Nginx & SSL Setup

So, I decided to go with Nginx for my webserver instead of Apache.  Why? If you are really interested, read something like this. Mainly, I think it will have less overhead, since it's event-driven instead of process based.  I also don't need to scale, so it will serve my needs (see what i did there?).

Easy to install

sudo apt-get install nginx-extras

Easy to run

sudo service nginx start

And easy to configure (once you know how).  The default config file you will change the most is in /etc/nginx/sites-enabled/default. My configuration will only have one virtual host, www.domain.com.  I plan to separate individual apps and webpages through subdomains.  like /subsonic, /opds, etc.  Also, I only plan to use https for my server.  This is because one of the web-apps (opds), can only authenticate through Basic HTTP Authentication.  I do not want the eventual LDAP credentials to be sent plain text, so SSL it is.  I ended up getting an SSL Certificate through the PositiveSSL service with Namecheap/Comodo for around $5-$6 a year.  

You can reference kbeezie's blog here for a start to getting the cert ready for nginx. Only difference is that I concatenated the certificates from Comodo into a bundle.  This will be needed later for some clients, and the LDAP server we'll build later.  

cat domain.crt PositiveSSLCA2.crt AddTrustExternalCARoot.crt > serverall.crt

Here is my initial nginx configuration file

server {

    listen [::]:443;
    server_name www.domain.com;

    #root /var/www;
    #index index.php index.html index.htm;

    ssl on;
    ssl_certificate /etc/nginx/certs/serverall.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;
    ssl_session_timeout 5m;

    access_log /var/log/nginx/server.access.log;
    error_log /var/log/nginx/server.error.log;

    root /usr/share/nginx/www;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ /index.html;
    }
}

I also want to redirect any unencrypted requests on port 80 to use SSL on port 443, so I added the below.

server
{
    listen 80;
    server_name www.domain.com;
    rewrite ^ https://$server_name$request_uri? permanent;  # enforce https
}