Installing Nginx on Raspberry Pi

I assume you started from my guide for hardened Raspberry Pi.

First steps

I like Nginx for the performances and the simple configuration file.

sudo apt update
sudo apt install nginx-light

Check the service is running.

systemctl status nginx
wget -O /dev/null http://127.0.0.1:80/

Add firewall rule to allow connection.

ufw allow 80/tcp
ufw allow 443/tcp

Self signed configuration

As the Deffie-Hellman generation is quite long on a Raspberry Pi, I generally download my dhparam.pem from the Public Deffie-Hellman Parameter Service.

curl https://2ton.com.au/getprimes/random/dhparam/4096 > dhparam.pem
sudo cp dhparam.pem /etc/nginx/
rm dhparam.pem

Let’s generate a self-signed certificate to get started.

openssl req -newkey rsa:2048 -nodes -keyout self-signed.key -x509 -days 3650 -out self-signed.pem
sudo cp self-signed.* /etc/nginx
sudo chmod g-rwx,o-rwx /etc/nginx/*.key
rm self-signed.*

Put your site configuration file in /etc/nginx/sites-available and enable it by setting a symbolic link in /etc/nginx/sites-enabled.

# Port 80/HTTP will redirect all traffic to 443/HTTPS
server {
        listen 80 default_server;
        listen [::]:80 default_server;

        server_name <website host>;
        server_tokens off;

        return 301 https://$host$request_uri;
}

# Main server on port 443/HTTPS
server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        server_name <website host>;
        server_tokens off;

        ssl_certificate         /etc/nginx/self-signed.pem;
        ssl_certificate_key     /etc/nginx/self-signed.key;
        ssl_trusted_certificate /etc/nginx/self-signed.pem;

        ssl_session_timeout 1d;
        ssl_session_cache shared:MozSSL:10m;
        ssl_session_tickets off;

        ssl_dhparam /etc/nginx/dhparam.pem;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256';
        ssl_prefer_server_ciphers on;

        ssl_stapling on;
        ssl_stapling_verify on;

        index index.php index.html index.htm;
        error_page 404             /404.html;
        error_page 500 502 503 504 /50x.html;

        root /var/www/html/<website folder>;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                try_files $uri $uri/ =404;

                # Security HTTP headers
                add_header Content-Security-Policy "default-src 'self'";
                add_header Permissions-Policy "camera=(),fullscreen=(),microphone=()";
                add_header Referrer-Policy "no-referrer";
                add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
                add_header X-Content-Type-Options "nosniff";
                add_header X-Frame-Options "sameorigin";
                add_header X-XSS-Protection "1; mode=block";
        }

}

When you are happy with your config, restart your Nginx server and check everything is ok.

sudo systemctl restart nginx
systemctl status nginx

The configuration file is mostly generated from Mozila SSL Config Generator.

I use the following sites to verify my SSL configuration: Qualys SSL Labs, Immuniweb SSL and cryptcheck.fr.

For the HTTP security, I check using Mozilla Observatory, Immuniweb WebSec and securityheaders.com.

Installing Let’s Encrypt

Let’s Encrypt certbot will generate valid certificate for you.

sudo apt install certbot python3-certbot-nginx

Running certbot.

sudo certbot --nginx

Test for a renewal

sudo certbot renew --dry-run

Edit /etc/crontab and add the following line for automatic renewal of the certificates.

0 0,12 * * * root sleep 1486 && certbot renew -q