HTTPS Configuration in Linux Using Nginx

  User 

 -> Cloudflare CDN (SSL/TLS Encryption, Edge Firewall, DDoS Protection)
 -> Contabo VPS (Nginx Reverse Proxy over port 443 only)

Step 1: Cloudflare DNS & Basic Security Setup

1. Purchase a domain 

2. Log into your domain registrar. go to DNS > Records and add two records:

• Type: A | Name: @ | IPv4 address: YOUR_CONTABO_VPS_IP | Proxy status: Proxied (Orange cloud)
• Type: A | Name: www | IPv4 address: YOUR_CONTABO_VPS_IP | Proxy status: Proxied (Orange cloud)

Step 2: Cloudflare Strict SSL & Origin Certificates

Cloudflare -> SSL/TLS > Configure ->  Encryption mode to Full (strict).

SSL/TLS > Origin Server -> Create Certificate.

Keep the default settings (valid for webserver.com and *.webserver.com). -> Create.

Copy Origin Certificate and a Private Key in text files require during Nginx configuration.

Step 1: Install Nginx, Node.js, and PM2

1. Update your system package manager:
   sudo dnf update -y
2. Install Nginx and Node.js directly from the official EL10 repositories
   sudo dnf install nginx nodejs -y
   Install PM2 globally to manage your Node.js application process
   sudo npm install pm2 -g
   
   

Step 2: Configure the Firewalld (Block Port 80, Allow 443)

• sudo dnf install firewalld -y
• sudo systemctl enable --now firewalld
• sudo firewall-cmd --permanent --add-service=https 
• sudo firewall-cmd --permanent --add-service=ssh
• sudo firewall-cmd --permanent --remove-service=http
• sudo firewall-cmd --reload
• sudo firewall-cmd --list-services

Step 3: Set up Cloudflare Origin Certificates

1. Create a secure directory structure for your SSL certificates:
sudo mkdir -p /etc/nginx/ssl

2. Create the file for your Cloudflare Origin Certificate and paste the text block you generated from the Cloudflare Dashboard:
#sudo nano /etc/nginx/ssl/webserver.crt
#sudo nano /etc/nginx/ssl/webserver.key

3. Secure the certificate file permissions:
sudo chmod 600 /etc/nginx/ssl/webserver.*

Step 4: Configure Nginx Reverse Proxy

1. Create a brand new configuration file for your domain:

sudo nano /etc/nginx/conf.d/webserver.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name webserver.com www.webserver.com;
    # Cloudflare Origin Certificates
    ssl_certificate /etc/nginx/ssl/webserver.crt;
    ssl_certificate_key /etc/nginx/ssl/webserver.key;
    # Maximum Security SSL Settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
    location / {
        proxy_pass http://127.0.0.1:8080; # Matches your Node.js application port
        proxy_http_version 1.1;
        # Pass real user context/IPs through Cloudflare
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Step 5: SELinux Adjustment & Starting Nginx

1. Allow Nginx to route outbound proxy connections to your backend:

sudo setsebool -P httpd_can_network_connect 1

2. Test your Nginx configuration syntax
sudo nginx -t

3. If the syntax test is successful, enable and start Nginx
sudo systemctl enable --now nginx

Node.js application using Express With Nginx reverse proxy configuration

Step 1: Create a Clean App Directory
mkdir -p /var/www/webserver
cd /var/www/webserver

Step 2: Initialize the Project and Install Express
npm init -y
npm install express

Step 3: Create the Application File
nano app.js

const express = require('express');
const app = express();
// Hardcoded configuration to match your Nginx reverse proxy
const PORT = 8080;
const HOST = '127.0.0.1'; 
// Trust Cloudflare's proxy headers passed by Nginx
app.set('trust proxy', true);
// Main landing route
app.get('/', (req, res) => {
    res.send('<h1>Welcome to WebServer.com</h1>');
});
// Start listening internally
app.listen(PORT, HOST, () => {
    console.log(`Node app successfully running on http://${HOST}:${PORT}`);
});

Step 4: Launch and Freeze the Process with PM2
pm2 start app.js --name "webserver-app"

Save the process configuration on reboot 
pm2 save

Step 5: Test the Proxy Loop Locally
curl -k https://127.0.0.1 

===========================================================