Nginx

Prerequisites

Before you launch this AMI, you need:

• An active AWS account
• An active subscription to the NGINX listing on AWS Marketplace
• An EC2 key pair for SSH access
• Familiarity with EC2 instance management and SSH

Recommended instance type: t3.small (2 vCPU, 2 GB RAM) or larger. The minimum requirements are 1 vCPU, 1 GB RAM and 20 GB of disk space. NGINX is lightweight and performs well even on smaller instances.

Configure virtual hosts

To serve multiple websites from a single NGINX instance, create server block configuration files.

Create a new server block:

sudo vi /etc/nginx/conf.d/mysite.conf

Example server block configuration:

server { listen 80; server_name mysite.example.com; root /var/www/mysite; index index.html; location / { try_files $uri $uri/ =404; } access_log /var/log/nginx/mysite_access.log; error_log /var/log/nginx/mysite_error.log; }

Test the configuration and reload:

sudo nginx -t sudo systemctl reload nginx

Configure a reverse proxy

NGINX is commonly used as a reverse proxy that forwards requests to application servers.

Example reverse proxy configuration:

sudo vi /etc/nginx/conf.d/proxy.conf

server { listen 80; server_name app.example.com; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } }

sudo nginx -t sudo systemctl reload nginx

Server components

Component Install Path

NGINX /etc/nginx

Note: The automatic OS package update script may update component versions on first boot.

Filesystem layout

Mount Point Size Description

/ 38 GB Root filesystem

/boot 2 GB Operating system kernel files

/usr/share/nginx 9.8 GB NGINX web server root

Key NGINX directories:

Directory Purpose

/etc/nginx Main configuration directory

/etc/nginx/nginx.conf Primary configuration file

/etc/nginx/conf.d/ Additional server block configurations

/usr/share/nginx/html Default web root

/var/log/nginx Access and error logs

/var/cache/nginx Cached content

Manage the NGINX service

systemd manages NGINX, and it starts automatically on boot.

Check service status:

systemctl status nginx

Stop NGINX:

systemctl stop nginx

Start NGINX:

systemctl start nginx

Restart NGINX:

systemctl restart nginx

Reload configuration without downtime:

systemctl reload nginx

Test configuration syntax:

nginx -t

Scripts and log files

Script/Log Path Description

initial_boot_update.sh /stage/scripts Updates the OS with the latest packages on first boot

initial_boot_update.log /stage/scripts Output log for the boot update script

NGINX logs:

Log File Path Description

access.log /var/log/nginx/access.log HTTP request log

error.log /var/log/nginx/error.log Error and diagnostic log

On startup

An OS package update script runs on first boot to bring the image fully up to date. To disable it, remove the script and its crontab entry:

rm -f /stage/scripts/initial_boot_update.sh crontab -e
# Delete the following line, save and exit: @reboot /stage/scripts/initial_boot_update.sh

Troubleshooting

You cannot reach NGINX on port 80

• Verify that NGINX is running: systemctl status nginx
• Check that your security group allows inbound traffic on port 80
• Ensure that the instance has passed 2/2 status checks
• Check the error logs: tail -f /var/log/nginx/error.log

The configuration test fails

• Run nginx -t to see the exact error and line number
• Look for common issues: missing semicolons, unclosed brackets and duplicate server_name values
• Check for syntax errors in the files under /etc/nginx/conf.d/

You get a 403 Forbidden error

• Check file ownership. Files should be owned by nginx:nginx
• Check directory permissions. Directories need 755 and files need 644
• Verify that the root directive in your server block points to the correct path
• Check SELinux with getenforce. If it is enforcing, adjust the contexts with chcon -R -t httpd_sys_content_t /var/www/mysite

You get a 502 Bad Gateway error (when using NGINX as a reverse proxy)

• Verify that the backend application is running on the expected port
• Check that the proxy_pass URL is correct
• Review the NGINX error logs: tail -f /var/log/nginx/error.log

Security recommendations

• Enable HTTPS. Install an SSL certificate from Let's Encrypt (certbot) or use your own certificate
• Hide the server version. Add server_tokens off; to the http block in /etc/nginx/nginx.conf
• Restrict sensitive paths. Use location blocks with deny all for admin areas
• Enable rate limiting. Use limit_req_zone to protect against brute-force attacks
• Configure security headers. Add headers such as X-Content-Type-Options, X-Frame-Options and Content-Security-Policy
• Keep NGINX updated. Update regularly with yum update nginx
• Monitor access logs. Review /var/log/nginx/access.log for suspicious requests
• Use firewall rules. Restrict SSH access to your IP address and open only the ports you need

Support

If you have any issues with this product, contact SecureAnyCloud support:

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7, with a guaranteed 24-hour response SLA

Deploy on AWS

Launch NGINX with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

• An AWS account with permission to launch EC2 instances
• A subscription to the NGINX Open Source AMI on AWS Marketplace
• An SSH key pair that you associate with the instance at launch

Connect to your instance

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<instance-public-ip>

Once connected, verify that NGINX is running:

nginx -v

nginx version: nginx/1.31.1

systemctl status nginx --no-pager

● nginx.service - nginx - high performance web server Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled) Active: active (running) since Wed 2026-05-27 17:37:37 UTC; 8s ago Docs: https://nginx.org/en/docs/ Process: 3357 ExecStart=/usr/sbin/nginx -c ${CONFFILE} (code=exited, status=0/SUCCESS) Main PID: 3358 (nginx) Tasks: 3 (limit: 4520) Memory: 2.9M (peak: 3.5M) CPU: 11ms CGroup: /system.slice/nginx.service ├─3358 "nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf" ├─3359 "nginx: worker process" └─3360 "nginx: worker process"

Confirm the default landing page

Browse to http://<instance-public-ip>/, or run this command from the instance:

curl -si http://127.0.0.1/ | head -10

HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 17:37:46 GMT Content-Type: text/html Content-Length: 2591 Last-Modified: Wed, 27 May 2026 17:35:55 GMT Connection: keep-alive ETag: "6a172b7b-a1f" Accept-Ranges: bytes

The SecureAnyCloud default landing page confirms that the server is healthy and shows where the document root is.

Instance information file

On first boot, nginx-firstboot.service writes a summary file. Read it with:

sudo cat /root/nginx-info.txt

# NGINX Open Source — written on first boot by nginx-firstboot.service.
# This file holds no secrets; NGINX itself is unauthenticated. It is an
# informational summary only. nginx.version=1.31.1 nginx.document.root=/var/www/html nginx.config.root=/etc/nginx nginx.landing.page=http://172.31.81.113/
# Monitoring (reachable from this instance only, by default):
# http://127.0.0.1/nginx_status live connection / request counters
#
# Place your website files in /var/www/html. To enable the reverse-proxy starter,
# rename /etc/nginx/conf.d/sample.conf.disabled to sample.conf, edit the
# upstream, run nginx -t, then systemctl reload nginx. To enable HTTPS, follow
# the Let's Encrypt section of the sac user guide.

Document root and web content volume

Your web content lives on a dedicated, independently resizable 20 GiB EBS volume mounted at /var/www:

df -h /var/www

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 20G 32K 19G 1% /var/www

The document root is /var/www/html. Replace the default landing page, or deploy your site files there:

sudo cp -r /path/to/your-site/* /var/www/html/
sudo nginx -t && sudo systemctl reload nginx

To grow the volume, resize it in the AWS Console, then run:

sudo resize2fs /dev/nvme1n1 df -h /var/www

NGINX configuration layout

/etc/nginx/ ├── nginx.conf
# main config (includes conf.d/*.conf and sites-enabled/*.conf) ├── conf.d/ │ ├── default.conf
# default server block on port 80 │ ├── sac-status.conf
# placeholder (stub_status is in default.conf) │ └── sample.conf.disabled
# reverse-proxy starter (rename to enable) └── sites-available/
# optional Debian-style sites sites-enabled/
# symlink your sites here

To view the effective running configuration, run:

sudo nginx -T > /tmp/nginx-dump.txt 2>/dev/null; grep -E "root|index |server_name|listen 80|location" /tmp/nginx-dump.txt

listen 80 default_server; server_name _; root /var/www/html; index index.html index.htm; location / { location = /nginx_status {

Monitor with stub_status

The stub_status endpoint is enabled at /nginx_status and is accessible from the instance itself:

curl -s http://127.0.0.1/nginx_status

Active connections: 1 server accepts handled requests 2 2 2 Reading: 0 Writing: 1 Waiting: 0

To expose it to a trusted monitoring server, add an allow directive inside the /nginx_status location block in /etc/nginx/conf.d/default.conf, then reload:

sudo nginx -t && sudo systemctl reload nginx

Enable the reverse-proxy starter

A documented reverse-proxy starter ships disabled at /etc/nginx/conf.d/sample.conf.disabled. To activate it, run:

sudo cp /etc/nginx/conf.d/sample.conf.disabled /etc/nginx/conf.d/sample.conf
sudo nano /etc/nginx/conf.d/sample.conf
# edit the upstream address
sudo nginx -t sudo systemctl reload nginx

The starter proxies requests to a backend, for example a Node.js app on port 3000. Edit the proxy_pass line to point to your backend.

Enable HTTPS with Let's Encrypt

1. Point your domain's A record to the instance's public IP address.
2. Install Certbot:

bash sudo apt-get install -y certbot python3-certbot-nginx

3. Obtain and install a certificate. Replace your-domain.com with your domain:

bash sudo certbot --nginx -d your-domain.com -d www.your-domain.com

4. Certbot edits your NGINX configuration and reloads the server automatically. Test auto-renewal:

bash sudo certbot renew --dry-run

Reloading vs restarting nginx

• Reload (zero downtime, preferred for configuration changes):

bash sudo nginx -t && sudo systemctl reload nginx

• Restart (needed after package upgrades):

bash sudo systemctl restart nginx

Support

SecureAnyCloud provides 24/7 technical support. Email sales@secureanycloud.com or use the AWS Marketplace support channel.

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com