Nginx আর reverse proxy — virtual host, TLS আর প্রথম deployment

# /etc/nginx/nginx.conf (a short sample, not a full file)
user www-data;              # worker runs as this user
worker_processes auto;      # usually one per CPU core

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    access_log /var/log/nginx/access.log;
    error_log  /var/log/nginx/error.log;
    include /etc/nginx/sites-enabled/*;
}

server {
    listen 80 default_server;
    server_name _;       # a name that matches nothing real
    return 444;          # nginx-only code: close without any reply
}

// nginx location matching: exact, longest prefix (^~ stops), regex in file order.
// A small model for learning, not nginx's real code.
const locations = [
  { mod: "",   path: "/" },
  { mod: "",   path: "/api/" },
  { mod: "=",  path: "/healthz" },
  { mod: "^~", path: "/static/" },
  { mod: "~*", path: "\\.(png|jpg|css)$" },
  { mod: "~",  path: "^/api/v[0-9]+/admin" },
];
const isPrefix = l => l.mod === "" || l.mod === "^~";
const isRegex = l => l.mod === "~" || l.mod === "~*";

function match(uri) {
  const exact = locations.find(l => l.mod === "=" && l.path === uri);
  if (exact) return [exact, "exact match: stop"];
  const best = locations.filter(l => isPrefix(l) && uri.startsWith(l.path))
    .sort((a, b) => b.path.length - a.path.length)[0];
  if (best && best.mod === "^~") return [best, "longest prefix has ^~: skip regex"];
  for (const l of locations.filter(isRegex)) {
    const re = new RegExp(l.path, l.mod === "~*" ? "i" : "");
    if (re.test(uri)) return [l, "first regex in file order"];
  }
  return [best, "no regex matched: use longest prefix"];
}

const tests = ["/healthz", "/healthz/", "/static/logo.png", "/img/photo.PNG",
  "/api/books", "/api/cover.png", "/api/v2/admin/users", "/about"];
for (const uri of tests) {
  const [loc, why] = match(uri);
  console.log(uri.padEnd(21), "->", (loc.mod + " " + loc.path).trim());
  console.log(" ".repeat(24) + why);
}

location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

upstream bookstall_app {
    # least_conn;                         # fewest active connections first
    server 127.0.0.1:3001 max_fails=2 fail_timeout=5s;
    server 127.0.0.1:3002 max_fails=2 fail_timeout=5s;
}

server {
    # ...
    location /api/ {
        proxy_pass http://bookstall_app;
        proxy_connect_timeout 3s;         # waiting to connect
        proxy_read_timeout    30s;        # gap between two reads of the reply
        proxy_next_upstream   error timeout;
    }
}

// Round-robin upstream: B hangs from t=4 to t=11. One request per simulated second.
// Simplified model of max_fails, fail_timeout and proxy_next_upstream.
const MAX_FAILS = 2, FAIL_TIMEOUT = 5, READ_TIMEOUT_MS = 3000, NORMAL_MS = 20;
const backends = ["A", "B", "C"].map(name => ({ name, fails: 0, checked: 0 }));
const hung = (b, t) => b.name === "B" && t >= 4 && t <= 11;
const usable = (b, t) => b.fails < MAX_FAILS || t - b.checked > FAIL_TIMEOUT;
let next = 0;

function pick(t, tried) {
  for (let i = 0; i < backends.length; i++) {
    const k = (next + i) % backends.length, b = backends[k];
    if (usable(b, t) && !tried.has(b)) { next = (k + 1) % backends.length; return b; }
  }
  return null;
}
function handle(t, method) {
  const tried = new Set(), path = [];
  let ms = 0;
  for (;;) {
    const b = pick(t, tried);
    if (!b) return { status: 502, path, ms };            // no live upstream
    tried.add(b);
    if (!hung(b, t)) { b.fails = 0; path.push(b.name); return { status: 200, path, ms: ms + NORMAL_MS }; }
    b.fails++; b.checked = t; ms += READ_TIMEOUT_MS; path.push(b.name + "!");
    if (method === "POST") return { status: 504, path, ms }; // already sent: not retried
  }
}
const POST_AT = new Set([7]);
console.log(" t method path    status  ms   B.fails");
for (let t = 1; t <= 14; t++) {
  const method = POST_AT.has(t) ? "POST" : "GET";
  const r = handle(t, method);
  console.log(String(t).padStart(2), method.padEnd(6), r.path.join(",").padEnd(7),
    String(r.status).padEnd(7), String(r.ms).padEnd(5), backends[1].fails);
}

server {
    listen 443 ssl;
    server_name shop.example.com;

    ssl_certificate     /etc/letsencrypt/live/shop.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/shop.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Start small. Raise max-age only after HTTPS has proved stable.
    add_header Strict-Transport-Security "max-age=300" always;
}

server {
    listen 80;
    server_name shop.example.com;
    return 301 https://$host$request_uri;
}

$ sudo nginx -t          # check the whole config; changes nothing
$ sudo nginx -T          # same, and print the full merged config
$ sudo systemctl reload nginx

# নমুনা আউটপুট, version-ভেদে আলাদা হতে পারে
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

gzip on;
gzip_types text/css application/javascript application/json;
gzip_min_length 1024;

location ^~ /static/ {
    add_header Cache-Control "public, max-age=31536000, immutable";
}

set -euo pipefail
# A sample config kept as text. Nothing here starts nginx.
cat > site.conf <<'EOF'
server {
    listen 80;
    server_name shop.example.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name shop.example.com www.shop.example.com;
    location /api/ { proxy_pass http://bookstall_app; }
    location /img/ { root /var/www/bookstall; }
}
server {
    listen 8080;
    server_name admin.example.com;
    location / { proxy_pass http://127.0.0.1:9000/; }
}
EOF
# One summary line per server block. Assumes "server {" and its "}" start a line.
awk '
  /^server \{/ { n++; listen = name = pass = "" }
  $1 == "listen"      { listen = listen " " $2 }
  $1 == "server_name" { for (i = 2; i <= NF; i++) name = name " " $i }
  /proxy_pass/        { for (i = 1; i <= NF; i++) if ($i == "proxy_pass") pass = pass " " $(i + 1) }
  /^\}/ {
    gsub(/;/, "", listen); gsub(/;/, "", name); gsub(/;/, "", pass)
    if (pass == "") pass = " (none)"
    printf "block %d\n  listen     :%s\n  server_name:%s\n  proxy_pass :%s\n", n, listen, name, pass
    if (pass != " (none)" && listen !~ /443/) print "  REVIEW: proxies traffic without TLS"
  }' site.conf

sudo useradd --system --shell /usr/sbin/nologin --home-dir /opt/bookstall bookstall
sudo mkdir -p /opt/bookstall /etc/bookstall /var/www/bookstall/static
# copy the release into /opt/bookstall; it stays owned by root and only readable by the app
sudo install -m 640 -o root -g bookstall /dev/null /etc/bookstall/env
sudoedit /etc/bookstall/env     # PORT=3000, HOST=127.0.0.1, secrets; never in git

# /etc/systemd/system/bookstall.service
[Unit]
Description=Bookstall web app
After=network-online.target
Wants=network-online.target

[Service]
User=bookstall
WorkingDirectory=/opt/bookstall
EnvironmentFile=/etc/bookstall/env
ExecStart=/usr/bin/node /opt/bookstall/server.js
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now bookstall
systemctl status bookstall --no-pager
curl -i http://127.0.0.1:3000/healthz     # test the app before putting Nginx in front

server {
    listen 80;
    server_name shop.example.com;
    root /var/www/bookstall;
    client_max_body_size 5m;

    location ^~ /static/ {
        expires 30d;
    }
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 3s;
        proxy_read_timeout    30s;
    }
}

sudo ln -s /etc/nginx/sites-available/bookstall /etc/nginx/sites-enabled/bookstall
sudo rm /etc/nginx/sites-enabled/default    # only the symlink; the sample stays available
sudo nginx -t && sudo systemctl reload nginx

sudo ufw allow OpenSSH        # FIRST, or you can lock yourself out
sudo ufw allow "Nginx Full"   # opens 80 and 443
sudo ufw enable
sudo ufw status

sudo certbot --nginx -d shop.example.com     # gets the cert and edits the Nginx site
sudo certbot renew --dry-run                 # rehearses renewal against the staging CA
systemctl list-timers | grep -i certbot      # package and snap installs name it differently

$ curl -i https://shop.example.com/healthz

# নমুনা আউটপুট, version-ভেদে আলাদা হতে পারে
HTTP/1.1 200 OK
Server: nginx
Content-Type: text/plain

ok

set -euo pipefail
cat > access.log <<'EOF'
203.0.113.7 - - [30/Oct/2026:10:00:01 +0600] "GET / HTTP/1.1" 200 5120 "-" "curl/8"
203.0.113.7 - - [30/Oct/2026:10:00:01 +0600] "GET /static/app.css HTTP/1.1" 200 2048 "-" "curl/8"
198.51.100.4 - - [30/Oct/2026:10:00:02 +0600] "GET /api/books HTTP/1.1" 200 812 "-" "curl/8"
198.51.100.4 - - [30/Oct/2026:10:00:03 +0600] "GET /old-page HTTP/1.1" 301 169 "-" "curl/8"
198.51.100.9 - - [30/Oct/2026:10:00:04 +0600] "GET /api/books HTTP/1.1" 200 812 "-" "curl/8"
198.51.100.9 - - [30/Oct/2026:10:00:05 +0600] "GET /favicon.png HTTP/1.1" 404 153 "-" "curl/8"
203.0.113.8 - - [30/Oct/2026:10:00:06 +0600] "POST /api/orders HTTP/1.1" 201 96 "-" "curl/8"
203.0.113.8 - - [30/Oct/2026:10:00:07 +0600] "GET /api/orders/7 HTTP/1.1" 200 240 "-" "curl/8"
203.0.113.9 - - [30/Oct/2026:10:00:08 +0600] "GET /api/report HTTP/1.1" 504 167 "-" "curl/8"
203.0.113.9 - - [30/Oct/2026:10:00:09 +0600] "GET /api/books HTTP/1.1" 502 157 "-" "curl/8"
203.0.113.9 - - [30/Oct/2026:10:00:10 +0600] "GET /api/report HTTP/1.1" 504 167 "-" "curl/8"
198.51.100.2 - - [30/Oct/2026:10:00:11 +0600] "GET / HTTP/1.1" 200 5120 "-" "curl/8"
198.51.100.2 - - [30/Oct/2026:10:00:12 +0600] "GET /static/app.css HTTP/1.1" 304 0 "-" "curl/8"
198.51.100.6 - - [30/Oct/2026:10:00:13 +0600] "GET /api/books HTTP/1.1" 200 812 "-" "curl/8"
198.51.100.6 - - [30/Oct/2026:10:00:14 +0600] "GET /api/report HTTP/1.1" 200 3300 "-" "curl/8"
203.0.113.7 - - [30/Oct/2026:10:00:15 +0600] "GET /api/books HTTP/1.1" 200 812 "-" "curl/8"
EOF
# In the combined log format, field 9 is the status code and field 7 the path.
echo "== status codes"
awk '{ c[$9]++ } END { for (s in c) printf "%s %d %.2f%%\n", s, c[s], c[s] * 100 / NR }' access.log | sort
echo "== by class"
awk '{ c[substr($9, 1, 1) "xx"]++ } END { for (k in c) printf "%s %d\n", k, c[k] }' access.log | sort
echo "== 5xx rate"
awk '$9 >= 500 { e++ } END { printf "%d of %d = %.2f%%\n", e, NR, e * 100 / NR }' access.log
echo "== paths behind the 5xx"
awk '$9 >= 500 { print $9, $7 }' access.log | sort | uniq -c | sort -rn