HowTo: server web Debian + Nginx de la zero

Un server web Debian + Nginx, de la sistem proaspat pana la HTTPS, cu toate comenzile gata de copiat. Testat pe Debian 12/13.

1. Actualizeaza sistemul

sudo apt update && sudo apt -y full-upgrade
sudo apt -y install curl gnupg ca-certificates

2. Instaleaza Nginx

sudo apt -y install nginx
sudo systemctl enable --now nginx
systemctl status nginx --no-pager

3. Firewall (UFW)

sudo apt -y install ufw
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'   # 80 + 443
sudo ufw --force enable

4. Document root si permisiuni

sudo mkdir -p /var/www/example.com/public
sudo chown -R www-data:www-data /var/www/example.com
echo '<h1>OK example.com</h1>' | sudo tee /var/www/example.com/public/index.html

5. Server block (site)

sudo tee /etc/nginx/sites-available/example.com >/dev/null <<'EOF'
server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/public;
    index index.html;
    location / { try_files $uri $uri/ =404; }
}
EOF

6. Activeaza site-ul si testeaza

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

7. TLS cu Let's Encrypt

sudo apt -y install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com --agree-tos -m admin@example.com --redirect
sudo certbot renew --dry-run

8. Verificare

curl -I http://example.com
curl -I https://example.com
sudo nginx -T | grep server_name

Securizare rapida (headere + gzip)

Doua imbunatatiri pe care le adaugi imediat: compresie gzip (pagini mai mici) si headere de securitate (protectie clickjacking/sniffing + HTTPS fortat).

# gzip (in http {} din /etc/nginx/nginx.conf)
gzip on;
gzip_types text/plain text/css application/javascript application/json image/svg+xml;

# headere de securitate (in server {})
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

nginx -t && systemctl reload nginx

Concluzie

Ai un server web functional cu HTTPS si reinnoire automata. Il securizam si monitorizam pentru tine.