Modifica di Macchine Linux Mr.Digital (sezione)

=== NGINX ===
==== Configurazione Virtual Host ====

<syntaxhighlight lang="bash">
upstream www.designbest.com {
	server 192.168.250.10:443;
}
upstream designbest.com {
	server 192.168.250.10:80;
}
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;

##
# DESIGNBEST.COM 
#

# Porta 80, forwardo e lascio gestire redirect da IIS
server {
	listen 80;

	server_name designbest.com www.designbest.com;

	#access_log /var/log/nginx/dbdemo47.com/access.log;
	error_log /var/log/nginx/designbest.com/error.log;

	location ~ ^/(it|fr|de|en) {
		limit_req zone=mylimit burst=20 nodelay;
		proxy_pass http://designbest.com;
		include /etc/nginx/proxy_params;
		limit_req_status 429;
	}

	location / {
		proxy_pass http://designbest.com;
		include /etc/nginx/proxy_params;
	}
}

# Porta 443
server {
	if ($host = designbest.com) {
		return 301 https://www.$host$request_uri;
	}

    listen 443 ssl http2;
    listen [::]:443 ssl http2;

	index index.html index.htm index.nginx-debian.html;
	server_name designbest.com www.designbest.com;

	# upload che di default è 1M
	client_max_body_size 100M;

	ssl_certificate /etc/nginx/ssl/designbest.com_ssl_certificate_bundle.crt;
	ssl_certificate_key /etc/nginx/ssl/designbest.com_private_key.key;

	error_log /var/log/nginx/designbest.com/error.log;
	#access_log /var/log/nginx/designbest.com/access.log;

	location ~ ^/(it|fr|de|en) {
		limit_req zone=mylimit burst=20 nodelay;
		proxy_ssl_server_name on;
		proxy_pass https://www.designbest.com;
		include /etc/nginx/proxy_params;
		limit_req_status 429;
	}

	location / {
		proxy_ssl_server_name on;
		proxy_pass https://www.designbest.com;
		include /etc/nginx/proxy_params;
	}
}


##
# IMMAGINI.DESIGNBEST.COM
#
server {
	# SSL configuration
	#
	listen 443 ssl;
	listen [::]:443 ssl;

	#root /var/www/html;

	index index.html index.htm index.nginx-debian.html;

	server_name immagini.designbest.com;

	ssl_certificate /etc/nginx/ssl/designbest.com_ssl_certificate_bundle.crt;
	ssl_certificate_key /etc/nginx/ssl/designbest.com_private_key.key;

	error_log /var/log/nginx/immagini.designbest.com/error.log;
	#access_log /media/discodati/logs/immagini.designbest.com/access.log;

	location ~ ^/(it|fr|de|en) {
		limit_req zone=mylimit burst=20 nodelay;
		proxy_ssl_server_name on;
		proxy_pass https://www.designbest.com;
		include /etc/nginx/proxy_params;
		limit_req_status 429;
	}

	location / {
		proxy_ssl_server_name on;
		proxy_pass https://www.designbest.com;
		include /etc/nginx/proxy_params;
	}
}

</syntaxhighlight>

Questa guida mostra come NGINX può integrare il controllo del flusso.<br/>

* https://www.nginx.com/blog/rate-limiting-nginx/
* https://www.youtube.com/watch?v=V9XGT7hvwWo
* https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/<br/>

===== Testing con Apache Bench =====
Suppose we want to see how fast Yahoo can handle 100 requests, with a maximum of 10 requests running concurrently:
<syntaxhighlight lang="bash">
ab -n 100 -c 10 -l http://www.yahoo.com/
</syntaxhighlight>
Nota bene: Se non si mette l'ultimo slash (/) il comando non funziona.
https://www.petefreitag.com/item/689.cfm

==== Protocollo http2 ====
Il nuovo <code>nginx</code> supporta nativamente il protocollo <code>http2</code>.<br/>
Basta aggiungere <code>http2</code> dietro all'istruzione <code>listen 443 ssl</code>
<syntaxhighlight lang="bash">
listen 443 ssl http2;
</syntaxhighlight>

==== Compressione Brotli ====
La nuova compressione che va a sostituire la classica <code>gzip</code> <br/>
è stata approfondita nell'apposito paragrafo [[Nginx modulo Brotli (text compression)]]