_Server_For_Hosting_Files_Ubuntu_22.04#Require_Username_and_Password_to_view_website/files_(Optional_-_Placed_here_for_educational_reasons)\|Require Username and Passwd to view files]]

Noob: /* sshfs */

2023-04-05T18:07:21Z

sshfs

← Older revision		Revision as of 18:07, 5 April 2023
Line 726:		Line 726:

	===sshfs===		===sshfs===
			[[Sshfs_ubuntu\|Read the sshfs page for more info]]<br>
	Can be useful if you are transferring a large number of files from your computer to server and want to use the GUI file explorer.<br>		Can be useful if you are transferring a large number of files from your computer to server and want to use the GUI file explorer.<br>
	<br>		<br>

Noob: /* Require Username and Password to view website/files (Optional - Placed here for educational reasons) */

2023-04-05T11:27:34Z

Require Username and Password to view website/files (Optional - Placed here for educational reasons)

← Older revision		Revision as of 11:27, 5 April 2023
Line 749:		Line 749:
	<code>/etc/nginx/sites-available/default</code>: Before		<code>/etc/nginx/sites-available/default</code>: Before
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
			<pre>
	##		##
	# You should look at the following URL's in order to grasp a solid understanding		# You should look at the following URL's in order to grasp a solid understanding
Line 912:		Line 913:

	}		}
			</pre>
	</div>		</div>
	</div>		</div>
Line 918:		Line 920:
	<code>/etc/nginx/sites-available/default</code>: After		<code>/etc/nginx/sites-available/default</code>: After
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
			<pre>
	##		##
	# You should look at the following URL's in order to grasp a solid understanding		# You should look at the following URL's in order to grasp a solid understanding
Line 1,085:		Line 1,088:

	}		}
			</pre>
	</div>		</div>
	</div>		</div>
Line 1,166:		Line 1,169:
	Restart Nginx:<br>		Restart Nginx:<br>
	<code>systemctl restart nginx</code><br>		<code>systemctl restart nginx</code><br>


	==No DNS using IP and SelfSigned Certs==		==No DNS using IP and SelfSigned Certs==

Noob: Undo revision 282 by Noob (talk)

2023-04-05T11:26:36Z

Undo revision 282 by Noob (talk)

Show changes

Noob: /* Require Username and Password to view website/files (Optional - Placed here for educational reasons) */

2023-04-05T11:22:41Z

Require Username and Password to view website/files (Optional - Placed here for educational reasons)

Show changes

Noob: /* With DNS - cert by LetsEncrypt */

2023-04-05T10:36:03Z

With DNS - cert by LetsEncrypt

← Older revision		Revision as of 10:36, 5 April 2023
Line 1:		Line 1:

	==With DNS - cert by LetsEncrypt==		==With DNS - cert by LetsEncrypt==
	[[~~Nginx_file_server~~#No_DNS_using_IP_and_SelfSigned_Certs\|No DNS Using IP and Self Signed Certs for https]]		[[Nginx_Server_For_Hosting_Files_Ubuntu_22.04#No_DNS_using_IP_and_SelfSigned_Certs\|No DNS Using IP and Self Signed Certs for https]]

	===Spin up a Server ===		===Spin up a Server ===

Noob at 10:35, 5 April 2023

2023-04-05T10:35:06Z

Show changes

Noob: /* scp */

2023-04-02T21:58:26Z

scp

← Older revision		Revision as of 21:58, 2 April 2023
Line 487:		Line 487:
	==Transfer Files to Sharing Directory==		==Transfer Files to Sharing Directory==
	===scp===		===scp===
	Check [[~~Basic_SCP_Examples~~\|Basic_SCP_Examples]] for more examples:<br>		Check [[SCP_Examples\|Basic_SCP_Examples]] for more examples:<br>
	To send direct from MediaWiki server (Example file 'xmlDump-03-03-2023')<br>		To send direct from MediaWiki server (Example file 'xmlDump-03-03-2023')<br>
	Will be prompted to enter password:<br>		Will be prompted to enter password:<br>

Noob: Created page with "==Spin up a Server == Using Vultr i am going to deploy a Ubuntu 20.04 Server.
$5 a month, 1 cpu, 1024MB ram, 25GB ssd, 1000GB Bandwidth.
I have been given the IP:192.248.155.201
===DNS=== make a A RECORD for subdomain server IP address
{| class="wikitable" |+ Dns |- |Type |Host |Ip address |TTL |- |A record |xml |192.248.155.201 |auto |- |} ==Enable Basic FireWall== `ufw allow 22/tcp`
`ufw allow 44..."`


2023-04-02T21:20:10Z
Created page with "==Spin up a Server == Using <b>Vultr</b> i am going to deploy a <b>Ubuntu 20.04</b> Server.<br \> $5 a month, 1 cpu, 1024MB ram, 25GB ssd, 1000GB Bandwidth.<br \> I have been given the IP:<b>192.248.155.201</b> <br \>  ===DNS=== make a <b>A RECORD</b> for subdomain server IP address<br>  {| class="wikitable" |+ Dns |- |Type |Host |Ip address |TTL |- |A record |xml |192.248.155.201 |auto |- |}  ==Enable Basic FireWall== <code>ufw allow 22/tcp</code><br> <code>ufw allow 44..."
New page
==Spin up a Server ==

Using <b>Vultr</b> i am going to deploy a <b>Ubuntu 20.04</b> Server.<br \>

$5 a month, 1 cpu, 1024MB ram, 25GB ssd, 1000GB Bandwidth.<br \>

I have been given the IP:<b>192.248.155.201</b> <br \>



===DNS===

make a <b>A RECORD</b> for subdomain server IP address<br>



{| class="wikitable"

|+ Dns

|-

|Type

|Host

|Ip address

|TTL

|-

|A record

|xml

|192.248.155.201

|auto

|-

|}



==Enable Basic FireWall==

<code>ufw allow 22/tcp</code><br>

<code>ufw allow 443/tcp</code><br>

<code>ufw allow 80/tcp</code><br>



<code>ufw enable</code><br \>



==Auto update Setup for server==



<code>$EDITOR /etc/apt/apt.conf.d/50unattended-upgrades</code><br \>

And change the lines:<br \>

<pre>

//      "${distro_id}:${distro_codename}-updates";

</pre>

To:

<pre>

      "${distro_id}:${distro_codename}-updates";

</pre>

<br \>



<pre>

// Remove unused automatically installed kernel-related packages

// (kernel images, kernel headers and kernel version locked tools).

//Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";



// Do automatic removal of newly unused dependencies after the upgrade

//Unattended-Upgrade::Remove-New-Unused-Dependencies "true";



// Do automatic removal of unused packages after the upgrade

// (equivalent to apt-get autoremove)

//Unattended-Upgrade::Remove-Unused-Dependencies "false";



// Automatically reboot *WITHOUT CONFIRMATION* if

//  the file /var/run/reboot-required is found after the upgrade

//Unattended-Upgrade::Automatic-Reboot "false";



// Automatically reboot even if there are users currently logged in

// when Unattended-Upgrade::Automatic-Reboot is set to true

//Unattended-Upgrade::Automatic-Reboot-WithUsers "true";



// If automatic reboot is enabled and needed, reboot at the specific

// time instead of immediately

//  Default: "now"

//Unattended-Upgrade::Automatic-Reboot-Time "02:00";



</pre>

Changed to<br \>

<pre>

// Remove unused automatically installed kernel-related packages

// (kernel images, kernel headers and kernel version locked tools).

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";



// Do automatic removal of newly unused dependencies after the upgrade

Unattended-Upgrade::Remove-New-Unused-Dependencies "true";



// Do automatic removal of unused packages after the upgrade

// (equivalent to apt-get autoremove)

Unattended-Upgrade::Remove-Unused-Dependencies "true";



// Automatically reboot *WITHOUT CONFIRMATION* if

//  the file /var/run/reboot-required is found after the upgrade

Unattended-Upgrade::Automatic-Reboot "true";



// Automatically reboot even if there are users currently logged in

// when Unattended-Upgrade::Automatic-Reboot is set to true

Unattended-Upgrade::Automatic-Reboot-WithUsers "true";



// If automatic reboot is enabled and needed, reboot at the specific

// time instead of immediately

//  Default: "now"

Unattended-Upgrade::Automatic-Reboot-Time "04:00";

</pre>



==Install NGINX==

<code>apt install nginx -y</code><br>



You should now be able to see the <b>Welcome to nginx!</b> site on your subdomain (or just use server ip address).<br>

Only <b>http</b> will work as we have not yet setup are <b>https</b><br>



===LetsEncrypt===

<code>snap install certbot --classic</code><br>

<code> certbot --nginx -d xml.completenoobs.com</code><br>

You should now be able to view the <b>Welcome to nginx!</b> page with <b>https</b><br>



===Setup NGINX===



The nginx default site should look like this:<br>

<code>cat /etc/nginx/sites-available/default</code><br>

<pre>

##

# You should look at the following URL's in order to grasp a solid understanding

# of Nginx configuration files in order to fully unleash the power of Nginx.

# https://www.nginx.com/resources/wiki/start/

# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/

# https://wiki.debian.org/Nginx/DirectoryStructure

#

# In most cases, administrators will remove this file from sites-enabled/ and

# leave it as reference inside of sites-available where it will continue to be

# updated by the nginx packaging team.

#

# This file will automatically load configuration files provided by other

# applications, such as Drupal or Wordpress. These applications will be made

# available underneath a path with that package name, such as /drupal8.

#

# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.

##



# Default server configuration

#

server {

	listen 80 default_server;

	listen [::]:80 default_server;



	# SSL configuration

	#

	# listen 443 ssl default_server;

	# listen [::]:443 ssl default_server;

	#

	# Note: You should disable gzip for SSL traffic.

	# See: https://bugs.debian.org/773332

	#

	# Read up on ssl_ciphers to ensure a secure configuration.

	# See: https://bugs.debian.org/765782

	#

	# Self signed certs generated by the ssl-cert package

	# Don't use them in a production server!

	#

	# include snippets/snakeoil.conf;



	root /var/www/html;



	# Add index.php to the list if you are using PHP

	index index.html index.htm index.nginx-debian.html;



	server_name _;



	location / {

		# First attempt to serve request as file, then

		# as directory, then fall back to displaying a 404.

		try_files $uri $uri/ =404;

	}



	# pass PHP scripts to FastCGI server

	#

	#location ~ \.php$ {

	#	include snippets/fastcgi-php.conf;

	#

	#	# With php-fpm (or other unix sockets):

	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;

	#	# With php-cgi (or other tcp sockets):

	#	fastcgi_pass 127.0.0.1:9000;

	#}



	# deny access to .htaccess files, if Apache's document root

	# concurs with nginx's one

	#

	#location ~ /\.ht {

	#	deny all;

	#}

}





# Virtual Host configuration for example.com

#

# You can move that to a different file under sites-available/ and symlink that

# to sites-enabled/ to enable it.

#

#server {

#	listen 80;

#	listen [::]:80;

#

#	server_name example.com;

#

#	root /var/www/example.com;

#	index index.html;

#

#	location / {

#		try_files $uri $uri/ =404;

#	}

#}



server {



	# SSL configuration

	#

	# listen 443 ssl default_server;

	# listen [::]:443 ssl default_server;

	#

	# Note: You should disable gzip for SSL traffic.

	# See: https://bugs.debian.org/773332

	#

	# Read up on ssl_ciphers to ensure a secure configuration.

	# See: https://bugs.debian.org/765782

	#

	# Self signed certs generated by the ssl-cert package

	# Don't use them in a production server!

	#

	# include snippets/snakeoil.conf;



	root /var/www/html;



	# Add index.php to the list if you are using PHP

	index index.html index.htm index.nginx-debian.html;

    server_name xml.completenoobs.com; # managed by Certbot





	location / {

		# First attempt to serve request as file, then

		# as directory, then fall back to displaying a 404.

		try_files $uri $uri/ =404;

	}



	# pass PHP scripts to FastCGI server

	#

	#location ~ \.php$ {

	#	include snippets/fastcgi-php.conf;

	#

	#	# With php-fpm (or other unix sockets):

	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;

	#	# With php-cgi (or other tcp sockets):

	#	fastcgi_pass 127.0.0.1:9000;

	#}



	# deny access to .htaccess files, if Apache's document root

	# concurs with nginx's one

	#

	#location ~ /\.ht {

	#	deny all;

	#}





    listen [::]:443 ssl ipv6only=on; # managed by Certbot

    listen 443 ssl; # managed by Certbot

    ssl_certificate /etc/letsencrypt/live/xml.completenoobs.com/fullchain.pem; # managed by Certbot

    ssl_certificate_key /etc/letsencrypt/live/xml.completenoobs.com/privkey.pem; # managed by Certbot

    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot

    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot



}

server {

    if ($host = xml.completenoobs.com) {

        return 301 https://$host$request_uri;

    } # managed by Certbot





	listen 80 ;

	listen [::]:80 ;

    server_name xml.completenoobs.com;

    return 404; # managed by Certbot





}

</pre>



CertBot did the work for us :) Good Bot.<br>

We just need to add one line <code>autoindex on;</code>in the <b>location { }</b>

<code>$EDITOR /etc/nginx/sites-available/default</code><br>



<div class="toccolours mw-collapsible mw-collapsed">

<code> /etc/nginx/sites-available/default</code> After appending <code>autoindex on;</code>:

<div class="mw-collapsible-content">

<pre>

##

# You should look at the following URL's in order to grasp a solid understanding

# of Nginx configuration files in order to fully unleash the power of Nginx.

# https://www.nginx.com/resources/wiki/start/

# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/

# https://wiki.debian.org/Nginx/DirectoryStructure

#

# In most cases, administrators will remove this file from sites-enabled/ and

# leave it as reference inside of sites-available where it will continue to be

# updated by the nginx packaging team.

#

# This file will automatically load configuration files provided by other

# applications, such as Drupal or Wordpress. These applications will be made

# available underneath a path with that package name, such as /drupal8.

#

# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.

##



# Default server configuration

#

server {

	listen 80 default_server;

	listen [::]:80 default_server;



	# SSL configuration

	#

	# listen 443 ssl default_server;

	# listen [::]:443 ssl default_server;

	#

	# Note: You should disable gzip for SSL traffic.

	# See: https://bugs.debian.org/773332

	#

	# Read up on ssl_ciphers to ensure a secure configuration.

	# See: https://bugs.debian.org/765782

	#

	# Self signed certs generated by the ssl-cert package

	# Don't use them in a production server!

	#

	# include snippets/snakeoil.conf;



	root /var/www/html;



	# Add index.php to the list if you are using PHP

	index index.html index.htm index.nginx-debian.html;



	server_name _;



	location / {

		# First attempt to serve request as file, then

		# as directory, then fall back to displaying a 404.

		try_files $uri $uri/ =404;

	}



	# pass PHP scripts to FastCGI server

	#

	#location ~ \.php$ {

	#	include snippets/fastcgi-php.conf;

	#

	#	# With php-fpm (or other unix sockets):

	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;

	#	# With php-cgi (or other tcp sockets):

	#	fastcgi_pass 127.0.0.1:9000;

	#}



	# deny access to .htaccess files, if Apache's document root

	# concurs with nginx's one

	#

	#location ~ /\.ht {

	#	deny all;

	#}

}





# Virtual Host configuration for example.com

#

# You can move that to a different file under sites-available/ and symlink that

# to sites-enabled/ to enable it.

#

#server {

#	listen 80;

#	listen [::]:80;

#

#	server_name example.com;

#

#	root /var/www/example.com;

#	index index.html;

#

#	location / {

#		try_files $uri $uri/ =404;

#	}

#}



server {



	# SSL configuration

	#

	# listen 443 ssl default_server;

	# listen [::]:443 ssl default_server;

	#

	# Note: You should disable gzip for SSL traffic.

	# See: https://bugs.debian.org/773332

	#

	# Read up on ssl_ciphers to ensure a secure configuration.

	# See: https://bugs.debian.org/765782

	#

	# Self signed certs generated by the ssl-cert package

	# Don't use them in a production server!

	#

	# include snippets/snakeoil.conf;



	root /var/www/html;



	# Add index.php to the list if you are using PHP

	index index.html index.htm index.nginx-debian.html;

    server_name xml.completenoobs.com; # managed by Certbot





	location / {

		# First attempt to serve request as file, then

		# as directory, then fall back to displaying a 404.

		try_files $uri $uri/ =404;

		# To allow browsing of directory

		autoindex on;

	}



	# pass PHP scripts to FastCGI server

	#

	#location ~ \.php$ {

	#	include snippets/fastcgi-php.conf;

	#

	#	# With php-fpm (or other unix sockets):

	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;

	#	# With php-cgi (or other tcp sockets):

	#	fastcgi_pass 127.0.0.1:9000;

	#}



	# deny access to .htaccess files, if Apache's document root

	# concurs with nginx's one

	#

	#location ~ /\.ht {

	#	deny all;

	#}





    listen [::]:443 ssl ipv6only=on; # managed by Certbot

    listen 443 ssl; # managed by Certbot

    ssl_certificate /etc/letsencrypt/live/xml.completenoobs.com/fullchain.pem; # managed by Certbot

    ssl_certificate_key /etc/letsencrypt/live/xml.completenoobs.com/privkey.pem; # managed by Certbot

    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot

    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot



}

server {

    if ($host = xml.completenoobs.com) {

        return 301 https://$host$request_uri;

    } # managed by Certbot





	listen 80 ;

	listen [::]:80 ;

    server_name xml.completenoobs.com;

    return 404; # managed by Certbot





}

</pre>

</div>

</div>



==Hosting XML files for easy Downloading==



we are going to delete the default index page and create another.<br>

<code>rm /var/www/html/index.nginx-debian.html</code><br>

<code>$EDITOR /var/www/html/index.html</code><br>

Insert:<br>

<pre>

<!DOCTYPE html>

<html>

<head>

<title>CompleteNoobs-XML_Dumps</title>

</head>

<body>

<h1>

<a href="xmlDumps/">Click here for are latest XML Dumps</a>.</p>

</h1>



</body>

</html>

</pre>

<br>

Create a Directory to place are dumps<br>

<code>mkdir /var/www/html/xmlDumps</code><br>

This is the directory we will place are dumps for sharing and easy downloads.<br>

<code>chown -R www-data:www-data /var/www/html/xmlDumps</code><br>

<code>systemctl restart nginx</code><br>



now create a test file with some content and test.<br>

<code>$EDITOR /var/www/html/xmlDumps/test.txt</code><br>

Check you can see/read on web browser.<br>

This is the directory where we will send are mediawiki dumps.<br>



==Transfer Files to Sharing Directory==

===scp===

Check [[Basic_SCP_Examples|Basic_SCP_Examples]] for more examples:<br>

To send direct from MediaWiki server (Example file 'xmlDump-03-03-2023')<br>

Will be prompted to enter password:<br>

<code>scp /path/to/xmlDump-03-03-2023 root@xml.completenoobs.com:/var/www/html/xmlDumps/</code><br>



===sshfs===

Can be useful if you are transferring a large number of files from your computer to server and want to use the GUI file explorer.<br>

<br>

NOTE:replace $USER with your user account (Example: mine is 'ubunix' so i will replace '$USER' with 'ubunix') <br>

Install sshfs on your computer<br>

<code>sudo apt install sshfs</code><br>

Create a Directory you are going to mount remote server directory to:<br>

<code>mkdir /home/$USER/ServerMount</code><br>

<br>

<code>sudo sshfs -o allow_other,default_permissions root@xml.completenoobs.com:/var/www/html/xmlDumps/ /home/$USER/ServerMount/</code><br>

To umount use:<br>

<code>sudo umount /home/$USER/ServerMount</code><br>



==Require Username and Password to view website/files (Optional - Placed here for educational reasons)==

<code>apt install apache2-utils</code><br>

In your <code>/etc/nginx/sites-available/default</code><br>

Append the lines(see before and after files to see where):<br>

<pre>

auth_basic "Hello Please Login";

auth_basic_user_file /etc/nginx/.htpasswd;

</pre>

<div class="toccolours mw-collapsible mw-collapsed">

<code>/etc/nginx/sites-available/default</code>: Before

<div class="mw-collapsible-content">

##

# You should look at the following URL's in order to grasp a solid understanding

# of Nginx configuration files in order to fully unleash the power of Nginx.

# https://www.nginx.com/resources/wiki/start/

# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/

# https://wiki.debian.org/Nginx/DirectoryStructure

#

# In most cases, administrators will remove this file from sites-enabled/ and

# leave it as reference inside of sites-available where it will continue to be

# updated by the nginx packaging team.

#

# This file will automatically load configuration files provided by other

# applications, such as Drupal or Wordpress. These applications will be made

# available underneath a path with that package name, such as /drupal8.

#

# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.

##



# Default server configuration

#

server {

	listen 80 default_server;

	listen [::]:80 default_server;



	# SSL configuration

	#

	# listen 443 ssl default_server;

	# listen [::]:443 ssl default_server;

	#

	# Note: You should disable gzip for SSL traffic.

	# See: https://bugs.debian.org/773332

	#

	# Read up on ssl_ciphers to ensure a secure configuration.

	# See: https://bugs.debian.org/765782

	#

	# Self signed certs generated by the ssl-cert package

	# Don't use them in a production server!

	#

	# include snippets/snakeoil.conf;



	root /var/www/html;



	# Add index.php to the list if you are using PHP

	index index.html index.htm index.nginx-debian.html;



	server_name _;



	location / {

		# First attempt to serve request as file, then

		# as directory, then fall back to displaying a 404.

		try_files $uri $uri/ =404;

	}



	# pass PHP scripts to FastCGI server

	#

	#location ~ \.php$ {

	#	include snippets/fastcgi-php.conf;

	#

	#	# With php-fpm (or other unix sockets):

	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;

	#	# With php-cgi (or other tcp sockets):

	#	fastcgi_pass 127.0.0.1:9000;

	#}



	# deny access to .htaccess files, if Apache's document root

	# concurs with nginx's one

	#

	#location ~ /\.ht {

	#	deny all;

	#}

}





# Virtual Host configuration for example.com

#

# You can move that to a different file under sites-available/ and symlink that

# to sites-enabled/ to enable it.

#

#server {

#	listen 80;

#	listen [::]:80;

#

#	server_name example.com;

#

#	root /var/www/example.com;

#	index index.html;

#

#	location / {

#		try_files $uri $uri/ =404;

#	}

#}



server {



	# SSL configuration

	#

	# listen 443 ssl default_server;

	# listen [::]:443 ssl default_server;

	#

	# Note: You should disable gzip for SSL traffic.

	# See: https://bugs.debian.org/773332

	#

	# Read up on ssl_ciphers to ensure a secure configuration.

	# See: https://bugs.debian.org/765782

	#

	# Self signed certs generated by the ssl-cert package

	# Don't use them in a production server!

	#

	# include snippets/snakeoil.conf;



	root /var/www/html;



	# Add index.php to the list if you are using PHP

	index index.html index.htm index.nginx-debian.html;

    server_name xml.completenoobs.com; # managed by Certbot





	location / {

		# First attempt to serve request as file, then

		# as directory, then fall back to displaying a 404.

		try_files $uri $uri/ =404;

	}



	# pass PHP scripts to FastCGI server

	#

	#location ~ \.php$ {

	#	include snippets/fastcgi-php.conf;

	#

	#	# With php-fpm (or other unix sockets):

	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;

	#	# With php-cgi (or other tcp sockets):

	#	fastcgi_pass 127.0.0.1:9000;

	#}



	# deny access to .htaccess files, if Apache's document root

	# concurs with nginx's one

	#

	#location ~ /\.ht {

	#	deny all;

	#}





    listen [::]:443 ssl ipv6only=on; # managed by Certbot

    listen 443 ssl; # managed by Certbot

    ssl_certificate /etc/letsencrypt/live/xml.completenoobs.com/fullchain.pem; # managed by Certbot

    ssl_certificate_key /etc/letsencrypt/live/xml.completenoobs.com/privkey.pem; # managed by Certbot

    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot

    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot



}

server {

    if ($host = xml.completenoobs.com) {

        return 301 https://$host$request_uri;

    } # managed by Certbot





	listen 80 ;

	listen [::]:80 ;

    server_name xml.completenoobs.com;

    return 404; # managed by Certbot





}

</div>

</div>



<div class="toccolours mw-collapsible mw-collapsed">

<code>/etc/nginx/sites-available/default</code>: After

<div class="mw-collapsible-content">

##

# You should look at the following URL's in order to grasp a solid understanding

# of Nginx configuration files in order to fully unleash the power of Nginx.

# https://www.nginx.com/resources/wiki/start/

# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/

# https://wiki.debian.org/Nginx/DirectoryStructure

#

# In most cases, administrators will remove this file from sites-enabled/ and

# leave it as reference inside of sites-available where it will continue to be

# updated by the nginx packaging team.

#

# This file will automatically load configuration files provided by other

# applications, such as Drupal or Wordpress. These applications will be made

# available underneath a path with that package name, such as /drupal8.

#

# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.

##



# Default server configuration

#

server {

	listen 80 default_server;

	listen [::]:80 default_server;



	# SSL configuration

	#

	# listen 443 ssl default_server;

	# listen [::]:443 ssl default_server;

	#

	# Note: You should disable gzip for SSL traffic.

	# See: https://bugs.debian.org/773332

	#

	# Read up on ssl_ciphers to ensure a secure configuration.

	# See: https://bugs.debian.org/765782

	#

	# Self signed certs generated by the ssl-cert package

	# Don't use them in a production server!

	#

	# include snippets/snakeoil.conf;



	root /var/www/html;



	# Add index.php to the list if you are using PHP

	index index.html index.htm index.nginx-debian.html;



	server_name _;



	location / {

		# First attempt to serve request as file, then

		# as directory, then fall back to displaying a 404.

		try_files $uri $uri/ =404;

	}



	# pass PHP scripts to FastCGI server

	#

	#location ~ \.php$ {

	#	include snippets/fastcgi-php.conf;

	#

	#	# With php-fpm (or other unix sockets):

	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;

	#	# With php-cgi (or other tcp sockets):

	#	fastcgi_pass 127.0.0.1:9000;

	#}



	# deny access to .htaccess files, if Apache's document root

	# concurs with nginx's one

	#

	#location ~ /\.ht {

	#	deny all;

	#}

}





# Virtual Host configuration for example.com

#

# You can move that to a different file under sites-available/ and symlink that

# to sites-enabled/ to enable it.

#

#server {

#	listen 80;

#	listen [::]:80;

#

#	server_name example.com;

#

#	root /var/www/example.com;

#	index index.html;

#

#	location / {

#		try_files $uri $uri/ =404;

#	}

#}



server {



	# SSL configuration

	#

	# listen 443 ssl default_server;

	# listen [::]:443 ssl default_server;

	#

	# Note: You should disable gzip for SSL traffic.

	# See: https://bugs.debian.org/773332

	#

	# Read up on ssl_ciphers to ensure a secure configuration.

	# See: https://bugs.debian.org/765782

	#

	# Self signed certs generated by the ssl-cert package

	# Don't use them in a production server!

	#

	# include snippets/snakeoil.conf;



	root /var/www/html;



	# Add index.php to the list if you are using PHP

	index index.html index.htm index.nginx-debian.html;

    server_name xml.completenoobs.com; # managed by Certbot





	location / {

		# First attempt to serve request as file, then

		# as directory, then fall back to displaying a 404.

		try_files $uri $uri/ =404;

		# To allow browsing of directory

		autoindex on;

		auth_basic "Hello Please Login";

		auth_basic_user_file /etc/nginx/.htpasswd;

	}



	# pass PHP scripts to FastCGI server

	#

	#location ~ \.php$ {

	#	include snippets/fastcgi-php.conf;

	#

	#	# With php-fpm (or other unix sockets):

	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;

	#	# With php-cgi (or other tcp sockets):

	#	fastcgi_pass 127.0.0.1:9000;

	#}



	# deny access to .htaccess files, if Apache's document root

	# concurs with nginx's one

	#

	#location ~ /\.ht {

	#	deny all;

	#}





    listen [::]:443 ssl ipv6only=on; # managed by Certbot

    listen 443 ssl; # managed by Certbot

    ssl_certificate /etc/letsencrypt/live/xml.completenoobs.com/fullchain.pem; # managed by Certbot

    ssl_certificate_key /etc/letsencrypt/live/xml.completenoobs.com/privkey.pem; # managed by Certbot

    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot

    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot



}

server {

    if ($host = xml.completenoobs.com) {

        return 301 https://$host$request_uri;

    } # managed by Certbot





	listen 80 ;

	listen [::]:80 ;

    server_name xml.completenoobs.com;

    return 404; # managed by Certbot





}



</div>

</div>



===Create a login Username and Password to view your website===



Add user; change <b>user1</b> to username of your choice; you will be prompted for password.<br \>

<code>htpasswd -c /etc/nginx/.htpasswd user1</code><br \>



The <b>-c</b> flag is only needed the first time to create the file <b>/etc/nginx/.htpasswd</b><br \>



Add second user; the same method is used to add has many users has you want.<br \>

<code>htpasswd /etc/nginx/.htpasswd user2</code>

<br \>

To update or change passwd for user, repeat command with username of account you wish to change; enter new password.<br \>

<code>htpasswd /etc/nginx/.htpasswd user1</code><br>

Restart Nginx:<br>

<code>systemctl restart nginx</code><br>

And try site.



===Fail2Ban to Block IP's Which Enter Incorrect Username and/or Password===

Install Fail2Ban:<br>

<code>apt install fail2ban</code><br>



<code>cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local</code><br>

<code>$EDITOR /etc/fail2ban/jail.local</code><br>

Note: Can append to the very bottom of the page.<br>

<pre>

# Reject Connections that failed username password

_action_tcp_udp = %(banaction)s[name=%(__name__)s-tcp, protocol="tcp", port="%(port)s", blocktype="REJECT --reject-with tcp-reset", chain="%(chain)s", actname=%(banaction)s-tcp]

    %(banaction)s[name=%(__name__)s-udp, protocol="udp", port="%(port)s", blocktype="REJECT --reject-with icmp-port-unreachable", chain="%(chain)s", actname=%(banaction)s-udp]





actionx = %(_action_tcp_udp)s



[nginx-cup]

#the name in brackets above is what you use for status

#   fail2ban-client status nginx-cup

enabled = true

filter = nginx-correct-up

port = http,https

logpath = /var/log/nginx/error.log

findtime = 3m

bantime = 3m

maxretry = 3

#ignoreip = <your-ipaddress>

#Note: Can find your ipaddress using `curl ifconfig.me` or visit `whatismyip.com`

</pre>

<br \>



<code>$EDITOR /etc/fail2ban/filter.d/nginx-correct-up.conf</code><br \>

<pre>

[Definition]

failregex = client:\s<HOST>

ignoreregex =

</pre>



===Check Fail2Ban for errors===

<code>fail2ban-client -d</code><br \>



===restart nginx and fail2ban so updated setting can take effect===

<code>systemctl restart fail2ban.service</code><br \>

<code>systemctl restart nginx.service</code><br \>

And test.



===Remove need for username and password===

Comment out (or delete) the following lines from your nginx config file:<br>

<code>$EDITOR /etc/nginx/sites-available/default</code><br>

<pre>

auth_basic "Hello Please Login";

auth_basic_user_file /etc/nginx/.htpasswd;

</pre>

<br>

Can comment out lines by placing a '#' in front.<br>

<pre>

#auth_basic "Hello Please Login";

#auth_basic_user_file /etc/nginx/.htpasswd;

</pre>

<br>

Restart Nginx:<br>

<code>systemctl restart nginx</code><br>