# Ubuntu/Debian
sudo apt update
sudo apt install nginx -y

# CentOS/RHEL/Rocky
sudo dnf install nginx -y

# Start dan enable Nginx
sudo systemctl start nginx
sudo systemctl enable nginx

# Cek status
sudo systemctl status nginx

# Test apakah Nginx berjalan
curl http://localhost
# Atau buka http://server-ip di browser

# Cek versi dan modules
nginx -V

/etc/nginx/
├── nginx.conf              ← Konfigurasi utama
├── conf.d/                 ← Tambahan config (auto-include)
│   └── default.conf
├── sites-available/        ← Semua virtual host (Ubuntu)
│   ├── default
│   └── mysite.com
├── sites-enabled/          ← Symlink ke sites-available (aktif)
│   └── default → ../sites-available/default
├── snippets/               ← Config snippets yang reusable
│   ├── ssl-params.conf
│   └── fastcgi-php.conf
├── mime.types              ← Mapping MIME types
└── modules-enabled/        ← Dynamic modules

# /etc/nginx/nginx.conf

user www-data;
worker_processes auto;        # Auto = jumlah CPU core
pid /run/nginx.pid;
error_log /var/log/nginx/error.log warn;

events {
    worker_connections 2048;  # Max koneksi per worker
    multi_accept on;          # Terima koneksi baru sekaligus
    use epoll;                # Event method untuk Linux
}

http {
    # Basic settings
    sendfile on;              # Menggunakan sendfile() untuk efisiensi
    tcp_nopush on;            # Optimasi packet
    tcp_nodelay on;           # Kirim data segera
    keepalive_timeout 65;     # Timeout keep-alive connection
    types_hash_max_size 2048;
    server_tokens off;        # Sembunyikan versi Nginx

    # MIME types
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # Logging
    log_format main '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" '
                    'rt=$request_time';
    access_log /var/log/nginx/access.log main buffer=16k flush=5s;

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/json
        application/javascript
        application/xml
        image/svg+xml;

    # Include server blocks
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

# /etc/nginx/sites-available/mysite.com

# Redirect HTTP ke HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name mysite.com www.mysite.com;
    return 301 https://$host$request_uri;
}

# Server block utama (HTTPS)
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name mysite.com www.mysite.com;

    # Document root
    root /var/www/mysite.com/public;
    index index.html index.htm;

    # SSL certificate
    ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem;

    # Logging
    access_log /var/log/nginx/mysite.com.access.log;
    error_log /var/log/nginx/mysite.com.error.log;

    # Serve static files
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Cache static assets
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # Block access ke hidden files
    location ~ /\. {
        deny all;
    }

    # Custom error pages
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }
}

# Buat symlink ke sites-enabled
sudo ln -s /etc/nginx/sites-available/mysite.com /etc/nginx/sites-enabled/

# Test konfigurasi
sudo nginx -t
# Output: syntax is ok, test is successful

# Reload Nginx
sudo systemctl reload nginx

# Buat direktori website
sudo mkdir -p /var/www/mysite.com/public
echo '
Hello from mysite.com
' | sudo tee /var/www/mysite.com/public/index.html

# Set permission yang tepat
sudo chown -R www-data:www-data /var/www/mysite.com
sudo chmod -R 755 /var/www/mysite.com

# /etc/nginx/sites-available/api.mysite.com

upstream node_backend {
    server 127.0.0.1:3000;
    keepalive 32;    # Keep koneksi ke backend
}

server {
    listen 443 ssl http2;
    server_name api.mysite.com;

    ssl_certificate /etc/letsencrypt/live/api.mysite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.mysite.com/privkey.pem;

    # Proxy ke Node.js backend
    location / {
        proxy_pass http://node_backend;
        proxy_http_version 1.1;

        # Headers untuk meneruskan info client
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Timeout settings
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        # Buffer settings
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
    }

    # Proxy untuk API tertentu ke service lain
    location /api/v2/ {
        proxy_pass http://127.0.0.1:4000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# === 1. ROUND ROBIN (Default) ===
upstream app_servers {
    server 10.0.0.1:3000;
    server 10.0.0.2:3000;
    server 10.0.0.3:3000;
}

# === 2. WEIGHTED ===
upstream app_weighted {
    server 10.0.0.1:3000 weight=3;   # Terima 3x lebih banyak
    server 10.0.0.2:3000 weight=2;   # Terima 2x lebih banyak
    server 10.0.0.3:3000 weight=1;   # Standar
}

# === 3. LEAST CONNECTIONS ===
upstream app_least_conn {
    least_conn;
    server 10.0.0.1:3000;
    server 10.0.0.2:3000;
    server 10.0.0.3:3000;
}

# === 4. IP HASH (Sticky Session) ===
upstream app_ip_hash {
    ip_hash;
    server 10.0.0.1:3000;
    server 10.0.0.2:3000;
    server 10.0.0.3:3000;
}

# === 5. DENGAN HEALTH CHECK & FAILOVER ===
upstream app_robust {
    least_conn;

    server 10.0.0.1:3000 weight=3 max_fails=3 fail_timeout=30s;
    server 10.0.0.2:3000 weight=2 max_fails=3 fail_timeout=30s;
    server 10.0.0.3:3000 weight=1 max_fails=3 fail_timeout=30s;

    # Backup server (hanya aktif saat semua server utama down)
    server 10.0.0.4:3000 backup;

    # Server yang dikurangi (maintenance mode)
    # server 10.0.0.5:3000 down;

    keepalive 32;
}

# Server block menggunakan upstream
server {
    listen 443 ssl http2;
    server_name app.mysite.com;

    ssl_certificate /etc/letsencrypt/live/app.mysite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.mysite.com/privkey.pem;

    location / {
        proxy_pass http://app_robust;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Connection "";
        proxy_next_upstream error timeout http_500 http_502 http_503;
    }
}

# Instalasi Certbot
sudo apt install certbot python3-certbot-nginx -y

# Generate dan install SSL certificate (otomatis edit Nginx config)
sudo certbot --nginx -d mysite.com -d www.mysite.com

# Atau generate saja tanpa auto-configure Nginx
sudo certbot certonly --nginx -d mysite.com

# Cek certificate
sudo certbot certificates

# Test auto-renewal
sudo certbot renew --dry-run

# Certbot akan auto-renew via systemd timer
sudo systemctl list-timers | grep certbot

# Manual renewal jika diperlukan
sudo certbot renew
sudo systemctl reload nginx

# /etc/nginx/snippets/ssl-params.conf

# Protocols — hanya TLS 1.2 dan 1.3
ssl_protocols TLSv1.2 TLSv1.3;

# Ciphers yang aman
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

# SSL session caching
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;

# OCSP Stapling (optimasi SSL handshake)
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

# Security Headers
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

# Diffie-Hellman parameter (generate: openssl dhparam -out /etc/nginx/dhparam.pem 4096)
ssl_dhparam /etc/nginx/dhparam.pem;

# Di dalam http {} block di nginx.conf

# Definisikan cache zone
proxy_cache_path /var/cache/nginx
    levels=1:2
    keys_zone=my_cache:10m
    max_size=10g
    inactive=60m
    use_temp_path=off;

# Di dalam server {} block

# Proxy dengan caching
location / {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;

    # Caching settings
    proxy_cache my_cache;
    proxy_cache_valid 200 302 10m;    # Cache response 200/302 selama 10 menit
    proxy_cache_valid 404 1m;          # Cache 404 selama 1 menit
    proxy_cache_valid any 5m;          # Cache semua lainnya 5 menit
    proxy_cache_use_stale error timeout updating http_500 http_502 http_503;
    proxy_cache_lock on;               # Hindari cache stampede

    # Cache bypass (jangan cache untuk kondisi tertentu)
    proxy_cache_bypass $http_authorization;
    proxy_no_cache $arg_nocache;

    # Tambah header untuk debug cache
    add_header X-Cache-Status $upstream_cache_status;
    # Miss = belum di-cache, Hit = dari cache, Bypass = dilewati
}

# Di dalam http {} block

# Definisikan rate limit zones
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

# Di dalam server {} block

# Rate limit untuk API
location /api/ {
    limit_req zone=api_limit burst=20 nodelay;
    limit_conn conn_limit 10;
    proxy_pass http://backend;

    # Custom error page saat rate limit tercapai
    limit_req_status 429;
    error_page 429 /429.html;
}

# Rate limit ketat untuk login
location /api/auth/login {
    limit_req zone=login_limit burst=5 nodelay;
    proxy_pass http://backend;
}