Nginx comme reverse proxy — Configuration complète avec SSL

Nginx est à la fois serveur web et reverse proxy performant. Voici comment le configurer pour héberger plusieurs applications avec SSL.

Installation

sudo apt update && sudo apt install -y nginx certbot python3-certbot-nginx
sudo systemctl enable nginx
sudo systemctl start nginx

Structure des fichiers de config

/etc/nginx/
├── nginx.conf              ← Config principale
├── sites-available/        ← Configs disponibles
│   ├── neotoad.fr
│   └── api.neotoad.fr
├── sites-enabled/          ← Liens symboliques vers sites-available
│   └── neotoad.fr -> ../sites-available/neotoad.fr
├── conf.d/                 ← Configs globales supplémentaires
│   ├── gzip.conf
│   └── security.conf
└── snippets/               ← Fragments réutilisables
    ├── ssl-params.conf
    └── proxy-params.conf

Configuration de base Laravel

# /etc/nginx/sites-available/neotoad.fr
server {
    listen 80;
    server_name neotoad.fr www.neotoad.fr;
    
    # Redirection HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name neotoad.fr www.neotoad.fr;
    
    root /var/www/neotoad/public;
    index index.php;

    # SSL (géré par Certbot)
    ssl_certificate /etc/letsencrypt/live/neotoad.fr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/neotoad.fr/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Logs
    access_log /var/log/nginx/neotoad.access.log;
    error_log /var/log/nginx/neotoad.error.log;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_hide_header X-Powered-By;
        
        # Timeouts
        fastcgi_read_timeout 300;
        fastcgi_connect_timeout 60;
    }

    # Cache des assets statiques
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # Interdire l'accès aux fichiers cachés
    location ~ /\.(?!well-known).* {
        deny all;
    }
}

Reverse proxy vers un container Docker

# /etc/nginx/sites-available/api.neotoad.fr
upstream neotoad_api {
    server 127.0.0.1:8080;
    server 127.0.0.1:8081;  # Load balancing
    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name api.neotoad.fr;
    
    ssl_certificate /etc/letsencrypt/live/api.neotoad.fr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.neotoad.fr/privkey.pem;

    location / {
        proxy_pass http://neotoad_api;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}

Certbot — SSL automatique

# Obtenir un certificat pour un domaine
sudo certbot --nginx -d neotoad.fr -d www.neotoad.fr

# Wildcard (nécessite DNS challenge)
sudo certbot certonly --manual \
    -d neotoad.fr -d *.neotoad.fr \
    --preferred-challenges dns

# Renouvellement automatique (cron)
sudo crontab -e
# 0 3 * * * certbot renew --quiet

Optimisation des performances

# /etc/nginx/conf.d/gzip.conf
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_types text/plain text/css text/xml application/json 
           application/javascript application/rss+xml 
           application/atom+xml image/svg+xml;

# /etc/nginx/nginx.conf
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 65535;
    use epoll;
    multi_accept on;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    server_tokens off;
}

Test et validation

# Tester la syntaxe
sudo nginx -t

# Recharger sans coupure
sudo nginx -s reload

# Tester SSL avec ssllabs.com ou localement
openssl s_client -connect neotoad.fr:443 -servername neotoad.fr

# Grade SSL (visez A+)
curl -s https://api.ssllabs.com/api/v3/analyze?host=neotoad.fr | jq '.grade'