{"result":{"depiction_url":null,"edges":{},"id":1790,"is_a":["text","documentation","developerguide"],"links":[{"rel":"self","target":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/1790"},{"rel":"hub","target":"https:\/\/zotonic.com\/.zotonic\/websub"}],"medium":null,"medium_url":null,"name":"doc_developerguide_deployment_nginx","page_url":{"en":"https:\/\/zotonic.com\/docs\/1790\/proxying-zotonic-with-nginx","x-default":"https:\/\/zotonic.com\/docs\/1790\/proxying-zotonic-with-nginx"},"preview_url":null,"resource":{"body":"
\n \n
\n\n

It is possible to put Zotonic behind the nginx <http:\/\/nginx.org\/><\/cite>\nweb server, for example if you have other, non-Zotonic virtual hosts\nrunning on your system.<\/p>\n

When proxying, don’t forget to check the config files of the sites you\nare planning to server (the apps_user\/yoursite\/priv\/zotonic_site.config<\/span><\/code>\nfiles). The hostname<\/span><\/code> value should not contain any port number, if\nyou run from port 80\/443: {hostname,<\/span> "test.zotonic.com"}<\/span><\/code>.<\/p>\n

\n

Zotonic configuration<\/h2>\n

Example of zotonic.config<\/span><\/code> (find the location using bin\/zotonic<\/span> configfiles<\/span><\/code>) ip\/port\nsettings when terminating SSL in nginx proxy and using plain HTTP towards the Zotonic\nbackend:<\/p>\n

<\/span>%%% IP address on which Zotonic will listen for HTTP requests.<\/span>\n{<\/span>listen_ip<\/span>,<\/span> any<\/span>},<\/span>\n\n%%% Port on which Zotonic will listen for HTTP requests.<\/span>\n{<\/span>listen_port<\/span>,<\/span> 8000<\/span>},<\/span>\n\n%%% Port on which Zotonic will listen for HTTPS requests.<\/span>\n%%% Set to the atom 'none' to disable SSL<\/span>\n{<\/span>ssl_listen_port<\/span>,<\/span> none<\/span>},<\/span>\n\n%%% Outside port on which Zotonic will listen for HTTP requests.<\/span>\n{<\/span>port<\/span>,<\/span> 80<\/span>},<\/span>\n\n%%% Outside port zotonic uses to receive incoming HTTPS requests.<\/span>\n{<\/span>ssl_port<\/span>,<\/span> 443<\/span>},<\/span>\n<\/pre><\/div>\n<\/div>\n<\/div>\n
\n
Nginx configuration<\/h2>\n
Below is an example configuration file to proxy nginx to zotonic. Be\nsure to replace all occurrences of test.zotonic.com<\/span><\/code> with your own\nhostname:<\/p>\n
<\/span>server<\/span> {<\/span>\n      listen<\/span> 80<\/span>;<\/span>\n      listen<\/span>   [::]:80<\/span> default_server<\/span> ipv6only=on<\/span>;<\/span> ## listen for ipv6<\/span>\n\n      listen<\/span> 443<\/span> ssl<\/span> http2<\/span>;<\/span>\n      listen<\/span> [::]:443<\/span> ssl<\/span> http2<\/span> ipv6only=on<\/span>;<\/span>\n\n      server_name<\/span>  test.zotonic.com<\/span>;<\/span>\n\n      access_log<\/span>  \/var\/log\/nginx\/test.zotonic.com.access.log<\/span>;<\/span>\n      error_log<\/span>  \/var\/log\/nginx\/test.zotonic.com.error.log<\/span>;<\/span>\n\n      keepalive_timeout<\/span> 65<\/span>;<\/span>\n      gzip<\/span> off<\/span>;<\/span>\n\n      ssl_protocols<\/span> TLSv1.2<\/span> TLSv1.3<\/span>;<\/span>\n      ssl_ciphers<\/span> "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES128-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA128:DHE-RSA-AES128-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA128:ECDHE-RSA-AES128-SHA384:ECDHE-RSA-AES128-SHA128:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA384:AES128-GCM-SHA128:AES128-SHA128:AES128-SHA128:AES128-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"<\/span>;<\/span>\n      ssl_prefer_server_ciphers<\/span> on<\/span>;<\/span>\n\n      # Disable preloading HSTS for now. Enable when you know that your<\/span>\n      # server certs works. You can use the header line that includes<\/span>\n      # the "preload" directive if you understand the implications.<\/span>\n      # add_header Strict-Transport-Security "max-age=15768000; includeSubdomains"; # six months<\/span>\n      # add_header Strict-Transport-Security "max-age=15768000; includeSubdomains; preload";<\/span>\n\n      ssl_session_cache<\/span> shared:SSL:10m<\/span>;<\/span>\n      ssl_session_timeout<\/span> 5m<\/span>;<\/span>\n\n      # create with: openssl dhparam -out \/etc\/nginx\/dhparam.pem 2048<\/span>\n      # ssl_dhparam \/etc\/nginx\/dhparam.pem;<\/span>\n\n      ssl_certificate<\/span> \/path\/to\/ssl.crt<\/span>;<\/span>\n      ssl_certificate_key<\/span> \/path\/to\/ssl.key<\/span>;<\/span>\n\n      location<\/span> \/<\/span> {<\/span>\n          proxy_pass<\/span> http:\/\/127.0.0.1:8000\/<\/span>;<\/span>\n          proxy_redirect<\/span> off<\/span>;<\/span>\n\n          proxy_set_header<\/span>  Host<\/span>              $http_host<\/span>;<\/span>\n          proxy_set_header<\/span>  X-Real-IP<\/span>         $remote_addr<\/span>;<\/span>\n          proxy_set_header<\/span>  X-Forwarded-For<\/span>   $proxy_add_x_forwarded_for<\/span>;<\/span>\n          proxy_set_header<\/span>  X-Forwarded-Proto<\/span> $scheme<\/span>;<\/span>\n          proxy_pass_request_headers<\/span> on<\/span>;<\/span>\n\n          client_max_body_size<\/span>       0<\/span>;<\/span>\n          client_body_buffer_size<\/span>    128k<\/span>;<\/span>\n\n          proxy_connect_timeout<\/span>      90<\/span>;<\/span>\n          proxy_send_timeout<\/span>         90<\/span>;<\/span>\n          proxy_read_timeout<\/span>         90<\/span>;<\/span>\n\n          proxy_buffer_size<\/span>          4k<\/span>;<\/span>\n          proxy_buffers<\/span>              4<\/span> 32k<\/span>;<\/span>\n          proxy_busy_buffers_size<\/span>    64k<\/span>;<\/span>\n          proxy_temp_file_write_size<\/span> 64k<\/span>;<\/span>\n      }<\/span>\n\n      location<\/span> \/mqtt-transport<\/span> {<\/span>\n          proxy_pass<\/span> http:\/\/127.0.0.1:8000\/mqtt-transport<\/span>;<\/span>\n\n          proxy_http_version<\/span> 1<\/span>.1<\/span>;<\/span>\n\n          proxy_set_header<\/span> Host<\/span>              $host<\/span>;<\/span>\n          proxy_set_header<\/span> X-Real-IP<\/span>         $remote_addr<\/span>;<\/span>\n          proxy_set_header<\/span> X-Forwarded-For<\/span>   $proxy_add_x_forwarded_for<\/span>;<\/span>\n          proxy_set_header<\/span> X-Forwarded-Proto<\/span> $scheme<\/span>;<\/span>\n          proxy_set_header<\/span> Upgrade<\/span>           $http_upgrade<\/span>;<\/span>\n          proxy_set_header<\/span> Connection<\/span>        "upgrade"<\/span>;<\/span>\n\n          proxy_pass_request_headers<\/span> on<\/span>;<\/span>\n      }<\/span>\n\n      location<\/span> \/close-connection<\/span> {<\/span>\n           keepalive_timeout<\/span> 0<\/span>;<\/span>\n           empty_gif<\/span>;<\/span>\n      }<\/span>\n}<\/span>\n<\/pre><\/div>\n<\/div>\n
As shown in the example above:<\/p>\n