By Default NGINX logs all IPs going through the reverse proxy. The log will keep growing in size.
To ease of maintainance and troubleshooting, it is advisable to get NGINX to create a new access.log everyday.
If NGINX is running on Windows this can be accomplished using a BAT file.
Create a new BAT file with the following
REM ECHO %YEAR%
REM ECHO %MONTH%
REM ECHO %DAY%
move C:\nginx\logs\Access.log C:\nginx\logs\Old_Logs\Access_%DATE_FRM%.log
move C:\nginx\logs\Error.log C:\nginx\logs\Old_Logs\Error_%DATE_FRM%.log
call C:\nginx\nginx -p C:\nginx -s reopen
Change the Path to the path of your NGINX Log folder. Also create a new folder in the 'Logs' folder called 'Old_Logs'
Save the BAT file.
We now need to create a Scheduled Task to run this BAT file once a Day.
Create a Basic Task
Daily Task or Weekly depending on how often you want to create a new log.
Choose a Time for it to change logs, i chose 00:00:01 so it would create a new log after midnight.
Next select the location of the BAT file and click next until your seen the screen below.
Make sure to put a tick in the 'Open the properties dialog....' box and click finish.
For The Task to restart NGINX the same user has to run the Task Scheduler and the Service.
Select the correct user in 'Change User or Group' and tick the 'Run with highest privileges' box and click 'ok'.
Next run 'services.msc'
Find your NGINX Service and right click on it 'properties'.
On the 'log on' tab change it from 'Local System Account' to 'This Account' and enter the same username as you did for the Task Scheduler.
Finally click Apply and Ok. And that's it. The task will run, move the access.log to the new folder and rename it with the date. NGINX will then create a new access.log file and repeat.
This guide assumes you have either setup a DDNS or have an A record setup to point your Domain Name to your WAN IP. If you dont have this setup go here.
Step 1 - Port Forwarding
Every router is different and rather than try to describe how to do this on all the different brands I will simplify it so it is more relevant to all routers.
Log into your router
Head over to port forwarding
Create a new rule to forward port 443 and port 80 to the machine that NGINX will
be running on.
Step 2 - Installing NGINX
Head over to NGINX-Win and download the latest version of NGINX for Windows. As of writing this guide the latest version is 188.8.131.52 Violet.
Extract the .zip folder somewhere easy to find. for my example I will extract it to C:\NGINX\
Open up the config folder C:\NGINX\config
Open up notepad (I recommend Notepad++) and copy the following into it.
This part makes NGINX listen on port 80 and any traffic it receives on port 80 (HTTP) it redirects to port 443 (HTTPS). It forces the connection to use a secure connection. listen [::]:80 is only required if you have users connecting on IPv6 addresses.
The next part is to configure NGINX to forward the traffic it receives to the correct location. Copy the code below into the same notepad.
Most of the above is to do with the ciphers to create the secure connection. ssl_protocols lists in order the protocols to use. TLSv1.2 is the most secure. These have replaced SSL which are now obsolete. In the very near future TLSv1.3 will make all the other versions of TLS obsolete. Preferred ciphers just list in the order of the ciphers used to create the secure connection.
This is the location of our cert.pem and private.key. I have them located in my NGINX folder in the following location C:\NGINX\config\SSL To find out how to create the Certs please use the guide Easy Let's Encrypt Certificates At the bottom it describes how to create .pem certs.
Most of the above is to do with the headers in html. They add extra security to the connection.
X-Xss-Protection - sets the configuration for the cross-site scripting filters built into most browsers. The best configuration is "X-XSS-Protection: 1; mode=block".
X-content-type-options - stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
Strict-Transport-Security - is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
X-Frame - tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
Referrer Policy - is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Content-Security-Policy - is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail.
The location block tells NGINX what to do when it received data and where to forward it to. It is also required for web sockets to work.
Edit the proxy_pass and point it to the location of your Service that you are running. If it is running on the same machine as NGINX you can leave it as http://127.0.0.1:PORT. If its running on another machine you will need to know the IP. http://192.168.1.10:PORT etc.
Save the notepad as nginx.config in the following location
Step 3 - Set NGINX as a Windows Service
To get NGINX to start with Windows we need to donwload an application called NSSM (Non-sucking service manager).
Download it and extract it. You will have a choice to use win32 or win64 version. Choice the version that relates to your Windows installation.
Copy the nssm.exe to C:\Windows\System32
Open up a command prompt (Run as administrator)
type the following
nssm install NGINX
It will now display this
Fill in the Path to the NGINX.exe and the Startup Directory as above.
Open up Service.msc and find the NGINX Service we just installed.
Right click and Start.
To Test, we can navigate to emby.mysite.com and it should bring up your Emby Server!
If you have any problems drop a comment below. I will also be creating a Troubleshooting NGINX post soon.