nginx reverse proxy

This guild will help you setup a reverse proxy so that you can use:

• htaccess (private maps)
• https (secure connections)
• blacklist (to get rid of scrapers)

Install

Depending on the used distro you will need one of the following commands

# CentOS
yum install epel-release && yum install nginx
# Ubuntu / Debian
apt install nginx
# ArchLinux
pacman -S nginx

Configure

Depending on your distro you will need to place the following configuration in

• /etc/nginx/conf.d/monocle.conf (CentOS),
• /etc/nginx/site-enabled/monocle.conf (Debian / Ubuntu),
• /etc/nginx/nginx.conf (ArchLinux, inside the http { [...] } section)

Additionally you may have to remove the default server section from /etc/nginx/nginx.conf or /etc/nginx/site-enabled/default.conf (or simular)

server {
        listen 80;
        listen [::]:80;

        server_name _;
        access_log /var/log/nginx/http.log;

        ## uncomment if using letsencrypt
        #location /.well-known/acme-challenge {
        #    default_type "text/plain";
        #    root         /path/to/your/webroot;
        #}

        location / {
                return 301 https://$host$request_uri;
        }
}

server {
        listen 443 ssl;
        listen [::]:443 ssl;
        ssl_certificate     /path/to/your/ssl/cert;
        ssl_certificate_key /path/to/your/ssl/key;

        server_name  _;
        root         /path/to/your/webroot;
        index        index.html index.htm;

        log_format cf_custom '$remote_addr - $remote_user [$time_local]  '
                             '"$request" $status $body_bytes_sent '
                             '"$http_referer" "$http_user_agent" '
                             '$http_cf_ipcountry $http_cf_ray';
        set $logfile cf_monocle.log;
        if ($http_cf_ray = "") {
            set $logfile monocle.log;
        }
        access_log /var/log/nginx/$logfile cf_custom;

        ## uncomment if using the blacklist
        #include snippets/blacklist.conf;

        location / {
                ## uncomment if you want to restrict the access to users with a password
                #auth_basic "Restricted";
                #auth_basic_user_file /etc/nginx/.htpasswd;

                proxy_pass http://127.0.0.1:5000;
        }
}

Please replace the following parts:

• /path/to/your/webroot
• /path/to/your/ssl/cert
• /path/to/your/ssl/key

Private Maps

To create users use printf "USER:$(openssl passwd -crypt PASSWORD)\n" >> /etc/nginx/.htpasswd

If using with Cloudflare

... you will have to add the following content into /etc/nginx/nginx.conf inside the http { [...] } section.

    # trust cloudflare's IPs
    set_real_ip_from 103.21.244.0/22;
    set_real_ip_from 103.22.200.0/22;
    set_real_ip_from 103.31.4.0/22;
    set_real_ip_from 104.16.0.0/12;
    set_real_ip_from 108.162.192.0/18;
    set_real_ip_from 131.0.72.0/22;
    set_real_ip_from 141.101.64.0/18;
    set_real_ip_from 162.158.0.0/15;
    set_real_ip_from 172.64.0.0/13;
    set_real_ip_from 173.245.48.0/20;
    set_real_ip_from 188.114.96.0/20;
    set_real_ip_from 190.93.240.0/20;
    set_real_ip_from 197.234.240.0/22;
    set_real_ip_from 198.41.128.0/17;
    set_real_ip_from 199.27.128.0/21;
    set_real_ip_from 2400:cb00::/32;
    set_real_ip_from 2606:4700::/32;
    set_real_ip_from 2803:f800::/32;
    set_real_ip_from 2405:b500::/32;
    set_real_ip_from 2405:8100::/32;
    set_real_ip_from 2c0f:f248::/32;
    set_real_ip_from 2a06:98c0::/29;

    # use any of the following two
    real_ip_header X-Forwarded-For;

Hardening SSL

Run the following command

openssl dhparam -out /etc/nginx/dhparam.pem 2048

add the following content into /etc/nginx/nginx.conf inside the http { [...] } section.

server_tokens off;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/dhparam.pem;
add_header Strict-Transport-Security max-age=15768000;