By Default NGINX logs all IPs going through the reverse proxy. The log will keep growing in size.
To ease of maintainance and troubleshooting, it is advisable to get NGINX to create a new access.log everyday.
If NGINX is running on Windows this can be accomplished using a BAT file.
Create a new BAT file with the following
REM ECHO %YEAR%
REM ECHO %MONTH%
REM ECHO %DAY%
move C:\nginx\logs\Access.log C:\nginx\logs\Old_Logs\Access_%DATE_FRM%.log
move C:\nginx\logs\Error.log C:\nginx\logs\Old_Logs\Error_%DATE_FRM%.log
call C:\nginx\nginx -p C:\nginx -s reopen
Change the Path to the path of your NGINX Log folder. Also create a new folder in the 'Logs' folder called 'Old_Logs'
Save the BAT file.
We now need to create a Scheduled Task to run this BAT file once a Day.
Create a Basic Task
Daily Task or Weekly depending on how often you want to create a new log.
Choose a Time for it to change logs, i chose 00:00:01 so it would create a new log after midnight.
Next select the location of the BAT file and click next until your seen the screen below.
Make sure to put a tick in the 'Open the properties dialog....' box and click finish.
For The Task to restart NGINX the same user has to run the Task Scheduler and the Service.
Select the correct user in 'Change User or Group' and tick the 'Run with highest privileges' box and click 'ok'.
Next run 'services.msc'
Find your NGINX Service and right click on it 'properties'.
On the 'log on' tab change it from 'Local System Account' to 'This Account' and enter the same username as you did for the Task Scheduler.
Finally click Apply and Ok. And that's it. The task will run, move the access.log to the new folder and rename it with the date. NGINX will then create a new access.log file and repeat.
You own a domain name and you use Cloudflare to proxy your websites, services or something else and now you want to have an email address with your new shiny domain name. Cloudflare doesnt support mail forwarding, some registrars have their own forwarding system but if you use Cloudflare then we need to look at Mailgun.
Once added you need to verify you own the domain and setup the relevent records. Head over to Cloudflare and create the records, they will look similar to the below image.
This is what you will end up with. (Make sure the email CNAME status is the grey cloud!)
Head back to Mailgun. You will need to give the Records we created above some time to propogated across the internet. You can check this by clicking 'Check DNS Records Now'
Creating Routes. In Mailgun we need to specify routes or email addresses. This will define the recipient email and the action to take.
You can create a number of routes or you can create a 'catch all' or both. Priority is like rules, It will match the lowest priority first (lowest number), so if you set a 'catch all' rule set a high number priority e.g. 100. That way it will attempt to match everything else first.
Finally in Mailgun we also need to validated our personal email address, hotmail, gmail or whatever. Head into Account Settings and then Authorised Recipients. Add your email address which will send a link to your email which you need to validate.
Once the DNS settings have been updated and you have validated your email you should now be able to receive any emails sent to *@mymedia.cf which will appear in your hotmail or gmail account.
Add a services and choose Cloudflare from the list.
Add the following details into the boxes.
email = your Cloudflare username (usually the email address)
API Token = On the Overview page on Cloudflare use the Global API token
Hostname = Your A record name from Cloudflare for example ddns.mymedia.cf
Domain = your top level domain mymedia.cf
We now need to setup a way for our router to update DNS-O-Matic.
I use a Unifi USG as my router and it requires the following details
Service = dyndns
Hostname = ddns.mymedia.cf
username = DNS-O-Matic email address
password = DNS-O-Matic password
server = updates.dnsomatic.com
DNS-O-Matci also offer a small program which can run on your LAN and update the details automatically.
So far I have documented different approaches to access Emby securely remotely.
This guide uses Cloudflare for DNS records of your domain name, create and maintain your SSL cert and add security to your connection.
So for anyone who doesnt know, Cloudflare acts like a middle man, or more like a big bouncer. Imagine you own a bar and you want security. You hire a bouncer and he lets your customers in but keeps the riff raff out. This is what cloudflare does it adds security to your Server, while allowing authorised people to access your server.
This guide will assume you have Emby Server already setup and working on your LAN.
Getting a Domain Name.
For this to work we need a domain name. You can get a free one from FreeNom or buy your own .com or .co.uk from a registrar such as NameCheap.
For this example I will use Freenom.
Search for the domain name you want. I will use mymedia.cf
Click Checkout. Enter your details. You will then see a button to manage domain, click that. Next click on Management Tools and Nameservers. You will see the below screen. Leave this open for now, we will come back to it.
Head over to Cloudflare Create an account with Cloudflare and then add your Domain name you entered above mymedia.cf. note. when adding your site and starting the scan it might fail due to DNS propagation. Give it 5-15 mins and try again.
Once your Domain Name appears in Cloudflare you can click 'Continue Setup' and you will see the page below.
Create an 'A Record'
Name = emby
Value = your WAN IP
Status = make sure its an Orange cloud
Select Free Plan
You will now be given Nameservers. Copy the 2 name servers from Cloudflare and enter them into FreeNom. If FreeNom has 4 delete all of them and only enter the 2 from cloudflare. Should look something like the below image.
It will take some time for DNS propagation before the Nameservers change to Cloudflare. In this time lets setup Emby Server and Port Forwarding on your router.
Go to your Emby Server and Dashboard Manager > Advanced.
Change your Public HTTP port to 80 and HTTPS port to 443. Enter your new domain name. I get emby.mymedia.cf from the CloudFlare DNS page. Emby was the name of the DNS record, so the full record is emby.mymedia.cf.
Save and Restart Emby.
Log into your router. All routers are different. Find the section to port forward and create a new rule.
Forward External port 443 to internal port 8920 and IP address of your Emby Server. You can also forward 80 to 8096, however this will mean users can connect insecurely to your Emby server.
Head back to CloudFlare and click 'Recheck Nameservers' if successfull you will see a green bar, and Cloudflare Active.
We now need to create a SSL cert for Cloudflare to connect to your Server Securely. On Cloudflare go to 'Crypto', and then 'Origin Certificates'.
Click Create Certificate, on the next screen leave everything default and click next.
You will now be given 2 boxes, A Certificate code and Private Key code.
Copy both of them into separate notepads and Save both. Call them cert.pem and private.key respectively
Click convert and you should end up with a PFX certificate.
Head back to Emby Server > Dashboard > Advanced.
Custom SSL certificate Path = your PFX file
Certificate Password = the one used above "what ever you want"
Save and Restart Emby
Head back to Cloudflare > Crypto Tab
You now need to change SSL from Flexible to Full.
(This means users connect to Cloudflare [uses cloudflare cert] Then Cloudflare connects to your emby server using the Cert we just created). Thus A Full SSL Path from user to server.
go to https://emby.mymedia.cf and enjoy your movies.
On Cloudflare > Crypto
You can enable 'Always use HTTPS' and 'Automatic HTTPS Rewrites'. Anyone trying to browse to HTTP will be forwarded to HTTPS.
On Cloudflare > Page Rules
Add the following rules to cache your images.
If you have a DHCP WAN IP then you will also need to do some additional steps so that Cloudflare forwards to your IP even if it changes. For this you need to use DNS-O-Matic, a Guide can be found HERE.