What it is
A web server and reverse proxy — the part that accepts incoming requests and decides which service handles them.
How we use it
As the entry point of almost every project: it serves static files, proxies requests to the right containers and checks access before a request goes any further.
Where nginx helps a business
- One server hosts several websites, and each must open on its own domain with HTTPS.
- Someone keeps guessing passwords on the admin login page, and that should be stopped before it reaches the site.
- Part of the site, or a live stream, must be visible only to your own people.
- A website and a VPN must share one port and look the same from outside.
How we use it
- One entry for all sites. On the websites server the entry nginx accepts HTTP and HTTPS, terminates TLS and hands each request to the right container by site name. Unknown names are rejected, and a bare IP address returns nothing.
- SNI on a single port. On the VPN entry node nginx reads the site name at the start of the TLS connection and decides where the stream goes: to a website, to the panel or into the tunnel.
- Access checks. In Peregovorka every request to the stream and voice goes through
auth_request: before serving, nginx asks the service whether the person is signed in. - Protecting a demo stand. On the museum site demo nginx runs the gate, security headers, the CSP policy, refusals for known site downloaders and request rate limiting.
- The WordPress login page. After the move from Joomla the entry nginx allows at most 20 requests a minute to the login page, and WordPress service files are closed.
We set up servers with nginx under Infrastructure.
Common problems
- The new certificate is not picked up. certbot updated the files, but nginx keeps serving the old certificate until it expires. You need a post-renewal hook that makes nginx re-read the certificate.
- An edit requires recreating the container. We mount the configuration as a whole directory, so an edit is applied with a config reload and live sessions are not dropped.
- A per-IP limit does not stop password guessing. Passwords are guessed from many addresses. In the online store the lockout counts per username, not only per address.
- An unusual file type. nginx does not know
.vcf, so a phone will not open a business card as a contact. On Valery Afanasiev's site the text/vcard type is set explicitly.
When you do not need it
If the site is static pages on a host like GitHub Pages, you do not need your own nginx: HTTPS is already there. And a single bot on long polling with no web interface needs no entry web server.