Linux Notes: Nginx (moving from Apache httpd to Nginx)

The information presented here is intended for educational use by qualified computer technologists.
The information presented here is provided free of charge, as-is, with no warranty of any kind.

Edit: 2026-09-25
back to: my Linux Notes (index)

Overview

Nginx first appeared in 2004, and was written to get around the 10k connection limit found in Apache HTTPd at that time.
- Nginx is much faster than Apache HTTPd, and the Nginx config file is much smaller.
- enabling CGI (Common Gateway Interface) is not so easy, and the recipe appears to be different on every platform including different Linux distros (and sometimes different versions of the same distro)
Apache HTTPd first appeared in 1995 and was based upon NCSA HTTPd which first appeared in 1993.
- It has been continuously updated since then and new versions continue to appear on all platforms including Linux.
- Apache solved the 10k connection limit in 2012 with the release of Apache-2.4
- Enabling CGI (Common Gateway Interface) is very easy to do via module mod_cgi

Moving from Apache httpd to Ngnix (2026-09-16)

Step-1 (installing Nginx on AlmaLinux-9.8)

If you are already running Apache, then consider installing Nginx the running it only on port 8080 just to try it out
- caveat: when setting up CGI on Nginx, a CGI failure in Nginx was somehow being handled by Apache so look out for that

You may need to adjust your firewall settings in order for port 8080 to work

notes:	all work should be done as user "root" or "sudo user"
legend:
	<ur> = user response
	<sr> = system response
================================================
<sr>	[root@host]				# my prompt
<ur>	dnf install epel-release		# optional command (you may already have this)
<sr>	...verbage ensues...
	[root@host]				# prompt
<ur>	dnf makecache
<sr>	....verbage ensues....
	[root@host]				#
<ur>	dnf install nginx
<sr>	...verbage ensues...
	[root@host]				#
------------------------------------------------
# task: modify the default config using "vi" or "nano"
# If testing in parallel with Apache:
#	set the port to 8080
#	do not enable ssl on 443 for now
# set hostname to be your system's URL (required for SSL)
# set "error_log /var/log/nginx/error.log;"
# set "access_log /var/log/nginx/access.log main buffer=8k flush=1m;"
------------------------------------------------
<ur>	vi /etc/nginx/nginx.conf		# modify the default config using "vi" or "nano"
	...editor typing happens here...
<sr>	[root@host]				#
<ur>	nginx -t				# test your config
<sr>	nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
	nginx: configuration file /etc/nginx/nginx.conf test is successful
	[root@host]
<ur>	systemctl start nginx			# start the server (but do not enable it at this time)
<sr>	...verbage ensues...
	[root@host]				#
------------------------------------------------
# now test your website by entering a URL similar to these:
# If testing in parallel with Apache:
	http://neilrieck.net:8080
# Otherwise:
	http://neilrieck.net
	https://neilrieck.net

Step-2 (enabling CGI on AlmaLinux-9.8)

Nginx provides no native support for CGI (common gateway interface) but does supply a forwarding mechanism to other code.

I chose fcgiwrap (caveat: this solution goes by several names: Nginx support scripts are prefixed "fastcgi" but the modules you download are prefixed with "fcgi"

<sr>	[root@host]				# my prompt
<ur>	dnf install fcgiwrap			# this will also install fcgi
<sr>	...verbage ensues....
	[root@host]				#
<ur>	man fcgiwrap				# check out online help
<sr>	...help text is displayed...
	[root@host]				#
------------------------------------------------
# task: locate the socket template filename (name contains: @ )
#	I want to type this command:
#	    find / -name fcgi*.sock* -exec ls -lad {} \;
#	but asterisks must be escaped with a forward slash
------------------------------------------------
<ur>	find / -name fcgi\*.sock\* -exec ls -lad {} \;
<sr>	-rw-r--r-- 1 root root 180 Jan 27  2022 /usr/lib/systemd/system/fcgiwrap@.socket
	[root@host]
------------------------------------------------
# task: use the discovered filename to start the socket listener
# note: executing the next command will create this file entry:
#		/run/fcgiwrap/fcgiwrap-nginx.sock
#	which must be entered into the location directive of nginx.conf
#	(see my example config at the bottom of this page)
------------------------------------------------
<ur>	systemctl enable --now fcgiwrap@nginx.socket
<sr>	...verbage ensues...
	[root@host]				#
<ur>	vi /etc/nginx/nginx.conf		# modify the default config using "vi" or "nano"
	...typing ensues...			# create a location directive for CGI
------------------------------------------------
<ur>	[root@host] nginx -t			# test your config
<sr>	nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
	nginx: configuration file /etc/nginx/nginx.conf test is successful
	[root@host]				#
<ur>	systemctl restart nginx			# restart the web server
------------------------------------------------
now test your website by entering a URL similar to these:
	https://neilrieck.net/cgi-bin/hello.cgi

Source code for hello.cgi (this code could easily be modified to start a python script)

#!/usr/bin/env bash
echo "Content-type: text/html"
echo ""
now="$(date)"
echo '<html><head><title>Hello World - CGI app</title></head>'
echo '<body>'
echo '<h2>Hello World!</h2>'
echo "Computer name : $HOSTNAME<br/>"
echo "The current date and time : ${now}<br/>"
echo '</body>'
echo '</html>'

Step-3 (enabling autoindex and fancyindex on AlmaLinux-9.8)

autoindex directives will force the webserver to produce a directory listing whenever a default index file is not found
fancyindex directives do the same thing but offer more features (including css file support for producing directory listing for smaller display devices like tablets and phones)
both autoindex and fancyindex are built into Apache

while autoindex is built into Nginx, fancyindex is not but can be installed from your distro's package manager

<sr>	[root@host]
<ur>	dnf install nginx-mod-fancyindex
<sr>	...verbage ensues...
	[root@host]
----------------------------------------------
see my example config at the bottom of this page

Step-4 (enabling password protection of one folder on AlmaLinux-9.8)

Caveat:

Apache allows the protected folder to not have an index file (but either autoindex or fancyindex must be enabled)
Nginx requires the protected folder to have a supported index file. This means that you must create a sub-folder below the protected folder, then move the files you wanted to display via autoindex or fancyindex into it.

Creating/populating a password file:

This can be done several ways but I will only show two:

via htpasswd which is found inside httpd-tools (a support package originally meant for Apache. You can install it from your distro's package manager without Apache)

htpasswd -c /etc/nginx/folder-name myusername1			# only use switch -c for the very first entry
htpasswd    /etc/nginx/folder-name myusername2			# adding a second account
# if something goes wrong, use an editor to repair the file

via the OpenSSL CLI (should already be on every system)

sh -c "echo -n 'myusername1:' >> /etc/nginx/folder-name"	# first half of adding an account (the user name)
sh -c "openssl passwd -apr1 >> /etc/nginx/folder-name"		# second half of adding an account (the password)
# if something goes wrong, use an editor to repair the file

Now update the config file

edit file "/etc/nginx/nginx.conf" then insert a location directive (see my example config at the bottom of this page)
test the config file then restart the server

Step-5 (forward http requests to https)

    server {
        listen       80;
      # listen       [::]:80;
        server_name  neilrieck.net *.neilrieck.net;
      # root         /usr/share/nginx/html;
        root         /var/www/html;                     # my Apache files live here

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        # redirect http to httpd
        # note: 301 means permanently moved
        return 301 https://$host$request_uri;
    }

My current conf (2026-09-24)

# ============================================================================
# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/
# ============================================================================
# 1) 2026-09-14: changes to get CGI working with fastcgi / fcgi.
# 2) 2026-09-14: enabled autoindex
# 3) 2026-09-15: switched over to fancyindex (an optional package that might
#      not be on your system). On AlmaLinux-9 you need to do this first:
#         sudo dnf install nginx-mod-fancyindex.x86_64
# 4) 2026-09-16: enabled password protection on one folder
# 5) 2026-09-19: added an expires directive (two places)
# 6) 2026-09-20: concated my cert + intermediate certs into a bundle (all
#      browsers work properly but python-based test scripts failed; oops!)
# 7) 2026-09-22: tweaks to fancyindex_css_href
# 8) 2026-09-24: now redirect all http requests to httpd (but I will leave all
#                port 80 directives in place in case I change my mind)
# ============================================================================

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

  # access_log  /var/log/nginx/access.log  main;
    access_log  /var/log/nginx/access.log  main buffer=8k flush=1m;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 4096;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80;
      # listen       [::]:80;
        server_name  neilrieck.net *.neilrieck.net;
      # root         /usr/share/nginx/html;
        root         /var/www/html;                     # my Apache files live here

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        #error_page 404 /404.html;
        #location = /404.html {
        #}

        #error_page 500 502 503 504 /50x.html;
        #location = /50x.html {
        #}

        # redirect http to httpd
        # note: 301 means permanently moved
        return 301 https://$host$request_uri;

        location ~ ^/mira/ {
            auth_basic "Restricted Access";
          # auth_basic_user_file /etc/nginx/.htpasswd;
            auth_basic_user_file /etc/nginx/passwd-folder-mira;
            # "autoindex" is built into nginx
            # autoindex on;
            # autoindex_exact_size off;
            # ------------------------------------
            # "fancyindex" is not built into nginx
            fancyindex on;
            fancyindex_default_sort name;
            fancyindex_directories_first on;
            fancyindex_case_sensitive off;
            fancyindex_exact_size off;
            fancyindex_time_format "%Y-%m-%d %H:%M";
            fancyindex_css_href /css/nsr-folder-default.css;
            try_files $uri $uri/ =404;
        }
        location / {
            expires 3600;                               # this affects cache-contol, etc.
            # "autoindex" is built into nginx
            # autoindex on;
            # autoindex_exact_size off;
            # ------------------------------------
            # "fancyindex" is not built into nginx
            fancyindex on;
            fancyindex_default_sort name;
            fancyindex_directories_first on;
            fancyindex_case_sensitive off;
            fancyindex_exact_size off;
            fancyindex_time_format "%Y-%m-%d %H:%M";
            fancyindex_css_href /css/nsr-folder-default.css;
        }
        location /cgi-bin/ {
            # Disable gzip so script outputs stream properly if needed
            gzip off;

            # The root directory where your 'cgi-bin' folder lives
            # e.g., if files are in /var/www/html/cgi-bin/, set root to /var/www/html
            root /var/www/html;                         # my Apache files live here

            # Pass requests to the fcgiwrap Unix socket
            # fastcgi_pass unix:/var/run/fcgiwrap.socket;
            fastcgi_pass unix:/run/fcgiwrap/fcgiwrap-nginx.sock;

            # Include standard Nginx FastCGI parameters
            include fastcgi_params;

            # Map the exact script filename to be executed
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        }
    }

# Settings for a TLS enabled server.
#
    server {
        listen       443 ssl http2;
      # listen       [::]:443 ssl http2;
        server_name  neilrieck.net *.neilrieck.net;
      # root         /usr/share/nginx/html;
        root         /var/www/html;                     # my Apache files live here

        # caveat: unlike Apache, Nginx has no provision for intermediate certs (eg. chain file) so you
        #         must create a bundle file which is a concat of the host cert file with the intermediate
        #         certs file file like so:
        #         1) cd /etc/pki/tls/certs
        #         2) cp host-file.crt chain-file.crt > bundle-file.crt
        #         3) now use an editor to ensure that the file is in PEM format
        #           (a) the file does not contain any blank likes or
        #           (b) the certs in the file stop/start on new lines
        #
      # ssl_certificate      "/etc/pki/nginx/server.crt";
      # ssl_certificate      "/etc/pki/tls/certs/neilrieck.net-20251022.cer";
        ssl_certificate      "/etc/pki/tls/certs/neilrieck.net-20251022-bundle.cer";
        #
      # ssl_certificate_key  "/etc/pki/nginx/private/server.key";
       ssl_certificate_key  "/etc/pki/tls/private/neilrieck.net-20251022.key";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers PROFILE=SYSTEM;
        ssl_prefer_server_ciphers on;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        #error_page 404 /404.html;
        #    location = /40x.html {
        #}

        #error_page 500 502 503 504 /50x.html;
        #    location = /50x.html {
        #}
        #
        #    password protected folder
        #    1) this special folder is password protected so needs to be encountered first
        #    2) this folder needs to have its own autoindex directives, or fancyindex directives.
        #       A common location entry (like the one 17-lines below) will not work here.
        #
        location ~ ^/mira/ {
            expires 3600;                               # this affects cache-contol, etc.
            auth_basic "Restricted Access";
          # auth_basic_user_file /etc/nginx/.htpasswd;
            auth_basic_user_file /etc/nginx/passwd-folder-mira;
            # "autoindex" is built into nginx
            # autoindex on;
            # autoindex_exact_size off;
            # ------------------------------------
            # "fancyindex" is not built into nginx
            fancyindex on;
            fancyindex_default_sort name;
            fancyindex_directories_first on;
            fancyindex_case_sensitive off;
            fancyindex_exact_size off;
            fancyindex_time_format "%Y-%m-%d %H:%M";
            fancyindex_css_href /css/nsr-folder-default.css;
            try_files $uri $uri/ =404;
        }
        #
        #    this declaration affects all subseqent folders
        #
        location / {
            expires 3600;                               # this affects cache-contol, etc.
            # "autoindex" is built into nginx
            # autoindex on;
            # autoindex_exact_size off;
            # ------------------------------------
            # "fancyindex" is not built into nginx
            fancyindex on;
            fancyindex_default_sort name;
            fancyindex_directories_first on;
            fancyindex_case_sensitive off;
            fancyindex_exact_size off;
            fancyindex_time_format "%Y-%m-%d %H:%M";
            fancyindex_css_href /css/nsr-folder-default.css;
        }
        location /cgi-bin/ {
            # Disable gzip so script outputs stream properly if needed
            gzip off;

            # The root directory where your 'cgi-bin' folder lives
            # e.g., if files are in /var/www/html/cgi-bin/, set root to /var/www/html
            root /var/www/html;

            # Pass requests to the fcgiwrap Unix socket
            # fastcgi_pass unix:/var/run/fcgiwrap.socket;
            fastcgi_pass unix:/run/fcgiwrap/fcgiwrap-nginx.sock;

            # Include standard Nginx FastCGI parameters
            include fastcgi_params;

            # Map the exact script filename to be executed
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        }
     }
}

Back to Home
Neil Rieck
Waterloo, Ontario, Canada.