Omar Khalil DonSYS91

Docker Installation: NGINX Secure Conf with full SSL Labs A+ and Reverse Proxy

This guide shows how to install and configure NGINX Docker with reverse proxy configurations and full grade A+ SSL Labs while also obtaining a LetsEncrypt cert via acme.sh client and CloudFlare DNS API.

To learn how to obtain CloudFlare DNS token check here or check acme.sh docs if you want to use a different method but you need to edit the script on your own.

# Variables {edit here}
export DOMAIN=
export ACME_EMAIL=

Moved to git repository: https://github.com/denji/nginx-tuning

NGINX Tuning For Best Performance

For this configuration you can use web server you like, i decided, because i work mostly with it to use nginx.

Generally, properly configured nginx can handle up to 400K to 500K requests per second (clustered), most what i saw is 50K to 80K (non-clustered) requests per second and 30% CPU load, course, this was 2 x Intel Xeon with HyperThreading enabled, but it can work without problem on slower machines.

You must understand that this config is used in testing environment and not in production so you will need to find a way to implement most of those features best possible for your servers.

Configuring IPv6 block from Online.net On Proxmox Host and Guests

Following the documentation on online.net would get IPv6 to work only in a simple system installation but won't get IPv6 to work with virtualization environment (Exp. Proxmox) as It's missing some IPv6 forwards and proxies on sysctl.conf.

On Proxmox Host (Or Debian if single Debian Installation)

Enable IPv6 on the System:

Change Module Options to Enable IPv6:

Nginx Cheat Sheet

(from Understanding Nginx Server and Location Block Selection Algorithms - https://goo.gl/YyzshP)

server {

	#!/bin/bash

	# Check if PHP version is passed as an argument
	if [ -z "$1" ]; then
	echo "Please pass PHP version as an argument."
	echo "Usage: ./script_name.sh php_version"
	exit 1
	fi

	# PHP version from the command line argument

	#odoo server
	upstream odoo {
	server 127.0.0.1:8069;
	}
	upstream odoochat {
	server 127.0.0.1:8072;
	}
	map $http_upgrade $connection_upgrade {
	default upgrade;
	'' close;

	FROM php:7.4-apache

	WORKDIR /var/www/html

	ARG DEBIAN_FRONTEND=noninteractive

	RUN apt-get update && apt-get install -y \
	libfreetype6-dev \
	libjpeg62-turbo-dev \
	libpng-dev \

	# route balancing only in commercial edition...
	#map $cookie_JESSIONID $route_cookie1 {
	# ~.+\.(?P<route>\w+)$ $route;
	#}
	#map $cookie_jsessionid $route_cookie2 {
	# ~.+\.(?P<route>\w+)$ $route;
	#}
	#map $request_uri $route_uri1 {
	# ~JSESSIONID=.+\.(?P<route>\w+)$ $route;
	#}