server
listen 80;
location /
expires 30d;
add_header Pragma public;
add_header Cache-Control "public";
When NGINX can’t match a virtual host to a requested domain name it serves the first server-block registered in the system. This results in all unconfigured domain names serving the same website, which negatively affects SEO.
To serve a site for all unconfigured domain names, use the default_server property to serve a placeholder page. Don’t forget to set it on both HTTP:80 and HTTPS:443.
Create a file in /etc/nginx/sites-enabled/ and paste this config to serve a static html page stored at /var/www. Don’t forget to adjust the reference to the SSL key and crt.
Don’t forget to restart the nginx server afterwards (Debian):
service nginx restart
Sample fallback config file
server {
listen 80 default_server;
root /var/www;
index index.html index.htm;
# Make site accessible from http://localhost/
server_name localhost;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ /index.html;
# Uncomment to enable naxsi on this location
# include /etc/nginx/naxsi.rules
}
}
# HTTPS server
#
server {
listen 443 default_server;
server_name localhost;
root /var/www;
index index.html index.htm;
ssl on;
ssl_certificate /etc/nginx/fallback.crt;
ssl_certificate_key /etc/nginx/fallback.key;
#enables all versions of TLS, but not SSLv2 or 3 which are weak and now deprecated.
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
#Disables all weak ciphers
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_prefer_server_ciphers on;
location / {
try_files $uri $uri/ =404;
}
}
PiWik can lookup your site visitor’s IPs to geolocate them. But if you’re running PiWik as an LXC container and forward traffic with Apache or Nginx to the container, PiWik thinks you’re coming from the IP the last network interface, eg. 10.0.0.2 or your server’s public facing IP.
I assume that the container runs Debian and you’re running PiWik with Apache.
1. Make sure you forward the original remote IP as HTTP headers to your Piwik install.
If you use NGINX as a proxy, you’d do it as follows:
proxy_set_header X-Real- $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
2. Configure Piwik to use the remote HTTP headers instead of normal ones:
nano /var/www/html/config/config.ini.php
and add these three lines below the [General] settings:
; Uncomment line below if you use a standard proxy
proxy_client_headers[] = HTTP_X_FORWARDED_FOR
proxy_host_headers[] = HTTP_X_FORWARDED_HOST
You may also need to enable the Apache RPAF module.
apt-get install libapache2-mod-rpaf
nano /etc/apache2/mods-enabled/rpaf.conf
Change RPAFproxy_ips setting to include your bridge network’s IP, or public IP depending on your set up, eg. 10.0.0.2
service apache2 restart
Check your PiWik and see visitor’s IPs. PiWik can automatically anonymize IP adresses to retain privacy.
