# SystemD (Ubuntu 16.04+, CentOS 7+)
sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl reload nginx
sudo systemctl status nginx
sudo systemctl enable nginx
sudo systemctl disable nginx
 
# SysVinit (older systems)
sudo service nginx start
sudo service nginx stop
sudo service nginx restart
sudo service nginx reload
sudo service nginx status

nginx -t                    # Test configuration
nginx -T                    # Test and dump configuration
nginx -v                    # Show version
nginx -V                    # Show version and configure options

nginx -s stop               # Fast shutdown
nginx -s quit               # Graceful shutdown
nginx -s reload             # Reload configuration
nginx -s reopen             # Reopen log files

# /etc/nginx/nginx.conf
 
user www-data;
worker_processes auto;
pid /run/nginx.pid;
 
events {
    worker_connections 768;
}
 
http {
    # Basic Settings
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    
    # MIME types
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # Logging
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
    
    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml text/javascript 
               application/json application/javascript application/xml+rss;
    
    # Virtual Host Configs
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    
    root /var/www/example.com;
    index index.html index.htm;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;
    
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    
    root /var/www/example.com;
    index index.html;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

location / {
    root /var/www/html;
    index index.html index.htm;
    try_files $uri $uri/ =404;
}

location / {
    proxy_pass http://localhost:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_cache_bypass $http_upgrade;
}

location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
}

location ~ /\.ht {
    deny all;
}
 
location /admin {
    deny all;
    allow 192.168.1.0/24;
}

upstream backend {
    least_conn;  # or ip_hash, or round-robin (default)
    server backend1.example.com weight=3;
    server backend2.example.com;
    server backend3.example.com backup;
}
 
server {
    location / {
        proxy_pass http://backend;
    }
}

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m 
                 max_size=10g inactive=60m use_temp_path=off;
 
server {
    location / {
        proxy_cache my_cache;
        proxy_cache_valid 200 60m;
        proxy_cache_valid 404 1m;
        proxy_cache_use_stale error timeout updating;
        add_header X-Cache-Status $upstream_cache_status;
        
        proxy_pass http://backend;
    }
}

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;
 
server {
    location /api/ {
        limit_req zone=mylimit burst=20 nodelay;
    }
}

log_format custom '$remote_addr - $remote_user [$time_local] '
                  '"$request" $status $body_bytes_sent '
                  '"$http_referer" "$http_user_agent"';
 
access_log /var/log/nginx/access.log custom;

map $status $loggable {
    ~^[23] 0;
    default 1;
}
 
access_log /var/log/nginx/access.log combined if=$loggable;

location / {
    try_files $uri $uri/ /index.php?$args;
}
 
location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
}

location / {
    proxy_pass http://localhost:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
}

location /ws {
    proxy_pass http://localhost:8080;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 86400;
}

tail -f /var/log/nginx/error.log
tail -f /var/log/nginx/access.log

nginx -t

# Permission denied
sudo chown -R www-data:www-data /var/www/html
 
# Port already in use
sudo lsof -i :80
sudo netstat -tulpn | grep :80
 
# SELinux issues (CentOS/RHEL)
sudo setsebool -P httpd_can_network_connect 1