Configuring the NGINX Server - HTTPS Virtual Hosts / Load Balancing / IP Access Restrictions

45 minutes
  • 7 Learning Objectives

About this Hands-on Lab

Before we can start building our world-changing website or application on LEMP, we have to lay the foundation – the stack. In this hands-on lab, we will walk through configuring NGINX on Ubuntu Linux. We will explore configuring HTTPS (secure) virtual hosts, load balancing, and IP access restrictions.

Completing this lab will provide a good understanding of how to implement these concepts in NGINX on Ubuntu Linux.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Verify the Self-Signed Certificate for the NGINX Server

First, we’ll need to become the root user:

sudo su -

Let’s verify that the X509 certificate was correctly generated using the openssl verify command:

openssl verify -CAfile /etc/nginx/ssl/bigstatecollege.edu/ca-cert.pem /etc/nginx/ssl/bigstatecollege.edu/server-cert.pem

We should see the following:
server-cert.pem: OK

Configure the Virtual Host to Use HTTPS

Configure the bigstatecollege.edu virtual host to use HTTPS:

cd /etc/nginx/sites-available
vi bigstatecollege.edu.conf

Change the listen line from port 80 to 443, and add ssl after 443:

listen 443 ssl;

Add the following lines after the server_name configuration line:

        ssl_certificate /etc/nginx/ssl/bigstatecollege.edu/server-cert.pem;
        ssl_certificate_key /etc/nginx/ssl/bigstatecollege.edu/server-key.pem;

Save and exit.

Validate HTTPS

Validate and reload NGINX:

nginx -t
systemctl reload nginx

Test the new HTTPS connection. We will need to use the --insecure switch in order to accept the self-signed certificate:

curl --insecure https://www.bigstatecollege.edu

We should see Welcome to www.bigstatecollege.edu!.

Congratulations! The virtual host for bigstatecollege.edu is now configured to use HTTPS.

Configure Load Balancing on the Virtual Host

There’s already an upstream group configured in the bigstatecollege.edu virtual host. Remove the backup status from app2 and app3. This will make them live. Edit the bigstatecollege.edu.conf file:

vi bigstatecollege.edu.conf

The end result should look like the following:

upstream bscapp  {
   server app1.bigstatecollege.edu:8085;
   server app2.bigstatecollege.edu:8086;
   server app3.bigstatecollege.edu:8087;
}

Save and exit.

Test Load Balancing on the Virtual Host

Validate and reload NGINX:

nginx -t
systemctl reload nginx

Test the new configuration for https://www.bigstatecollege.edu/app:

curl --insecure https://www.bigstatecollege.edu/app

Reload the command several times. We should see Welcome to app1.bigstatecollege.edu!.

Restrict Access By IP Address

We’re going to restrict the bigstatecollege.edu virtual host to the 127.0.0.1 interface. Add the following lines after the listen 443; line in the bigstatecollege.edu.conf file:

        allow 127.0.0.1;
        deny all;

Save and exit.

Test IP Address Restriction

Validate and reload NGINX:

nginx -t
systemctl reload nginx

Test the new configuration for https://www.bigstatecollege.edu:

curl --insecure https://www.bigstatecollege.edu

Access is forbidden via the private IP address. Try to access the virtual host via localhost:

curl --insecure -H "www.bigstatecollege.edu" https://localhost

We should see Welcome to www.bigstatecollege.edu!.

Additional Resources

Big State College (BSC) is a Large Ten Conference school in a Midwestern state. BSC is looking to deploy a centralized web hosting service using the LEMP stack.

As the engineers tasked with executing this project, we will be configuring HTTPS virtual hosts, load balancing, and IP address restrictions on an Ubuntu Linux server. Let's begin!

Connecting to the Lab Server

Use the credentials provided on the hands-on lab overview page, and log in using an SSH connection to the Public IP or DNS of the server as cloud_user.

Making a SSH connection using the ssh command. Replace <<public_IP_or_DNS>> with the Public IP or DNS provided on the overview page.

ssh cloud_user@<<public_IP_or_DNS>>

If you can't use ssh or prefer a GUI client, use the credentials provided on the hands-on lab overview page to configure your SSH connection to the lab server.

Lab Git Repository

Feel free to explore the configurations and code from the lab at: GitHub - linuxacademy/content-lemp-deep-dive

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Get Started
Who’s going to be learning?

How many seats do you need?

  • $499 USD per seat per year
  • Billed Annually
  • Renews in 12 months

Ready to accelerate learning?

For over 25 licenses, a member of our sales team will walk you through a custom tailored solution for your business.


$2,495.00

Checkout
Sign In
Welcome Back!

Psst…this one if you’ve been moved to ACG!