Nginx — reverse proxy, SSL

~20 daq · NestJS · Deployment

Muammodan boshlaylik

Serverda NestJS app port 3000 da ishlaydi. Lekin foydalanuvchilar http://yoursite.com:3000 emas, https://yoursite.com ga kirishi kerak:

• Port ko'rsatmaslik (80 va 443 standart portlar)
• HTTPS — SSL sertifikat
• Bir serverda bir necha ilova (api.yoursite.com, admin.yoursite.com)

Nginx shu vazifalarni bajaradi.

Nginx nima?

Nginx — reverse proxy va web server.

Hayotiy o'xshatma: bino qorovuli va yo'naltiruvchi.

Mehmon binoga kiradi. Qorovul kim ekanini tekshiradi, qaysi xonaga borishi kerakligini aytadi. Mehmon to'g'ridan to'g'ri xonani izlamaydi.

Internet → Nginx (port 80/443) → NestJS (port 3000)
                              → Frontend (port 4200)
                              → Admin (port 4000)

Nginx tashqaridan kelgan so'rovni ichki servislarga yo'naltiradi.

O'rnatish (Ubuntu)

sudo apt update
sudo apt install nginx
sudo systemctl start nginx
sudo systemctl enable nginx  # server yonganida avtomatik ishga tushsin

Asosiy konfiguratsiya

# /etc/nginx/sites-available/myapp

server {
    listen 80;
    server_name yoursite.com www.yoursite.com;

    location / {
        proxy_pass http://localhost:3000;      # ← NestJS ga yo'naltirish
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_cache_bypass $http_upgrade;
    }
}

# Konfiguratsiyani yoqish
sudo ln -s /etc/nginx/sites-available/myapp /etc/nginx/sites-enabled/

# Konfiguratsiyani tekshirish
sudo nginx -t

# Qayta ishga tushirish
sudo systemctl reload nginx

SSL — HTTPS (Let's Encrypt, bepul)

sudo apt install certbot python3-certbot-nginx

# Sertifikat olish va nginx ni avtomatik sozlash
sudo certbot --nginx -d yoursite.com -d www.yoursite.com

Certbot Nginx konfiguratsiyasini avtomatik yangilaydi:

server {
    listen 443 ssl;
    server_name yoursite.com;

    ssl_certificate /etc/letsencrypt/live/yoursite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yoursite.com/privkey.pem;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# HTTP → HTTPS yo'naltirish
server {
    listen 80;
    server_name yoursite.com;
    return 301 https://$host$request_uri;
}

Sertifikat 90 kun amal qiladi. Certbot avtomatik yangilaydi:

# Avtomatik yangilashni tekshirish
sudo certbot renew --dry-run

Subdomain bilan bir necha ilova

# API
server {
    listen 443 ssl;
    server_name api.yoursite.com;

    location / {
        proxy_pass http://localhost:3000;
    }
}

# Admin
server {
    listen 443 ssl;
    server_name admin.yoursite.com;

    location / {
        proxy_pass http://localhost:4000;
    }
}

WebSocket sozlash

location /socket.io/ {
    proxy_pass http://localhost:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;      # ← WebSocket uchun
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
}

Fayl yuklash hajmini oshirish

server {
    client_max_body_size 50M;  # ← default 1MB, 50MB ga oshiramiz

    location / {
        proxy_pass http://localhost:3000;
    }
}

Tez-tez uchraydigan xatolar

1. 502 Bad Gateway

502 Bad Gateway

Sababi: Nginx ishlayapti, lekin NestJS app ishlamayapti. Yechim: pm2 status yoki docker ps bilan appni tekshiring.

2. Konfiguratsiya xatosi

nginx: [emerg] unknown directive

Yechim: sudo nginx -t bilan tekshiring, xato satrini ko'ring.

3. SSL sertifikat eskirgan

NET::ERR_CERT_DATE_INVALID

Yechim: sudo certbot renew bilan yangilang. Agar cron bilan sozlangan bo'lsa — avtomatik yangilanishi kerak edi.

Xulosa

Eslab qoling:

• Nginx — tashqaridan kelgan so'rovni ichki servislarga yo'naltiradi
• proxy_pass — asosiy direktiva
• Let's Encrypt — bepul SSL sertifikat
• sudo nginx -t — konfiguratsiyani saqlamadan tekshirish
• WebSocket uchun Upgrade header kerak

Keyingi dars: 59-dars: CI/CD — GitHub Actions bilan avtomatik deploy