Nginx - Revision history

Vincent: /* snippets */

2018-08-12T13:27:20Z

snippets

← Older revision		Revision as of 13:27, 12 August 2018
Line 160:		Line 160:
	* <code>/etc/nging/conf.d/acme-challenge.conf</code><br />See [[Let’s Encrypt]]		* <code>/etc/nging/conf.d/acme-challenge.conf</code><br />See [[Let’s Encrypt]]
	* <code>/etc/nging/conf.d/hsts.conf</code><syntaxhighlight lang="nginx">		* <code>/etc/nging/conf.d/hsts.conf</code><syntaxhighlight lang="nginx">
			# The standard add_header from Nginx has two issues:
			# - it will result in duplicate headers if the proxied content set it as well
			# - if a subblock uses add_header as well, parent block headers are ignored
			# Using more_set_headers fixes both issues

			# WARNING
			# Make sure you have HTTPS correctly setup before including this file.
			# Failing to do so will render your site inaccessible.

	# Activate HTTP Strict Transport Security		# Activate HTTP Strict Transport Security
	# max-age value is in seconds. ~~31536000~~ is ~~1 year~~		# max-age value is in seconds. 63072000 is 2 years
			more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";

	~~add_header~~ Strict-Transport-Security max-age=~~31536000 always~~;		# If subdomains are still using insecure HTTP, remove the includeSubDomains:
			# more_set_headers "Strict-Transport-Security: max-age=63072000";
	</syntaxhighlight>		</syntaxhighlight>
	* <code>/etc/nginx/snippets/security-headers.conf</code><syntaxhighlight lang="nginx">		* <code>/etc/nginx/snippets/security-headers.conf</code><syntaxhighlight lang="nginx">
	# Some safe security headers that can almost be used ~~for any site~~		# Some safe security headers that can almost always be used

			# The standard add_header from Nginx has two issues:
			# - it will result in duplicate headers if the proxied content set it as well
			# - if a subblock uses add_header as well, parent block headers are ignored
			# Using more_set_headers fixes both issues

	# https://~~stackoverflow~~.~~com~~/a/~~24998106~~/~~1631174~~		# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
	~~add_header~~ X-XSS-Protection "1; mode=block" ~~always~~;		more_set_headers "X-XSS-Protection: 1; mode=block";
	# https://~~www~~.~~owasp~~.org/~~index.php~~/~~OWASP_Secure_Headers_Project#~~X-Content-Type-Options		# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
	~~add_header~~ X-Content-Type-Options nosniff ~~always~~;		more_set_headers "X-Content-Type-Options: nosniff";
	# Prevent access from flash and PDF		# Prevent access from flash and PDF
	~~add_header~~ X-Permitted-Cross-Domain-Policies none ~~always~~;		more_set_headers "X-Permitted-Cross-Domain-Policies: none";
			# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
			more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";

	</syntaxhighlight>		</syntaxhighlight>
	* <code>/etc/nginx/snippets/x-frame-options-deny.conf</code><br /><code>/etc/nginx/snippets/x-frame-options-sameorigin.conf</code><syntaxhighlight lang="nginx">		* <code>/etc/nginx/snippets/x-frame-options-deny.conf</code><br /><code>/etc/nginx/snippets/x-frame-options-sameorigin.conf</code><syntaxhighlight lang="nginx">
			# The standard add_header from Nginx has two issues:
			# - it will result in duplicate headers if the proxied content set it as well
			# - if a subblock uses add_header as well, parent block headers are ignored
			# Using more_set_headers fixes both issues

	# Prevent all usages of the website in an iframe.		# Prevent all usages of the website in an iframe.
	# Warning: This might break the site if it uses iframes for internal		# Warning: This might break the site if it uses iframes for internal
	# functionalities. You might want to use the less strict		# functionalities. You might want to use the less strict
	# x-frame-options-sameorigin.conf in that case.		# x-frame-options-sameorigin.conf in that case.
			more_set_headers "X-Frame-Options: DENY";

	~~add_header X-Frame-Options DENY always;~~
	</syntaxhighlight><syntaxhighlight lang="nginx">		</syntaxhighlight><syntaxhighlight lang="nginx">
			# The standard add_header from Nginx has two issues:
			# - it will result in duplicate headers if the proxied content set it as well
			# - if a subblock uses add_header as well, parent block headers are ignored
			# Using more_set_headers fixes both issues

	# Prevent usage of the website in an iframe from other domains.		# Prevent usage of the website in an iframe from other domains.
	# Warning: This ~~might break the site if it uses iframes for internal~~		# Warning: This will still allow iframe on your own domain.
	# ~~functionalities. You might want to~~ use ~~the less strict~~		# For a more strict policy, use x-frame-options-deny.conf
	# x-frame-options-~~sameorigin~~.conf ~~in that case.~~		more_set_headers "X-Frame-Options: SAMEORIGIN";

	~~add_header~~ X-Frame-Options SAMEORIGIN ~~always~~;
	</syntaxhighlight>		</syntaxhighlight>
	* <code>/etc/nginx/snippets/https-permanent-redirect.conf</code><syntaxhighlight lang="nginx">		* <code>/etc/nginx/snippets/https-permanent-redirect.conf</code><syntaxhighlight lang="nginx">
Line 207:		Line 234:
	ssl on;		ssl on;
	ssl_stapling on;		ssl_stapling on;

			# The standard add_header from Nginx has two issues:
			# - it will result in duplicate headers if the proxied content set it as well
			# - if a subblock uses add_header as well, parent block headers are ignored
			# Using more_set_headers fixes both issues

			more_set_headers 'Expect-CT: max-age=86400';
	</syntaxhighlight>		</syntaxhighlight>

Vincent: Update gzip mime types

2018-08-12T13:10:17Z

Update gzip mime types

@@ Line 86: / Line 86: @@
 gzip_proxied any;
-gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
+gzip_min_length 500;
 </syntaxhighlight>
 * <code>/etc/nginx/conf.d/php.conf</code><br />See documentation to [[PHP|install PHP]].

Vincent: Update Debian version

2017-07-01T18:59:01Z

Update Debian version

← Older revision		Revision as of 18:59, 1 July 2017
Line 2:		Line 2:

	== Prerequisite ==		== Prerequisite ==
	This guide ~~was tested on~~ Debian ~~Jessie (stable), and~~ Stretch ~~(testing)~~. ~~For other~~ distributions ~~you might have some adjustments to do~~.		This guide is written for Debian Stretch. Other Debian based distributions should work as well.

	While not mandatory, the guide makes use of the following programs to enhance the security of the installation		While not mandatory, the guide makes use of the following programs to enhance the security of the installation
Line 11:		Line 11:

	=== Nginx ===		=== Nginx ===

	~~==== Jessie ====~~
	The version of nginx in Debian Jessie support the deprecated [https://en.wikipedia.org/wiki/SPDY SPDY] protocol. Using the version from jessie-backports allows to get support for [https://en.wikipedia.org/wiki/HTTP/2 HTTP/2].
	~~<syntaxhighlight lang="console">~~
	~~$ sudo apt install nginx-light/jessie-backports libnginx-mod-http-headers-more-filter~~
	~~</syntaxhighlight>~~

	~~==== Stretch ====~~
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	$ sudo apt install nginx-light libnginx-mod-http-headers-more-filter		$ sudo apt install nginx-light libnginx-mod-http-headers-more-filter

Vincent: Update TLS config

2017-07-01T16:29:53Z

Update TLS config

@@ Line 33: / Line 33: @@
 == Configure ==
 === conf.d ===
@@ Line 46: / Line 84: @@
 </syntaxhighlight>
 * <code>/etc/nginx/conf.d/gzip.conf</code><syntaxhighlight lang="nginx">
 # Insert header "Vary: Accept-Encoding" in responses
 # https://www.maxcdn.com/blog/accept-encoding-its-vary-important/
@@ Line 56: / Line 96: @@
 gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
 </syntaxhighlight>
-* <code>/etc/nginx/conf.d/php*.conf</code><br />See documentation to [[PHP|install PHP]].
+* <code>/etc/nginx/conf.d/php.conf</code><br />See documentation to [[PHP|install PHP]].
 * <code>/etc/nginx/conf.d/server_tokens.conf</code><syntaxhighlight lang="nginx">
 # Hide nginx version
@@ Line 65: / Line 105: @@
 * <code>/etc/nginx/conf.d/ssl.conf</code><syntaxhighlight lang="nginx">
-# These two settings are now included by default in nginx.conf
+ssl_protocols TLSv1.2;
-#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_prefer_server_ciphers on;
-ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!CAMELLIA:!SEED";
+# Cipher list from https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
-# Parameters for Diffie-Hellman handshake
+# If you have a version of openssl < 1.1.0, you need to remove X25519 from the list
-# Generate the file with the command:
+ssl_ecdh_curve X25519:secp256k1:secp384r1;
 # Support OSCP Stapling. Check that resolver from in dns.conf is working
@@ Line 82: / Line 120: @@
 # Support SSL session cache
 ssl_session_cache shared:NginxCache:50m;
 ssl_session_tickets off; # https://timtaubert.de/blog/2014/11/the-sad-state-of-server-side-tls-session-resumption-implementations/
 </syntaxhighlight>

Vincent: new plugin based version

2017-02-25T16:14:10Z

new plugin based version

← Older revision		Revision as of 16:14, 25 February 2017
Line 15:		Line 15:
	The version of nginx in Debian Jessie support the deprecated [https://en.wikipedia.org/wiki/SPDY SPDY] protocol. Using the version from jessie-backports allows to get support for [https://en.wikipedia.org/wiki/HTTP/2 HTTP/2].		The version of nginx in Debian Jessie support the deprecated [https://en.wikipedia.org/wiki/SPDY SPDY] protocol. Using the version from jessie-backports allows to get support for [https://en.wikipedia.org/wiki/HTTP/2 HTTP/2].
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	$ sudo apt install nginx-~~extras~~/jessie-backports		$ sudo apt install nginx-light/jessie-backports libnginx-mod-http-headers-more-filter
	</syntaxhighlight>		</syntaxhighlight>

	==== Stretch ====		==== Stretch ====
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	$ sudo apt install nginx-~~extras~~		$ sudo apt install nginx-light libnginx-mod-http-headers-more-filter
	</syntaxhighlight>		</syntaxhighlight>

Line 61:		Line 61:
	# This doesn't provides any real security but makes hackers life a bit more difficult		# This doesn't provides any real security but makes hackers life a bit more difficult
	server_tokens off;		server_tokens off;
			more_clear_headers Server;
	</syntaxhighlight>		</syntaxhighlight>

Line 84:		Line 85:
	ssl_session_tickets off; # https://timtaubert.de/blog/2014/11/the-sad-state-of-server-side-tls-session-resumption-implementations/		ssl_session_tickets off; # https://timtaubert.de/blog/2014/11/the-sad-state-of-server-side-tls-session-resumption-implementations/
	</syntaxhighlight>Generate file <code>/etc/nginx/dh2048.pem</code> with<syntaxhighlight lang="console">		</syntaxhighlight>Generate file <code>/etc/nginx/dh2048.pem</code> with<syntaxhighlight lang="console">
	# openssl dhparam 2048 -out /etc/nginx/dh2048.pem		$ sudo openssl dhparam 2048 -out /etc/nginx/dh2048.pem
	</syntaxhighlight>		</syntaxhighlight>

Vincent: sudo

2017-02-23T06:01:10Z

sudo

← Older revision		Revision as of 06:01, 23 February 2017
Line 15:		Line 15:
	The version of nginx in Debian Jessie support the deprecated [https://en.wikipedia.org/wiki/SPDY SPDY] protocol. Using the version from jessie-backports allows to get support for [https://en.wikipedia.org/wiki/HTTP/2 HTTP/2].		The version of nginx in Debian Jessie support the deprecated [https://en.wikipedia.org/wiki/SPDY SPDY] protocol. Using the version from jessie-backports allows to get support for [https://en.wikipedia.org/wiki/HTTP/2 HTTP/2].
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install nginx-extras/jessie-backports		$ sudo apt install nginx-extras/jessie-backports
	</syntaxhighlight>		</syntaxhighlight>

	==== Stretch ====		==== Stretch ====
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install nginx-extras		$ sudo apt install nginx-extras
	</syntaxhighlight>		</syntaxhighlight>

	=== nginx_modsite ===		=== nginx_modsite ===
	nginx_modsite is a script that allows to activate or deactivate a site simply, without having to handle symlinks manually. In Debian, it is distributed in source form as part of the <code>nginx-doc</code> package. The easiest is to download it directly from [https://anonscm.debian.org/cgit/collab-maint/nginx.git/tree/debian/help/examples/nginx_modsite the source repository]:<syntaxhighlight lang="console">		nginx_modsite is a script that allows to activate or deactivate a site simply, without having to handle symlinks manually. In Debian, it is distributed in source form as part of the <code>nginx-doc</code> package. The easiest is to download it directly from [https://anonscm.debian.org/cgit/collab-maint/nginx.git/tree/debian/help/examples/nginx_modsite the source repository]:<syntaxhighlight lang="console">
	# curl "https://anonscm.debian.org/cgit/collab-maint/nginx.git/plain/debian/help/examples/nginx_modsite" ~~> /usr/local/sbin/nginx_modsite~~		$ sudo curl -o /usr/local/sbin/nginx_modsite "https://anonscm.debian.org/cgit/collab-maint/nginx.git/plain/debian/help/examples/nginx_modsite"
	% Total % Received % Xferd Average Speed Time Time Time Current		% Total % Received % Xferd Average Speed Time Time Time Current
	Dload Upload Total Spent Left Speed		Dload Upload Total Spent Left Speed
	100 4625 100 4625 0 0 12836 0 --:--:-- --:--:-- --:--:-- 12847		100 4625 100 4625 0 0 12836 0 --:--:-- --:--:-- --:--:-- 12847
	# chmod +x /usr/local/sbin/nginx_modsite		$ sudo chmod +x /usr/local/sbin/nginx_modsite
	</syntaxhighlight>		</syntaxhighlight>

Line 106:		Line 106:
	add_header X-Permitted-Cross-Domain-Policies none always;		add_header X-Permitted-Cross-Domain-Policies none always;
	</syntaxhighlight>		</syntaxhighlight>
	* <code>/etc/nginx/snippets/x-frame-options-deny.conf</code><br/><code>/etc/nginx/snippets/x-frame-options-sameorigin.conf</code><syntaxhighlight lang="nginx">		* <code>/etc/nginx/snippets/x-frame-options-deny.conf</code><br /><code>/etc/nginx/snippets/x-frame-options-sameorigin.conf</code><syntaxhighlight lang="nginx">
	# Prevent all usages of the website in an iframe.		# Prevent all usages of the website in an iframe.
	# Warning: This might break the site if it uses iframes for internal		# Warning: This might break the site if it uses iframes for internal
Line 144:		Line 144:
	==== Install ====		==== Install ====
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install apache2-utils		$ sudo apt install apache2-utils
	</syntaxhighlight>		</syntaxhighlight>

Line 195:		Line 195:
	=== /var/www/ permissions ===		=== /var/www/ permissions ===
	Setting the [https://en.wikipedia.org/wiki/Setgid setgid] bit on the <code>/var/www/</code> allows to make sure that new files are readable by Nginx.<syntaxhighlight lang="console">		Setting the [https://en.wikipedia.org/wiki/Setgid setgid] bit on the <code>/var/www/</code> allows to make sure that new files are readable by Nginx.<syntaxhighlight lang="console">
	# chmod 2750 /var/www/		$ sudo chmod 2750 /var/www/
	# chown root:www-data /var/www/		$ sudo chown root:www-data /var/www/
	</syntaxhighlight>This also revoke the default read permission to user outside the <code>www-data</code> group. They don't need it and some data might b\not be public here.		</syntaxhighlight>This also revoke the default read permission to user outside the <code>www-data</code> group. They don't need it and some data might not be public here.

	== New Site ==		== New Site ==
Line 232:		Line 232:

	root /var/www/mysite.example.org;		root /var/www/mysite.example.org;
	} }}		<nowiki>}</nowiki>}}

	== Fail2Ban ==		== Fail2Ban ==

Vincent: Move htpasswd files to subfolder

2016-12-18T18:43:53Z

Move htpasswd files to subfolder

← Older revision		Revision as of 18:43, 18 December 2016
Line 141:		Line 141:

	=== HTTP Auth ===		=== HTTP Auth ===
			<span id="http-auth-anchor"></span>
	==== Install ====		==== Install ====
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
Line 148:		Line 148:

	==== Create Password File ====		==== Create Password File ====
			If the folder doesn't exist, you need to create it using
			<syntaxhighlight lang="console">
			$ sudo mkdir /etc/nginx/htpasswd
			$ sudo chmod 710 /etc/nginx/htpasswd
			$ sudo chown root:www-data /etc/nginx/htpasswd
			</syntaxhighlight>

			The create the user file
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# touch /etc/nginx/generic.htpasswd		$ sudo touch /etc/nginx/htpasswd/generic.htpasswd
	</syntaxhighlight>If you want different website to have different users, you can create as many password files as you want.		</syntaxhighlight>
			If you want different website to have different users, you can create as many password files as you want.

	==== Add User ====		==== Add User ====
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# htpasswd /etc/nginx/generic.htpasswd jdoe		$ sudo htpasswd /etc/nginx/htpasswd/generic.htpasswd jdoe
	New password:		New password:
	Re-type new password:		Re-type new password:
	Adding password for user jdoe		Adding password for user jdoe
	</syntaxhighlight>To update a password user, just run the same command.		</syntaxhighlight>
			To update a password user, just run the same command.

	Nginx will pick the modified file automatically. There is nothing to restart.		Nginx will pick the modified file automatically. There is nothing to restart.

	==== Use ====		==== Use ====
	To restrict access to a site or part of it, add the following lines to a <code>server</code> or <code>location</code> config<syntaxhighlight lang="nginx">		To restrict access to a site or part of it, add the following lines to a <code>server</code> or <code>location</code> config
			<syntaxhighlight lang="nginx">
	auth_basic "You shall not pass!";		auth_basic "You shall not pass!";
	auth_basic_user_file /etc/nginx/generic.htpasswd;		auth_basic_user_file /etc/nginx/htpasswd/generic.htpasswd;
	</syntaxhighlight>		</syntaxhighlight>

Vincent: Remove non-FS cipher

2016-12-01T08:02:15Z

Remove non-FS cipher

← Older revision		Revision as of 08:02, 1 December 2016
Line 68:		Line 68:
	#ssl_prefer_server_ciphers on;		#ssl_prefer_server_ciphers on;

	ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-~~AES256-SHA:~~AES256-SHA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!CAMELLIA:!SEED";		ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!CAMELLIA:!SEED";

	# Parameters for Diffie-Hellman handshake		# Parameters for Diffie-Hellman handshake

Vincent: /var/www/ permissions

2016-08-21T17:31:40Z

/var/www/ permissions

← Older revision		Revision as of 17:31, 21 August 2016
Line 181:		Line 181:
	proxy_set_header Proxy "";		proxy_set_header Proxy "";
	</syntaxhighlight>		</syntaxhighlight>

			=== /var/www/ permissions ===
			Setting the [https://en.wikipedia.org/wiki/Setgid setgid] bit on the <code>/var/www/</code> allows to make sure that new files are readable by Nginx.<syntaxhighlight lang="console">
			# chmod 2750 /var/www/
			# chown root:www-data /var/www/
			</syntaxhighlight>This also revoke the default read permission to user outside the <code>www-data</code> group. They don't need it and some data might b\not be public here.

	== New Site ==		== New Site ==

Vincent: Install nginx_modsite

2016-08-21T07:58:34Z

Install nginx_modsite

← Older revision		Revision as of 07:58, 21 August 2016
Line 10:		Line 10:
	== Install ==		== Install ==

	=== Jessie ===		=== Nginx ===

			==== Jessie ====
	The version of nginx in Debian Jessie support the deprecated [https://en.wikipedia.org/wiki/SPDY SPDY] protocol. Using the version from jessie-backports allows to get support for [https://en.wikipedia.org/wiki/HTTP/2 HTTP/2].		The version of nginx in Debian Jessie support the deprecated [https://en.wikipedia.org/wiki/SPDY SPDY] protocol. Using the version from jessie-backports allows to get support for [https://en.wikipedia.org/wiki/HTTP/2 HTTP/2].
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
Line 16:		Line 18:
	</syntaxhighlight>		</syntaxhighlight>

	=== Stretch ===		==== Stretch ====
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install nginx-extras		# apt install nginx-extras
			</syntaxhighlight>

			=== nginx_modsite ===
			nginx_modsite is a script that allows to activate or deactivate a site simply, without having to handle symlinks manually. In Debian, it is distributed in source form as part of the <code>nginx-doc</code> package. The easiest is to download it directly from [https://anonscm.debian.org/cgit/collab-maint/nginx.git/tree/debian/help/examples/nginx_modsite the source repository]:<syntaxhighlight lang="console">
			# curl "https://anonscm.debian.org/cgit/collab-maint/nginx.git/plain/debian/help/examples/nginx_modsite" > /usr/local/sbin/nginx_modsite
			% Total % Received % Xferd Average Speed Time Time Time Current
			Dload Upload Total Spent Left Speed
			100 4625 100 4625 0 0 12836 0 --:--:-- --:--:-- --:--:-- 12847
			# chmod +x /usr/local/sbin/nginx_modsite
	</syntaxhighlight>		</syntaxhighlight>