Nginx 1.28

Prerequisites

• An Azure subscription with permission to create virtual machines.
• An SSH key pair. The public key is uploaded during VM creation.
• A domain name pointed at your VM's public IP address, if you plan to request a Let's Encrypt TLS certificate.

Step 1 - Deploy from the Azure Portal

In the Azure Marketplace, find NGINX 1.28 Stable on Ubuntu 24.04 LTS by SecureAnyCloud and click Create.

On the Basics tab, select or create a resource group and choose East US as the region. Set the VM size to Standard_B2s (2 vCPU / 4 GB RAM) for a lightweight reverse proxy, or to Standard_D2s_v3 (2 vCPU / 8 GB RAM) and upward for production TLS-terminating workloads.

Under Administrator account, choose SSH public key and paste your public key.

On the Networking tab, open inbound ports 80 (HTTP) and 443 (HTTPS) in addition to 22 (SSH).

Click Review + create, then Create.

Step 2 - Deploy with the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:nginx-1-28-ubuntu-24-04:standard:latest
az vm create \
  --resource-group \
  --name nginx-1-28 \
  --image sac1647283583153:nginx-1-28-ubuntu-24-04:standard:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

After the VM starts, open the HTTP and HTTPS ports:

az vm open-port --port 80 --resource-group --name nginx-1-28 --priority 1010
az vm open-port --port 443 --resource-group --name nginx-1-28 --priority 1011

Step 3 - Connect over SSH

Connect to the VM as azureuser:

ssh azureuser@

On first boot, nginx-firstboot.service marks the image as live and enables nginx.service. This one-shot service completes in under a second.

Step 4 - Verify that NGINX is running

Check the service status and listening ports:

sudo systemctl status nginx --no-pager

sudo ss -tln | grep -E ':80|:443'

Confirm the NGINX version shipped in this image:

sudo nginx -v

Check that the configuration is syntactically valid:

sudo nginx -t

Fetch the landing page locally. The SecureAnyCloud welcome page is served from /usr/share/nginx/html/index.html:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/

curl -sI http://127.0.0.1/ | grep -iE '^(HTTP|Server|Content-Type)'

From a browser, open http:/// and you should see the SecureAnyCloud NGINX 1.28 landing page. This page is a template. Replace it with your own content in Step 5.

Step 5 - Publish your own content

The active document root is /usr/share/nginx/html. Replace the welcome page with your own HTML:

sudo tee /usr/share/nginx/html/index.html > /dev/null Hello from NGINX Hello from NGINX 1.28 on Azure by sac. HTML

Reload NGINX to pick up file changes without dropping connections:

sudo nginx -s reload

Fetch the new page:

curl -s http://127.0.0.1/ | head -3

For larger sites, upload your content into /usr/share/nginx/html/ or configure an alternate document root in a server block (see Step 6).

Step 6 - Configure a reverse-proxy server block

A sample reverse-proxy server block ships at /etc/nginx/conf.d/sac-example.conf.disabled. Rename it and edit the upstream to point at your backend:

sudo cat /etc/nginx/conf.d/sac-example.conf.disabled

Copy it into an active server block, then edit the upstream backend block and the server_name line for your domain. For example, to reverse-proxy a Node.js app running on 127.0.0.1:8080:

sudo tee /etc/nginx/conf.d/backend.conf > /dev/null \
  --nsg-name \
  --name allow-http3 \
  --priority 1012 \
  --protocol Udp --destination-port-ranges 443 \
  --access Allow --direction Inbound

Reload NGINX and verify that the QUIC listener is bound:

sudo nginx -t && sudo nginx -s reload

Step 9 - Configure rate limiting and caching

Rate-limit requests per client IP address. Define a zone in the http {} block of /etc/nginx/nginx.conf, then apply it in a location block:

http { limit_req_zone $binary_remote_addr zone=api_zone:10m rate=10r/s; proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=edge_cache:100m max_size=1g inactive=60m use_temp_path=off; } server { location /api/ { limit_req zone=api_zone burst=20 nodelay; proxy_pass http://backend; } location /static/ { proxy_cache edge_cache; proxy_cache_valid 200 1h; proxy_pass http://backend; } }

Reload NGINX to activate the configuration:

sudo nginx -t && sudo nginx -s reload

Step 10 - Harden the server

The image ships with server_tokens off already applied, which hides the NGINX version from response headers and error pages. Verify it:

curl -sI http://127.0.0.1/ | grep -i '^server:'

Add these recommended security headers to your server block:

add_header X-Content-Type-Options nosniff always; add_header X-Frame-Options SAMEORIGIN always; add_header Referrer-Policy strict-origin-when-cross-origin always; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

Restrict admin endpoints with an IP allowlist:

location /admin/ { allow 203.0.113.0/24; deny all; proxy_pass http://backend; }

Keep NGINX up to date from the nginx.org APT repository:

sudo apt-get update
sudo apt-get install -y --only-upgrade nginx

Step 11 - Everyday operations

Reload the configuration without dropping connections:

sudo nginx -s reload

Read the error and access logs:

sudo tail -50 /var/log/nginx/error.log

sudo tail -50 /var/log/nginx/access.log

Restart the service. You can also stop or start it with systemctl:

sudo systemctl restart nginx

Support

SecureAnyCloud provides 24/7/365 expert technical support. Response is guaranteed within 24 hours, with a one-hour average for critical issues. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Nginx 1.28 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com