Nextjs Nginx Config SSL

serve.sh

#!/bin/bash

# Configuration
NGINX_DIR="$PWD/nginx"
NGINX_CONF="${NGINX_DIR}/nginx.conf"
ENV_FILE=".env"

# Exit codes
EXIT_NO_NGINX=1
EXIT_INVALID_USAGE=2
EXIT_NO_ENV=3
EXIT_NO_MKCERT=4

# Check if nginx is installed
command -v nginx >/dev/null 2>&1 || {
    echo "Error: nginx is not installed" >&2
    exit $EXIT_NO_NGINX
}

nginx_version=$(nginx -v 2>&1 | grep -o '1\.[0-9]\+\.[0-9]\+')
manor_version=$(echo "$nginx_version" | cut -d '.' -f 2)

# Check if nginx version is 1.23 or higher
if [[ "$manor_version" -lt 23 ]]; then
    echo "Error: nginx version 1.23 or higher is required for HTTP/3 support" >&2
    exit $EXIT_NO_NGINX
fi

# Check for argument
[ $# -eq 0 ] && {
    echo "Usage: $0 {start|stop|reload|config|cert}" >&2
    exit $EXIT_INVALID_USAGE
}

[ -f "$ENV_FILE" ] || {
    echo "Error: $ENV_FILE not found" >&2
    exit $EXIT_NO_ENV
}
set -a; source "$ENV_FILE"; set +a

mkdir -p "$NGINX_DIR"

nginx_conf=`cat <<EOF
worker_processes auto;
error_log error.log warn;
pid nginx.pid;

events {
    worker_connections 1024;
}

http {
    types {
        text/html                                        html htm shtml;
        text/css                                         css;
        text/xml                                         xml;
        image/gif                                        gif;
        image/jpeg                                       jpeg jpg;
        application/javascript                           js;
        application/atom+xml                             atom;
        application/rss+xml                              rss;

        text/mathml                                      mml;
        text/plain                                       txt;
        text/vnd.sun.j2me.app-descriptor                 jad;
        text/vnd.wap.wml                                 wml;
        text/x-component                                 htc;

        image/avif                                       avif;
        image/png                                        png;
        image/svg+xml                                    svg svgz;
        image/tiff                                       tif tiff;
        image/vnd.wap.wbmp                               wbmp;
        image/webp                                       webp;
        image/x-icon                                     ico;
        image/x-jng                                      jng;
        image/x-ms-bmp                                   bmp;

        font/woff                                        woff;
        font/woff2                                       woff2;

        application/java-archive                         jar war ear;
        application/json                                 json;
        application/mac-binhex40                         hqx;
        application/msword                               doc;
        application/pdf                                  pdf;
        application/postscript                           ps eps ai;
        application/rtf                                  rtf;
        application/vnd.apple.mpegurl                    m3u8;
        application/vnd.google-earth.kml+xml             kml;
        application/vnd.google-earth.kmz                 kmz;
        application/vnd.ms-excel                         xls;
        application/vnd.ms-fontobject                    eot;
        application/vnd.ms-powerpoint                    ppt;
        application/vnd.oasis.opendocument.graphics      odg;
        application/vnd.oasis.opendocument.presentation  odp;
        application/vnd.oasis.opendocument.spreadsheet   ods;
        application/vnd.oasis.opendocument.text          odt;
        application/vnd.openxmlformats-officedocument.presentationml.presentation
                                                        pptx;
        application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
                                                        xlsx;
        application/vnd.openxmlformats-officedocument.wordprocessingml.document
                                                        docx;
        application/vnd.wap.wmlc                         wmlc;
        application/wasm                                 wasm;
        application/x-7z-compressed                      7z;
        application/x-cocoa                              cco;
        application/x-java-archive-diff                  jardiff;
        application/x-java-jnlp-file                     jnlp;
        application/x-makeself                           run;
        application/x-perl                               pl pm;
        application/x-pilot                              prc pdb;
        application/x-rar-compressed                     rar;
        application/x-redhat-package-manager             rpm;
        application/x-sea                                sea;
        application/x-shockwave-flash                    swf;
        application/x-stuffit                            sit;
        application/x-tcl                                tcl tk;
        application/x-x509-ca-cert                       der pem crt;
        application/x-xpinstall                          xpi;
        application/xhtml+xml                            xhtml;
        application/xspf+xml                             xspf;
        application/zip                                  zip;

        application/octet-stream                         bin exe dll;
        application/octet-stream                         deb;
        application/octet-stream                         dmg;
        application/octet-stream                         iso img;
        application/octet-stream                         msi msp msm;

        audio/midi                                       mid midi kar;
        audio/mpeg                                       mp3;
        audio/ogg                                        ogg;
        audio/x-m4a                                      m4a;
        audio/x-realaudio                                ra;

        video/3gpp                                       3gpp 3gp;
        video/mp2t                                       ts;
        video/mp4                                        mp4;
        video/mpeg                                       mpeg mpg;
        video/quicktime                                  mov;
        video/webm                                       webm;
        video/x-flv                                      flv;
        video/x-m4v                                      m4v;
        video/x-mng                                      mng;
        video/x-ms-asf                                   asx asf;
        video/x-ms-wmv                                   wmv;
        video/x-msvideo                                  avi;
    }

    default_type application/octet-stream;

    log_format main '\\$remote_addr - \\$remote_user [\\$time_local] "\\$request" '
                    '\\$status \\$body_bytes_sent "\\$http_referer" '
                    '"\\$http_user_agent" "\\$http_x_forwarded_for"';

    access_log access.log main;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
    gzip_min_length 256;
    gzip_comp_level 6;

    server {
        listen 80;
        listen [::]:80;
        server_name *.${NEXT_PUBLIC_ROOT_DOMAIN} ${NEXT_PUBLIC_ROOT_DOMAIN};

        location / {
            return 301 https://\\$host\\$request_uri;
        }
    }

    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        listen 443 quic reuseport;
        listen [::]:443 quic reuseport;
        server_name *.${NEXT_PUBLIC_ROOT_DOMAIN} ${NEXT_PUBLIC_ROOT_DOMAIN};

        ssl_certificate cert.pem;
        ssl_certificate_key key.pem;

        # HTTP/3 specific settings
        http3 on;
        quic_gso on; # Enable Generic Segmentation Offload for QUIC
        ssl_early_data on; # Enable 0-RTT for QUIC
        add_header Alt-Svc 'h3=":443"; ma=86400'; # Advertise HTTP/3 support

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header Referrer-Policy "strict-origin-when-cross-origin";

        location /_next/ {
            alias ${PWD}/.next/;
            expires 365d;
            add_header Cache-Control "public, immutable";
            access_log off;
            try_files \\$uri @next;
        }

        # Serve other static files (e.g., from public directory)
        location /static/ {
            alias ${PWD}/public/;
            expires 365d;
            add_header Cache-Control "public, no-transform";
            access_log off;
            try_files \\$uri @next;
        }

        # Reverse proxy for Next.js app for dynamic content
        location @next {
            proxy_pass http://127.0.0.1:3000;
            proxy_http_version 1.1;
            proxy_set_header Upgrade \\$http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host \\$host;
            proxy_set_header X-Real-IP \\$remote_addr;
            proxy_set_header X-Forwarded-For \\$proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto \\$scheme;
            proxy_set_header X-Forwarded-Host \\$host;
            proxy_set_header X-Forwarded-Port \\$server_port;
        }

        # Fallback for all other requests
        location / {
            try_files \\$uri @next;
        }
    }
}
EOF
`

# Nginx command wrapper
run_nginx() {
    nginx -p "$NGINX_DIR" -c "nginx.conf" "$@"
}

case "$1" in
    start)
        echo "Stopping existing nginx process..."
        run_nginx -s quit
        sleep 1
  
        echo "Starting nginx..."
        run_nginx
        ;;
    stop)
        echo "Stopping nginx..."
        run_nginx -s stop
        ;;
    reload)
        echo "Reloading nginx..."
        run_nginx -s reload
        ;;
    config)
        echo "Checking nginx configuration..."
        echo "$nginx_conf" > "$NGINX_CONF"
        echo "Configuration file created: $NGINX_CONF"
        run_nginx -t
        ;;
    cert)
        command -v mkcert >/dev/null 2>&1 || {
            echo "Error: mkcert is not installed" >&2
            exit $EXIT_NO_MKCERT
        }
        echo "Generating certificates..."
        mkcert -key-file "${NGINX_DIR}/key.pem" -cert-file "${NGINX_DIR}/cert.pem" \
            "*.${NEXT_PUBLIC_ROOT_DOMAIN}" "${NEXT_PUBLIC_ROOT_DOMAIN}" localhost
        ;;    
    *)
        echo "Usage: $0 {start|stop|reload|config|cert}" >&2
        echo "start: Start the nginx server"
        echo "stop: Stop the nginx server"
        echo "reload: Reload the nginx server configuration"
        echo "config: Check the nginx configuration"
        echo "cert: Generate SSL certificates using mkcert"
        echo "Flow: cert > config > start"

        exit $EXIT_INVALID_USAGE
        ;;
esac