From e4ba34815302fc690d2102eccacc5dbde0e7369c Mon Sep 17 00:00:00 2001 From: Timur Date: Tue, 7 Jul 2026 00:00:36 +0300 Subject: [PATCH] docs: update Nginx guides --- docs/install/remnawave-node.md | 2 +- docs/install/reverse-proxies/nginx.md | 104 ++++++++++++-------------- 2 files changed, 50 insertions(+), 56 deletions(-) diff --git a/docs/install/remnawave-node.md b/docs/install/remnawave-node.md index bec3f2a..bf627d5 100644 --- a/docs/install/remnawave-node.md +++ b/docs/install/remnawave-node.md @@ -230,7 +230,7 @@ remnawave: // highlight-next-line-green volumes: // highlight-next-line-green - - '/opt/remnawave/nginx:/var/lib/remnawave/configs/xray/ssl' + - /opt/remnawave/nginx/ssl/:/var/lib/remnawave/configs/xray/ssl/:ro depends_on: remnawave-db: condition: service_healthy diff --git a/docs/install/reverse-proxies/nginx.md b/docs/install/reverse-proxies/nginx.md index e379893..28af106 100644 --- a/docs/install/reverse-proxies/nginx.md +++ b/docs/install/reverse-proxies/nginx.md @@ -46,7 +46,7 @@ curl https://get.acme.sh | sh -s email=EMAIL && source ~/.bashrc ### Create a folder for the certificates ```bash -mkdir -p /opt/remnawave/nginx && cd /opt/remnawave/nginx +mkdir -p /opt/remnawave/nginx/ssl && cd /opt/remnawave/nginx/ssl ``` ### Issue a certificate @@ -58,7 +58,7 @@ Do not use domain zones: .ru, .su, .рф. Currently ZeroSSL does not support the ::: ```bash -acme.sh --issue --standalone -d 'DOMAIN' --key-file /opt/remnawave/nginx/privkey.key --fullchain-file /opt/remnawave/nginx/fullchain.pem --alpn --tlsport 8443 --reloadcmd "docker exec remnawave-nginx nginx -s reload" +acme.sh --issue --standalone -d 'DOMAIN' --key-file /opt/remnawave/nginx/ssl/privkey.key --fullchain-file /opt/remnawave/nginx/ssl/fullchain.pem --alpn --tlsport 8443 --reloadcmd "docker exec remnawave-nginx nginx -s reload" ``` :::info @@ -68,7 +68,7 @@ Make sure that port **8443** is open on your server. It is required for certific ![](/reverse-proxies/nginx/issue-cert.webp) ```bash -acme.sh --install-cert -d 'DOMAIN' --key-file /opt/remnawave/nginx/privkey.key --fullchain-file /opt/remnawave/nginx/fullchain.pem --reloadcmd "docker exec remnawave-nginx nginx -s reload" +acme.sh --install-cert -d 'DOMAIN' --key-file /opt/remnawave/nginx/ssl/privkey.key --fullchain-file /opt/remnawave/nginx/ssl/fullchain.pem --reloadcmd "docker exec remnawave-nginx nginx -s reload" ``` This shows that the certificate is issued. `Acme.sh` will take care of automatically renewing the certificate every 60 days, just make sure that you have a **8443** port open (and not busy) on your server. @@ -77,10 +77,10 @@ This shows that the certificate is issued. `Acme.sh` will take care of automatic ### Simple configuration -Create a file called `nginx.conf` in the `/opt/remnawave/nginx` directory. +Create a file called `remnawave.conf` in the `/opt/remnawave/nginx/conf.d` directory. ```bash -cd /opt/remnawave/nginx && nano nginx.conf +mkdir -p /opt/remnawave/nginx/conf.d && cd /opt/remnawave/nginx/conf.d && nano remnawave.conf ``` Paste the following configuration. @@ -93,7 +93,7 @@ Review the configuration below, look for red highlighted lines. ::: -```nginx title="nginx.conf" +```nginx title="remnawave.conf" upstream remnawave { server remnawave:3000; } @@ -102,9 +102,9 @@ server { // highlight-next-line-red server_name REPLACE_WITH_YOUR_DOMAIN; - listen 443 ssl reuseport; - listen [::]:443 ssl reuseport; + listen 443 ssl; http2 on; + gzip on; location / { proxy_http_version 1.1; @@ -115,60 +115,55 @@ server { proxy_set_header X-Forwarded-Proto $scheme; } - # SSL Configuration (Mozilla Intermediate Guidelines) - ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305; - - ssl_session_timeout 1d; - ssl_session_cache shared:MozSSL:10m; - ssl_session_tickets off; ssl_certificate "/etc/nginx/ssl/fullchain.pem"; ssl_certificate_key "/etc/nginx/ssl/privkey.key"; ssl_trusted_certificate "/etc/nginx/ssl/fullchain.pem"; - - ssl_stapling on; - ssl_stapling_verify on; - resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s; - resolver_timeout 2s; - - # Gzip Compression - gzip on; - gzip_vary on; - gzip_proxied any; - gzip_comp_level 6; - gzip_buffers 16 8k; - gzip_http_version 1.1; - gzip_min_length 256; - gzip_types - application/atom+xml - application/geo+json - application/javascript - application/x-javascript - application/json - application/ld+json - application/manifest+json - application/rdf+xml - application/rss+xml - application/xhtml+xml - application/xml - font/eot - font/otf - font/ttf - image/svg+xml - text/css - text/javascript - text/plain - text/xml; } +# Reject unknown SNI server { - listen 443 ssl default_server; - listen [::]:443 ssl default_server; + listen 443 ssl default_server reuseport; server_name _; ssl_reject_handshake on; } +# Gzip Compression +gzip_vary on; +gzip_proxied any; +gzip_comp_level 6; +gzip_min_length 1024; +gzip_types + application/javascript + application/json + application/manifest+json + application/xml + font/opentype + font/eot + font/otf + font/ttf + image/svg+xml + text/css + text/javascript + text/plain + text/xml; + +# SSL Configuration (https://configurator.tlsref.org/#server=nginx&version=1.30&config=intermediate&openssl=3.5&ocsp) +ssl_protocols TLSv1.2 TLSv1.3; +ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1; +ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305; +ssl_prefer_server_ciphers off; + +# Turn off session cache and tickets +ssl_session_cache off; +ssl_session_tickets off; + +# OCSP stapling +ssl_stapling on; +ssl_stapling_verify on; +resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s; +resolver_timeout 2s; + ``` ### Create docker-compose.yml @@ -184,13 +179,12 @@ Paste the following configuration. ```yaml title="docker-compose.yml" services: remnawave-nginx: - image: nginx:1.30 + image: nginx:stable container_name: remnawave-nginx hostname: remnawave-nginx volumes: - - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro - - ./fullchain.pem:/etc/nginx/ssl/fullchain.pem:ro - - ./privkey.key:/etc/nginx/ssl/privkey.key:ro + - ./conf.d/:/etc/nginx/conf.d/:ro + - ./ssl/:/etc/nginx/ssl/:ro restart: always ports: - '0.0.0.0:443:443'