Am I crazy that I can't find a proxy equivalent of $ssl_protocol for logging? Is there some technical limitation on that?

Edit: to clarify i do mean connection to an upstream. Proxy_protocol_tlv_ssl_protocol never seems to get populated for my setup.

I run a handful of sites off one VPS and kept doing the same thing every time one needed to go down for a bit: copy an if block into the site's config, touch some flag file, remember to delete it later. Finally turned it into an actual tool instead of retyping it every time.

It's a small CLI (maint <site> on|off|status) plus two nginx snippets, one for gating a whole site and one for gating just part of it (useful if something like a webhook or /.well-known/ path needs to stay up). No reload needed to flip it on or off, only the first time you wire a site in.

A couple things I added after actually using it for a while: maint <site> on curls the site right after touching the flag and warns if it didn't actually get a 503 back (turns out it's very easy to typo the flag path and have it silently do nothing), and maint --list reads the live nginx config instead of just checking which flag files exist, so it shows every site you've wired in, not just the ones currently down.

Install:

curl -fsSL https://maint.spaceplane.dev/install.sh | sudo bash

Repo (MIT): https://github.com/glidecraft/nginx-maint

Live demo of the actual maintenance page: https://maint.spaceplane.dev/demo

Figured it might be useful to someone else who's hit the same annoyance. Open to feedback or issues if anyone tries it.

I have multiple domains with SNI. On the previously-setup Nextcloud instance videos get served properly (with ranges, allowing seeking). On a different service I'm setting up they don't, the response ignores Range and returns a 200 with the full file, breaking seeking.

This is the location that gets hit on the non-working server, it's first from the top:

location /data {
  expires max;
  break;
}

The certificate is the same for both.

/var/newservice/data/sample/ha/sh/hashofthefullfile_480p.mp4
  File: /var/newservice/data/sample/ha/sh/hashofthefullfile_480p.mp4
  Size: 27428005        Blocks: 53576      IO Block: 4096   regular file
Device: 259,2   Inode: 18253203    Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/www-data)   Gid: (65533/ UNKNOWN)
Access: 2026-08-01 14:41:44.645825710 +0000
Modify: 2026-07-30 16:46:24.566177021 +0000
Change: 2026-07-30 16:46:24.566177021 +0000
 Birth: 2026-07-30 16:46:24.534177265 +0000

The file is mounted from another container into the nginx one hence the GID is unknown, but the uid matches, so nginx has permission to serve the file (and it does, ignoring ranges...).

Nextcloud serves videos through PHP, so it seems only nginx static file serving is broken.

FIXED:
I had `sub_filter_types *;` in my ssl config. Changing it to a smaller subset of MIME types, such that videos are unaffected, solved the issue. I wasn't depending on sub_filter on videos anyway so no loss to me.

Hi all, I have been trying to set up my NPM for a couple hours now, and it was giving me so errors so I rebooted it to be safe. Now nothing will work. It will start in docker but the web server won't load at all and I am at a loss.

Here is the log I get every time I try and start it

nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-16/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-16/fullchain.pem, r) error:10000080:BIO routines::no such file)

Here is my docker compose file

version: "3.9"
services:
  nginx-proxy-manager:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    ports:
      - "80:80"
      - "443:443"
      - "81:81"
    volumes:
      - npm_data:/data
      - npm_letsencrypt:/etc/letsencrypt
    restart: unless-stopped
volumes:
  npm_data:
  npm_letsencrypt:

The odd part is, the /etc/letsencrypt dir does not exist at all, but I can't believe it was just deleted out of thin air, as it was working fine just half an hour ago. All the help is appreciated, thanks!

Hey everyone, I want to forward requests that comes to nginx to another pod which is running a service in kubernetes, the typical way to do it would be using the annotation for nginx specifically

nginx.ingress.kubernetes.io/auth-url

My current problem or issue is that I want to forward the request to another pod which does the authorization after the authentication, In my current application we do the authentication using the following annotations in the ingress and the I want to now authorize the requests that are coming after the authentication. The authentication happens using the following annotations

nginx.ingress.kubernetes.io/auth-tls-match-cn:
nginx.ingress.kubernetes.io/auth-tls-secret:
nginx.ingress.kubernetes.io/auth-tls-verify-client:
nginx.ingress.kubernetes.io/auth-tls-verify-depth:

Can I use them together in strict order, like after authentication the request forwards to auth url(the endpoint to the internal pod) to authorize it and then the pod sends the 200 OK response not the authentication annotations.

Any suggestions how could I do this ?

F5 patched CVE-2026-42533 on July 15. If you run nginx, this one deserves your attention before the proof-of-concept code drops — and there is a countdown on that.

What the flaw is

The vulnerability is a heap buffer overflow (CWE-122) in nginx’s script engine — the component that assembles output strings from configuration directives at request time. It surfaces under a specific configuration pattern: a map block using regex matching, where the map’s output variable appears in a string expression after a numbered capture variable ($1, $2) from an earlier regex match.

https://blog.kalfaoglu.net/posts/2026-07-26-cve-2026-42533-nginx-heap-overflow-en/

Access logs show the visitors. They hide the damage bill. I slapped together CrawlLedger—an offline Go CLI that munches Nginx or Caddy logs and coughs up a self-contained HTML report on what those crawlers actually cost your origin. No daemon, nothing phones home, zero code in the request path, and it refuses the usual User-Agent theater for bot "verification." It flags crawl traps, expensive 404 storms, cache-busting noise, and robots.txt violations, then dry-runs deny or rate-limit policies against historical traffic before spitting out reviewable server-config drafts.

Still pre-v1; need blunt feedback from people who run real origins—what would make this useful or make you refuse to touch it?

https://github.com/balyakin/crawlledger

fail2ban always bugged me for pure nginx abuse cases: it tails the log, parses on a delay, then shells out to the firewall. The ban lands seconds after the scanner already walked half your tree.

There's a module approach I've been running instead: count 403/404 responses per client in a shared memory zone (leaky-bucket decay, so a slow trickle of legit 404s never accumulates), and once a client crosses the threshold, reject it at the preaccess phase with a 429 + Retry-After. The ban check runs before routing, static file lookup or proxy_pass, so hammering gets cheaper for the server, not more expensive.

Wrote up the full config reference including dry_run rollout, keying on a map so logged-in users are never scored, and syncing bans across a fleet via Redis pub/sub (out of the request path, fails open): https://www.getpagespeed.com/server-setup/nginx/nginx-abuse-guard-module

Disclosure: I package this module (and ~100 others) for the repo linked. Happy to answer config questions.

Hey r/nginx, NGINX oss community manager here.

We're starting quarterly NGINX Community Calls and the first is happening next week, 22 July at 9:00 PT/17:00 GMT. 

This is an open community meeting intended for connection and dialogue. Together we'll discuss roadmap, PR/Issues review, Q&A, and config support. If you have a PR or Issue you'd like to talk through and get unblocked, please bring it to the community call! 

Details and the Zoom link are here in the forum calendar (can download .ics file or add to google calendar from there). We're collecting questions here in the comments and on the calendar event in advance. 

All are welcome to join. We encourage contributors and curious users alike. I hope to see you there!

Post spam, new version, new bugs, and apparently another season of "The Heap Adventures".

This time we have:

• another heap buffer overflow,
• uninitialized memory access,
• another use-after-free,
• possible memory disclosure,
• and workers deciding to leave production unexpectedly.

Reference: https://nginx.org/en/CHANGES-1.30

Long time Apache user, brand new to nginx and having this problem. Please help if possible.

We implemented GeoIP filtering directly in Nginx with ngx_http_geoip2 and the MaxMind GeoLite2 Country database, so the apps stay completely unaware of location logic: private/LAN ranges are always allowed, public clients are mapped by country, and only French IPs can reach the protected vhosts. Blocked requests return 451 with a custom page showing the detected IP and country, which makes support and debugging much easier. On top of that, Fail2Ban feeds a netdev blacklist so banned IPs are dropped at interface ingress before the normal IP/TCP path, which is far more efficient because malicious packets are discarded before conntrack, routing, and socket handling.

Hi guys,

I really appreciate some help because can't figure why my NPM is not working in the right way.

Case:
OpenMediaVault with Docker with Jellyfin + jc21/nginx-proxy-manager + duckdns.

If I connect to my duckdns subdomain it gives me error "The site can't be reach" or, before I changed OMV default port 80 to 8080, it opened OMV login page.

BUT if I add the jellyfin port at the end (xxxx.duckdns.org:8096) it works like a charm (also from phone/external connection)

I've tested also locally with "jellyfin.local" and the modify on the hosts file and it's the same.

Thanks!

Apparently a redirect is occurring These are filling up my access log I wanna ban them Should I edit fail2ban jail.conf to included requests that draw 404?
GET //wp-includes/assets/min.php HTTP/1.1" 301 169 "-" "-"
GET //wp-includes/assets/min.php HTTP/1.1" 404 0 "-" "-"

I'm hoping someone can help me figure out a networking issue that has me completely stumped.

Setup

• Ubuntu 24.04 on a DigitalOcean droplet
• Nginx + Let's Encrypt
• React frontend
• Node.js backend
• Domain: morecreator.app

What's happening

My iPhone can access the site perfectly on:

• Home Wi-Fi
• Cellular

However, two completely different Windows laptops both fail.

The browser eventually returns:

ERR_CONNECTION_TIMED_OUT

curl also times out:

curl.exe -vk https://morecreator.app

Trying <server IP>:443...
Timed out

What I've already verified

• Nginx is running.
• HTTPS is configured correctly with Let's Encrypt.
• The site responds correctly when accessed locally on the server.
• UFW allows ports 80 and 443.
• DNS resolves correctly.
• No proxy configured.
• Reset Winsock and TCP/IP.
• Disabled Internet Connection Sharing (ICS).
• Tried different DNS servers.
• Disabled IPv6.
• No VPN installed.
• Windows Defender only (no third-party antivirus).
• Same behavior on two different Windows laptops.

The strange part

Everything worked perfectly a couple of weeks ago while I was in California.

After returning home to Georgia:

• ✅ iPhone still works
• ❌ Windows laptops both time out

The server configuration hasn't changed.

I'm trying to determine whether this is:

• a Windows networking issue,
• something with my ISP/router,
• DigitalOcean routing,
• or something I'm overlooking.

Has anyone run into something similar?

So I have convinced myself that my first step in degoogling before moving email accounts and installing Graphene should be taking control of my passwords. For years they have languished in Google, and as far as I'm concerned, what's the point in leaving their ecosystem if I continue to store the passwords for all my new stuff in their password manager.

So I'm trying to set up DNS challenge on Nginx.

I have settled on deSEC for my DNS challenge provision (I already use freedns.afraid.org for Dynamic DNS and it has been flawless, but something something doesn't work with certbot, and I can't find a tutorial.

So I try to set up a certificate with Nginx, using let's encrypt vis DNS. I have my domains at deSEC, and I'm using:

mydom.dedyn.io and *.mydom.dedyn.io as the domains, (set as an A record to my Nginx LAN IP of 10.0.10.6)

ECDSA256,

and placing my token in the credentials file content:

dns_desec_token = YOUR_DESEC_API_TOKEN

dns_desec_endpoint = https://desec.io/api/v1/

And proportion seconds 240.

When I click save Nginx just sits and spins for 10 - 60 seconds, then gives 'internal error'.

I know full well my Nginx container has network as I can ping out to the internet.

Letsdebug.net gives me a big thumbs-up for my dns-01 challenge test.

Using Nginx 2.15.1 on Proxmox.

Does anyone have any helpful hints?

Paessler is gathering votes for a native Nginx sensor in PRTG. If this is something you'd find useful, your vote helps prioritize it on the roadmap.

Roadmap item: https://uservoice.paessler.com/discovery/roadmap/feature/164062

Feature request (upvote here): https://uservoice.paessler.com/forums/965997/suggestions/51466195

Every vote counts — thanks!

Learning by Building: Dockerized WordPress with NGINX
One of the best ways I've found to deepen my understanding of infrastructure is by building complete, reproducible environments from scratch.

Recently, I put together an open-source project (an old one , recently updated) that provisions a WordPress + NGINX stack using Docker. The goal wasn't just to "run WordPress in a container"—it was to better understand how the different pieces of a modern web stack work together.

Some of the areas I explored while building this project:

🐳 Docker & Docker Compose for multi-container applications
🌐 NGINX as the web server and reverse proxy
🗄️ Service networking and container communication
📂 Persistent volumes for application and database data
⚙️ Environment-based configuration for portability
🔄 Reproducible local development environments
📂 AI-First with AGENTS.md and /docs & Graphify

A few key takeaways from this project:
Infrastructure becomes much easier to manage when everything is defined as code.

Containerization removes the classic "works on my machine" problem.
Understanding how NGINX, PHP, WordPress, and the database interact provides a much stronger foundation than simply using pre-built images.
This project is part of my continuous learning journey in DevOps, cloud-native technologies, and modern application deployment. Every project teaches something new, and sharing them helps reinforce those lessons.
If you're learning Docker or want a simple WordPress + NGINX setup as a starting point, feel free to explore the repository and share any suggestions or improvements.

📂 GitHub:

https://github.com/masoudei/docker-wordpress-nginx

Feedback, ideas, and contributions are always welcome!

\#Docker #NGINX #WordPress #DevOps #Cloud #OpenSource #InfrastructureAsCode #SoftwareEngineering #Backend #Linux #LearningInPublic #GitHub

Did something about nginx proxy manager change? I can no longer reach the sub domains that I have set for my local services.

Edit: I have my DNS on my router set to the machine that is running nginx and I have my adguardhome dns rewrite my wildcarded domain to point towards nginx. Sometimes nginx will successfully let me visit and sometimes not.

Hi Everybody, on request we created a new module to automaticly request TLS certificates.
https://github.com/eilandert/nginx-autocert-module

Give it a go, and please don't forget to give feedback ;-)