Nginx asoslari — statik sayt, reverse proxy, HTTPS

~20 daq · Linux · Server

Muammodan boshlaylik

Server tayyor (42-dars). Ilovangiz systemd orqali 127.0.0.1:3000 da ishlayapti (25-dars). Endi foydalanuvchilar uni https://dokon.uz orqali ochishi kerak:

• 80 va 443 portlarda kimdir tinglashi kerak
• HTTPS sertifikati kerak
• Frontend fayllari (HTML, CSS, rasmlar) tez berilishi kerak
• Ilova to'g'ridan-to'g'ri internetga ochilmasligi kerak

Bularning hammasini Nginx qiladi — dunyodagi eng mashhur veb-serverlardan biri.

O'rnatish

sudo apt install -y nginx
sudo systemctl enable --now nginx
sudo ufw allow 'Nginx Full'

Brauzerda http://45.12.34.56 — "Welcome to nginx!" sahifasi.

Fayllar tuzilishi

/etc/nginx/
├── nginx.conf                  ← asosiy sozlama (kamdan-kam tegiladi)
├── sites-available/            ← barcha sayt sozlamalari
│   └── default
├── sites-enabled/              ← yoqilganlari (havolalar, 10-dars)
│   └── default -> ../sites-available/default
└── snippets/                   ← qayta ishlatiladigan bo'laklar

/var/log/nginx/
├── access.log                  ← barcha so'rovlar (17-dars)
└── error.log                   ← xatolar — muammoda BIRINCHI qarash joyi

/var/www/html/                  ← standart sayt fayllari

Asosiy buyruqlar

sudo nginx -t                    # sozlamani TEKSHIRISH — har o'zgarishdan keyin!
sudo systemctl reload nginx      # to'xtamasdan qayta yuklash
sudo systemctl restart nginx     # to'liq qayta ishga tushirish
sudo tail -f /var/log/nginx/error.log

[!WARNING] Har doim sudo nginx -t → keyin reload. Sintaksis xatosi bilan restart qilsangiz — Nginx ishga tushmaydi va barcha saytlar to'xtaydi. reload esa xatoli sozlamani qabul qilmaydi va eskisi bilan ishlashda davom etadi.

1. Statik sayt

sudo mkdir -p /var/www/dokon
echo "<h1>Dokon ishlayapti!</h1>" | sudo tee /var/www/dokon/index.html
sudo chown -R otabek:www-data /var/www/dokon

Sozlama:

sudo nano /etc/nginx/sites-available/dokon

server {
    listen 80;
    server_name dokon.uz www.dokon.uz;

    root /var/www/dokon;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Yoqish:

sudo ln -s /etc/nginx/sites-available/dokon /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default       # standart saytni o'chirish
sudo nginx -t && sudo systemctl reload nginx

• server_name — qaysi domen uchun (bitta serverda ko'p sayt bo'lishi mumkin)
• root — fayllar qayerda
• location / — qaysi yo'llar uchun qoida
• try_files $uri $uri/ =404 — fayl bormi? papka bormi? bo'lmasa — 404

SPA uchun (React, Vue)

location / {
    try_files $uri $uri/ /index.html;
}

Mavjud bo'lmagan har qanday yo'l — index.html ga (frontend router o'zi hal qiladi).

2. Reverse proxy — ilovaga yo'naltirish

Nginx so'rovlarni qabul qilib, ichkaridagi ilovaga uzatadi:

Brauzer ──HTTPS──→ Nginx (:443) ──HTTP──→ Node.js (127.0.0.1:3000)

server {
    listen 80;
    server_name dokon.uz;

    # Frontend — statik fayllar
    root /var/www/dokon/public;

    location / {
        try_files $uri $uri/ /index.html;
    }

    # API — Node.js ga
    location /api/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    client_max_body_size 20M;
}

• proxy_pass — so'rovni qayerga uzatish
• proxy_set_header — ilova foydalanuvchining haqiqiy IP si va protokolini bilishi uchun (aks holda hamma so'rov 127.0.0.1 dan kelgandek ko'rinadi). Express da: app.set('trust proxy', 1)
• client_max_body_size — yuklanadigan fayl hajmi chegarasi (standart — atigi 1 MB)

Ilova esa faqat 127.0.0.1 ni tinglaydi — internetdan to'g'ridan-to'g'ri yetib bo'lmaydi (32-dars).

WebSocket

location /ws/ {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

3. HTTPS — Let's Encrypt

Bepul sertifikat, avtomatik yangilanadi. Shart: domenning A yozuvi server IP siga ko'rsatgan bo'lishi kerak (32-dars: dig dokon.uz +short).

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d dokon.uz -d www.dokon.uz

certbot:

1. Domen sizniki ekanini tekshiradi
2. Sertifikat oladi
3. Nginx sozlamasiga listen 443 ssl va sertifikat yo'llarini o'zi qo'shadi
4. HTTP → HTTPS yo'naltirishni sozlaydi

Brauzerda https://dokon.uz — yashil qulf.

Sertifikat 90 kun amal qiladi, yangilanish — avtomatik (systemd timer, 40-dars):

systemctl list-timers | grep certbot
sudo certbot renew --dry-run       # yangilanishni sinash

4. Foydali sozlamalar

Gzip va keshlash

gzip on;
gzip_types text/css application/javascript application/json image/svg+xml;

location ~* \.(css|js|png|jpg|jpeg|webp|svg|woff2)$ {
    expires 30d;
    add_header Cache-Control "public";
}

Xavfsizlik sarlavhalari

add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options SAMEORIGIN always;
add_header Referrer-Policy strict-origin-when-cross-origin always;

server_tokens off;                  # Nginx versiyasini yashirish

location ~ /\.(?!well-known) {      # .env, .git kabi yashirin fayllar
    deny all;
}

www → asosiy domen

server {
    listen 80;
    server_name www.dokon.uz;
    return 301 https://dokon.uz$request_uri;
}

Xatolarni tuzatish

Har qanday muammoda birinchi buyruq:

sudo tail -50 /var/log/nginx/error.log

connect() failed (111: Connection refused) while connecting to upstream,
upstream: "http://127.0.0.1:3000/api/mahsulotlar"

— ilova 3000-portda ishlamayapti. Muammo Nginx da emas.

sudo nginx -T — barcha sozlamalarni (barcha fayllarni birlashtirib) ko'rsatadi.

Nima uchun shunday?

Nima uchun ilova o'zi 80/443 portlarda ishlamaydi — o'rtada Nginx nima uchun kerak?

Har biri o'z ishini yaxshi qiladi. Nginx — minglab bir vaqtdagi ulanishlarni bir necha megabayt xotira bilan ushlab turish, statik fayllarni yadro darajasida (sendfile) berish, gzip, TLS shifrlash va sekin mijozlarni "buferlash" uchun optimallashtirilgan. Ilovangiz esa biznes mantiq uchun. Bundan tashqari: 80/443 portlar uchun root kerak — ilova root siz ishlashi kerak (18-dars); HTTPS sertifikati bir joyda boshqariladi; bitta serverda bir nechta sayt va ilova bo'lishi mumkin; ilovani qayta ishga tushirayotganda Nginx foydalanuvchilarga chiroyli xato sahifasini ko'rsata oladi. Bu arxitektura Docker da ham xuddi shunday saqlanadi.

Xulosa

Eslab qoling:

• Sozlamalar: sites-available/ → ln -s → sites-enabled/
• sudo nginx -t → reload — har doim shu tartibda
• server_name, root, location, try_files; SPA — /index.html
• Reverse proxy: proxy_pass http://127.0.0.1:3000 + X-Forwarded-* sarlavhalari
• client_max_body_size — fayl yuklash chegarasi
• HTTPS: certbot --nginx -d domen — avtomatik sozlash va yangilash
• 502 — ilova ishlamayapti; 403 — ruxsatlar; birinchi qarash — error.log

Keyingi dars

44-dars: Yakuniy loyiha — ilovani noldan serverga chiqarish