How to Install Nginx Web Server on FreeBSD 14.0

Introduction

Nginx web server is a high-performance web server application that delivers static web applications and also acts as a reverse proxy or load balancer to process connections to backend services on a server. Nginx is commonly used with high-traffic web applications and works with dynamic processors such as PHP to deliver dynamic applications on your server.

This article explains how to install the Nginx web server on FreeBSD 14.0 and deliver sample web applications on your server.

Prerequisites

Before you begin:

• Deploy a FreeBSD 14.0 server on Vultr.
• Create a new DNS A record pointing to your server IP. For example, app.example.com.
• Access the server using SSH.
• Create a non-root user with sudo privileges and switch to the user.

Install Nginx

Nginx is available in the default FreeBSD package repositories and you can install a specific version from source code or ports collections on your server. Follow the steps below to install the Nginx web server package using the default pkg package manager.

1. Update the FreeBSD server package catalog.

   CONSOLE

   Copy

   $ sudo pkg update

   Explain Code

   Powered by Vultr AgentBeta

2. Install the Nginx web server package.

   CONSOLE

   Copy

   $ sudo pkg install -y nginx

   Explain Code

   Powered by Vultr AgentBeta

3. Verify the Nginx version installed on your server.

   CONSOLE

   Copy

   $ sudo nginx -v

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   nginx version: nginx/1.24.0

4. Test the default Nginx configurations for errors.

   CONSOLE

   Copy

   $ sudo nginx -t

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
   nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful

Manage the Nginx System Service

1. Enable the Nginx web server to automatically start at system boot.

   CONSOLE

   Copy

   $ sudo sysrc nginx_enable=yes

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   nginx_enable:  -> yes

2. Start the Nginx web server.

   CONSOLE

   Copy

   $ sudo service nginx start

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   Performing sanity check on nginx configuration:
   nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
   nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful
   Starting nginx.

3. View the Nginx service status and verify that it's running.

   CONSOLE

   Copy

   $ sudo service nginx status

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   nginx is running as pid 1350.

4. Stop the Nginx web server.

   CONSOLE

   Copy

   $ sudo service nginx stop

   Explain Code

   Powered by Vultr AgentBeta

5. Restart the Nginx web server.

   CONSOLE

   Copy

   $ sudo service nginx restart

   Explain Code

   Powered by Vultr AgentBeta

6. Access your FreeBSD server IP address in a web browser such as Chrome to verify that the default Nginx virtual host profile is running on your server.

   http://SERVER-IP

   

Create a New Nginx Virtual Host

Nginx uses the /usr/local/etc/nginx directory to store web server configuration files. The sites-available and conf.d directories are not available by default, but you can modify the nginx.conf file to create new virtual hosts. In the following steps, create a new virtual host files directory and set up a new Nginx virtual host configuration to serve web applications using a domain name on your server.

1. Switch to the Nginx configuration files directory /usr/local/etc/nginx.

   CONSOLE

   Copy

   $ cd /usr/local/etc/nginx/

   Explain Code

   Powered by Vultr AgentBeta

2. Create a new directory to store your virtual host configurations. For example, conf.d.

   CONSOLE

   Copy

   $ sudo mkdir -p conf.d/

   Explain Code

   Powered by Vultr AgentBeta

3. Open the main Nginx configuration nginx.conf using a text editor such as Easy Editor ee.

   CONSOLE

   Copy

   $ sudo ee nginx.conf

   Explain Code

   Powered by Vultr AgentBeta

4. Add the following include directive at the end of the file before the closing } tag.

   INI

   Copy

   include /etc/nginx/conf.d/*.conf;

   Explain Code

   Powered by Vultr AgentBeta

   Press Esc + Enter to save the file and close the ee text editor.

   Within the above configuration, the include directive enables Nginx to access virtual host configurations in your specified directory /usr/local/etc/nginx/conf.d. Storing the virtual host configurations separately allows you to troubleshoot the web server in case of errors.

5. Test the Nginx configuration for errors.

   CONSOLE

   Copy

   $ sudo nginx -t

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
   nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful

6. Restart Nginx to apply the new configuration changes.

   CONSOLE

   Copy

   $ sudo service nginx restart

   Explain Code

   Powered by Vultr AgentBeta

7. Switch to your Nginx virtual host configurations directory.

   CONSOLE

   Copy

   $ cd /usr/local/etc/nginx/conf.d/

   Explain Code

   Powered by Vultr AgentBeta

8. Create a new virtual host configuration such as app.example.com.conf to serve a new web application on your server.

   CONSOLE

   Copy

   $ sudo ee app.example.com.conf

   Explain Code

   Powered by Vultr AgentBeta

9. Add the following configurations to the file. Replace app.example.com with your actual domain.

   NGINX

   Copy

   server {
       listen       80;
       server_name  app.example.com;
   
       root   /usr/local/www/app.example.com/;
       index  index.html index.htm;
   
       location / {
           try_files $uri $uri/ =404;
       }
   
   # Deny access to .htaccess if available
   
       location ~ /\.ht {
          deny  all;
       }
   }

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

10. Create a new webroot directory to store your web application files. For example, /usr/local/www/app.example.com.

    CONSOLE

    Copy

    $ sudo mkdir -p /usr/local/www/app.example.com/

    Explain Code

    Powered by Vultr AgentBeta

11. Create a new HTML web application file index.html in your webroot directory.

    CONSOLE

    Copy

    $ sudo ee /usr/local/www/app.example.com/index.html

    Explain Code

    Powered by Vultr AgentBeta

12. Add the following HTML code to the file that outputs the heading Greetings from Vultr.

    HTML

    Copy

    <html>
        <head>
            <title>Greetings from Vultr!</title>
        </head>
        <body>
    <br>
    <br>
            <h1 align="center">Hello World! Greetings from Vultr!</h1>
        </body>
    </html>

    Explain Code

    Powered by Vultr AgentBeta

    Save and close the file.

13. Verify the active Nginx user profile on your server to grant permission to your web application files.

    CONSOLE

    Copy

    $ ps aux | grep nginx

    Explain Code

    Powered by Vultr AgentBeta

    Output:

    root   2930   0.0  0.5 20724  9572  -  Is   01:00      0:00.00 nginx: master p
    www    2931   0.0  0.5 20724 10044  -  I    01:00      0:00.05 nginx: worker p
    root  12876   0.0  0.0   432   264  0  R+   22:26      0:00.00 grep nginx

    Based on the above output, Nginx worker process runs with the www user on your server.

14. Grant the Nginx user www full privileges on your webroot directory.

    CONSOLE

    Copy

    $ sudo chown -R www: /usr/local/www/app.example.com/

    Explain Code

    Powered by Vultr AgentBeta

15. Restart Nginx to apply your virtual host configuration changes.

    CONSOLE

    Copy

    $ sudo service nginx restart

    Explain Code

    Powered by Vultr AgentBeta

    Output:

    Performing sanity check on nginx configuration:
    nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
    nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful
    Stopping nginx.
    Performing sanity check on nginx configuration:
    nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
    nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful
    Starting nginx.

Secure the Nginx Web Server

The Nginx web server accepts connections from any service or client on the Internet by default. Enable the FreeBSD Packet Filter (pf) firewall to block requests to unpermitted ports on your server. Then, generate trusted SSL certificates to encrypt connection requests to the Nginx web server using HTTPS. Follow the sections below to secure the server using the pf firewall and secure the Nginx web server with trusted Let's Encrypt SSL certificates.

Set Up Firewall Rules

1. Enable the Packet Filter firewall to start at boot time.

   CONSOLE

   Copy

   $ sudo sysrc pf_enable=yes

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   pf_enable: NO -> yes

2. View your FreeBSD server interfaces and note the main public interface name.

   CONSOLE

   Copy

   $ ifconfig

   Explain Code

   Powered by Vultr AgentBeta

   Your output should be similar to the one below.

   vtnet0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
           options=4c07bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,VLAN_HWTSO,LINKSTATE,TXCSUM_IPV6>
           ether 56:00:00:fa:ae:e9
           inet 10.10.10.1 netmask 0xfffffe00 broadcast 10.10.10.255
           media: Ethernet autoselect (10Gbase-T <full-duplex>)
           status: active
           nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
   lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 16384
           options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
           inet 127.0.0.1 netmask 0xff000000
           inet6 ::1 prefixlen 128
           inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
           groups: lo
           nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

   vtnet0 is the main FreeBSD server network interface based on the example public IP address 10.10.10.1 associated with the server.

3. Create a new firewall configuration file pf.conf.

   CONSOLE

   Copy

   $ sudo touch /etc/pf.conf

   Explain Code

   Powered by Vultr AgentBeta

4. Open the pf.conf firewall configuration file.

   CONSOLE

   Copy

   $ sudo ee /etc/pf.conf

   Explain Code

   Powered by Vultr AgentBeta

5. Add the following firewall rules to the file. Replace vtnet0 with your actual public network interface name.

   INI

   Copy

   # Set the public Vultr Server Interface
   ext_if = "vtnet0" 
   
   # Allow Network ports
   allowed_ports = "{ 22, 80, 443 }"
   
   # Block non-permitted traffic
   block all
   
   # Allow internal traffic
   set skip on lo
   
   # Allow incoming traffic
   pass in on $ext_if proto tcp to port $allowed_ports
   
   # Allow outgoing traffic
   pass out on $ext_if from any to any keep state

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

   In the above configuration, network connection requests to the HTTP port 80, HTTPS port 443, and the SSH port 22 are allowed through the firewall. As a result, the Nginx web server can deliver web applications on your server using HTTP and HTTPS.

6. Test your firewall configuration for errors.

   CONSOLE

   Copy

   $ sudo pfctl -vnf /etc/pf.conf

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   ext_if = "vtnet0"
   allowed_ports = "{ 22, 80, 443 }"
   set skip on { lo }
   block drop all
   pass in on vtnet0 proto tcp from any to any port = ssh flags S/SA keep state
   pass in on vtnet0 proto tcp from any to any port = http flags S/SA keep state
   pass in on vtnet0 proto tcp from any to any port = https flags S/SA keep state
   pass out on vtnet0 all flags S/SA keep state

7. Enable the firewall to use your /etc/pf.conf configuration.

   CONSOLE

   Copy

   sudo pfctl -f /etc/pf.conf

   Explain Code

   Powered by Vultr AgentBeta

8. Start the Packet Filter firewall.

   CONSOLE

   Copy

   $ sudo pfctl -e

   Explain Code

   Powered by Vultr AgentBeta

9. View all active firewall rules on your server and verify that your new connection rules are available.

   CONSOLE

   Copy

   $ sudo pfctl -sr

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   block drop all
   pass in on vtnet0 proto tcp from any to any port = ssh flags S/SA keep state
   pass in on vtnet0 proto tcp from any to any port = http flags S/SA keep state
   pass in on vtnet0 proto tcp from any to any port = https flags S/SA keep state
   pass out on vtnet0 all flags S/SA keep state

Generate Let’s Encrypt SSL Certificates

1. Install the Certbot package for Nginx on your server.

   CONSOLE

   Copy

   $ sudo pkg install security/py-certbot-nginx

   Explain Code

   Powered by Vultr AgentBeta

2. Generate a new Let’s Encrypt SSL certificate using your domain name. Replace app.example.com with your actual domain and user@example.com with your email.

   CONSOLE

   Copy

   $ sudo certbot --nginx --domain app.example.com --email user@example.com --agree-tos

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   Deploying certificate
   Successfully deployed certificate for app.example.com to /usr/local/etc/nginx/conf.d/app.example.com.conf
   Congratulations! You have successfully enabled HTTPS on https://app.example.com

3. Verify that Certbot autorenews your SSL certificate upon expiry.

   CONSOLE

   Copy

   $ sudo certbot renew --dry-run

   Explain Code

   Powered by Vultr AgentBeta

4. Restart Nginx to apply your SSL configuration changes.

   CONSOLE

   Copy

   $ sudo service nginx restart

   Explain Code

   Powered by Vultr AgentBeta

5. Open your domain name in a new web browser window and verify that Nginx securely serves your virtual host web application files using HTTPS.

   https://app.example.com

   

Conclusion

You have installed the Nginx web server on FreeBSD 14.0. Nginx is a high-performance application you can configure to securely deliver or load balance between multiple backend services on your server. For more information and configuration options, visit the Nginx documentation.