{"id":32357,"date":"2025-08-09T15:28:02","date_gmt":"2025-08-09T08:28:02","guid":{"rendered":"https:\/\/interdata.vn\/blog\/?p=32357"},"modified":"2025-08-09T15:30:50","modified_gmt":"2025-08-09T08:30:50","slug":"huong-dan-cai-dat-nginx-ubuntu-centos","status":"publish","type":"post","link":"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/","title":{"rendered":"H\u01b0\u1edbng D\u1eabn C\u00e0i \u0110\u1eb7t Nginx Tr\u00ean Ubuntu\/CentOS Chi Ti\u1ebft, C\u1ef1c \u0110\u01a1n Gi\u1ea3n"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-hierarchy ez-toc-counter ez-toc-white ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">N\u1ed8I DUNG<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Nginx-la-gi-Khi-nao-nen-dung-thay-cho-Apache\" >Nginx l\u00e0 g\u00ec? Khi n\u00e0o n\u00ean d\u00f9ng thay cho Apache?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Yeu-cau-chuan-bi-truoc-khi-cai-dat\" >Y\u00eau c\u1ea7u &amp; chu\u1ea9n b\u1ecb tr\u01b0\u1edbc khi c\u00e0i \u0111\u1eb7t<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Khac-biet-Ubuntu-vs-CentOS-ban-can-nam\" >Kh\u00e1c bi\u1ec7t Ubuntu vs CentOS b\u1ea1n c\u1ea7n n\u1eafm<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Cai-dat-Nginx-tren-Ubuntu-200422042404\" >C\u00e0i \u0111\u1eb7t Nginx tr\u00ean Ubuntu (20.04\/22.04\/24.04)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Cai-dat-Nginx-tren-CentOSAlmaLinuxRocky\" >C\u00e0i \u0111\u1eb7t Nginx tr\u00ean CentOS\/AlmaLinux\/Rocky<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Cau-hinh-reverse-proxy-upstream-co-ban\" >C\u1ea5u h\u00ecnh reverse proxy &amp; upstream c\u01a1 b\u1ea3n<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Bat-HTTPS-voi-Lets-Encrypt-Certbot\" >B\u1eadt HTTPS v\u1edbi Let\u2019s Encrypt (Certbot)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Toi-uu-hieu-suat-bao-mat-co-ban\" >T\u1ed1i \u01b0u hi\u1ec7u su\u1ea5t &amp; b\u1ea3o m\u1eadt c\u01a1 b\u1ea3n<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Kiem-tra-xu-ly-loi-thuong-gap\" >Ki\u1ec3m tra &amp; x\u1eed l\u00fd l\u1ed7i th\u01b0\u1eddng g\u1eb7p<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Giam-sat-log-va-bao-tri-dinh-ky\" >Gi\u00e1m s\u00e1t, log v\u00e0 b\u1ea3o tr\u00ec \u0111\u1ecbnh k\u1ef3<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Cau-hoi-thuong-gap-FAQ\" >C\u00e2u h\u1ecfi th\u01b0\u1eddng g\u1eb7p (FAQ)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/interdata.vn\/blog\/huong-dan-cai-dat-nginx-ubuntu-centos\/#Checklist-trien-khai-nhanh\" >Checklist tri\u1ec3n khai nhanh<\/a><\/li><\/ul><\/nav><\/div>\n<p>B\u00e0i vi\u1ebft n\u00e0y c\u1ee7a InterData s\u1ebd h\u01b0\u1edbng d\u1eabn b\u1ea1n chi ti\u1ebft quy tr\u00ecnh c\u00e0i \u0111\u1eb7t v\u00e0 c\u1ea5u h\u00ecnh <a href=\"https:\/\/interdata.vn\/blog\/nginx-la-gi\/\">Nginx<\/a> tr\u00ean hai h\u1ec7 \u0111i\u1ec1u h\u00e0nh m\u00e1y ch\u1ee7 ph\u1ed5 bi\u1ebfn nh\u1ea5t: Ubuntu v\u00e0 CentOS. Ch\u00fang t\u00f4i s\u1ebd \u0111i t\u1eeb nh\u1eefng kh\u00e1i ni\u1ec7m c\u01a1 b\u1ea3n, qua c\u00e1c b\u01b0\u1edbc c\u00e0i \u0111\u1eb7t c\u1ee5 th\u1ec3, \u0111\u1ebfn c\u00e1c k\u1ef9 thu\u1eadt n\u00e2ng cao nh\u01b0 c\u1ea5u h\u00ecnh Reverse Proxy, b\u1eadt HTTPS v\u1edbi Let&#8217;s Encrypt v\u00e0 c\u00e1c ph\u01b0\u01a1ng ph\u00e1p t\u1ed1i \u01b0u, b\u1ea3o m\u1eadt thi\u1ebft y\u1ebfu cho m\u00f4i tr\u01b0\u1eddng production.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2025\/08\/Cai-dat-Nginx-tren-Ubuntu-Centos.jpg\" alt=\"C\u00e0i \u0111\u1eb7t Nginx tr\u00ean Ubuntu Centos\" width=\"600\" height=\"400\" class=\"aligncenter size-full wp-image-32360\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2025\/08\/Cai-dat-Nginx-tren-Ubuntu-Centos.jpg 600w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2025\/08\/Cai-dat-Nginx-tren-Ubuntu-Centos-300x200.jpg 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<h2><span class=\"ez-toc-section\" id=\"Nginx-la-gi-Khi-nao-nen-dung-thay-cho-Apache\"><\/span>Nginx l\u00e0 g\u00ec? Khi n\u00e0o n\u00ean d\u00f9ng thay cho Apache?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Nginx<\/strong> (ph\u00e1t \u00e2m l\u00e0 &#8220;engine-x&#8221;) l\u00e0 m\u1ed9t web server m\u00e3 ngu\u1ed3n m\u1edf hi\u1ec7u n\u0103ng cao. Ban \u0111\u1ea7u, Nginx \u0111\u01b0\u1ee3c t\u1ea1o ra \u0111\u1ec3 gi\u1ea3i quy\u1ebft b\u00e0i to\u00e1n C10k &#8211; x\u1eed l\u00fd m\u01b0\u1eddi ngh\u00ecn k\u1ebft n\u1ed1i \u0111\u1ed3ng th\u1eddi tr\u00ean m\u1ed9t m\u00e1y ch\u1ee7.<\/p>\n<p>\u0110i\u1ec3m l\u00e0m n\u00ean s\u1ee9c m\u1ea1nh c\u1ee7a Nginx l\u00e0 <strong>ki\u1ebfn tr\u00fac b\u1ea5t \u0111\u1ed3ng b\u1ed9, \u0111i\u1ec1u khi\u1ec3n b\u1edfi s\u1ef1 ki\u1ec7n (event-driven)<\/strong>. Thay v\u00ec t\u1ea1o m\u1ed9t ti\u1ebfn tr\u00ecnh (process) ho\u1eb7c lu\u1ed3ng (thread) m\u1edbi cho m\u1ed7i y\u00eau c\u1ea7u nh\u01b0 <a href=\"https:\/\/interdata.vn\/blog\/apache-la-gi\/\">Apache<\/a>, Nginx s\u1eed d\u1ee5ng m\u1ed9t ti\u1ebfn tr\u00ecnh worker duy nh\u1ea5t \u0111\u1ec3 x\u1eed l\u00fd h\u00e0ng ngh\u00ecn k\u1ebft n\u1ed1i. C\u00e1ch ti\u1ebfp c\u1eadn n\u00e0y gi\u00fap Nginx ti\u00eau th\u1ee5 b\u1ed9 nh\u1edb c\u1ef1c k\u1ef3 hi\u1ec7u qu\u1ea3 v\u00e0 c\u00f3 hi\u1ec7u n\u0103ng v\u01b0\u1ee3t tr\u1ed9i, \u0111\u1eb7c bi\u1ec7t khi ph\u1ee5c v\u1ee5 n\u1ed9i dung t\u0129nh ho\u1eb7c c\u00f3 l\u01b0\u1ee3ng truy c\u1eadp \u0111\u1ed3ng th\u1eddi l\u1edbn.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2024\/08\/loi-ich-cua-nginx.webp\" alt=\"Nh\u1eefng l\u1ee3i \u00edch c\u1ee7a Nginx Web Server\" width=\"600\" height=\"336\" class=\"aligncenter wp-image-16383\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2024\/08\/loi-ich-cua-nginx.webp 900w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2024\/08\/loi-ich-cua-nginx-300x168.webp 300w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2024\/08\/loi-ich-cua-nginx-768x430.webp 768w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2024\/08\/loi-ich-cua-nginx-750x420.webp 750w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>Theo kh\u1ea3o s\u00e1t c\u1ee7a W3Techs v\u00e0o th\u00e1ng 8 n\u0103m 2025, Nginx \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng b\u1edfi <strong>34.2%<\/strong> t\u1ea5t c\u1ea3 c\u00e1c website tr\u00ean th\u1ebf gi\u1edbi, cho th\u1ea5y s\u1ef1 ph\u1ed5 bi\u1ebfn v\u00e0 tin c\u1eady c\u1ee7a n\u00f3.<\/p>\n<p>B\u1ea1n n\u00ean ch\u1ecdn Nginx khi:<\/p>\n<ul>\n<li><strong>Ph\u1ee5c v\u1ee5 n\u1ed9i dung t\u0129nh:<\/strong> H\u00ecnh \u1ea3nh, CSS, JavaScript.<\/li>\n<li><strong>L\u00e0m Reverse Proxy:<\/strong> \u0110\u1ee9ng tr\u01b0\u1edbc c\u00e1c application server (Node.js, Python, Java) \u0111\u1ec3 \u0111i\u1ec1u ph\u1ed1i request.<\/li>\n<li><strong>L\u00e0m Load Balancer (B\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i):<\/strong> Ph\u00e2n ph\u1ed1i l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp \u0111\u1ebfn nhi\u1ec1u m\u00e1y ch\u1ee7 backend.<\/li>\n<li><strong>X\u00e2y d\u1ef1ng API Gateway:<\/strong> Qu\u1ea3n l\u00fd c\u00e1c \u0111i\u1ec3m cu\u1ed1i API.<\/li>\n<li><strong>Ki\u1ebfn tr\u00fac Microservices:<\/strong> Nginx ho\u1ea1t \u0111\u1ed9ng hi\u1ec7u qu\u1ea3 nh\u01b0 m\u1ed9t c\u1ed5ng v\u00e0o cho c\u00e1c d\u1ecbch v\u1ee5 nh\u1ecf l\u1ebb.<\/li>\n<\/ul>\n<p>Apache v\u1eabn l\u00e0 m\u1ed9t l\u1ef1a ch\u1ecdn m\u1ea1nh m\u1ebd cho c\u00e1c m\u00f4i tr\u01b0\u1eddng shared hosting truy\u1ec1n th\u1ed1ng ho\u1eb7c c\u00e1c \u1ee9ng d\u1ee5ng y\u00eau c\u1ea7u c\u1ea5u h\u00ecnh linh ho\u1ea1t th\u00f4ng qua file <code>.htaccess<\/code>. Tuy nhi\u00ean, v\u1edbi c\u00e1c \u1ee9ng d\u1ee5ng hi\u1ec7n \u0111\u1ea1i, Nginx th\u01b0\u1eddng l\u00e0 l\u1ef1a ch\u1ecdn \u01b0u ti\u00ean v\u1ec1 hi\u1ec7u n\u0103ng.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Yeu-cau-chuan-bi-truoc-khi-cai-dat\"><\/span>Y\u00eau c\u1ea7u &amp; chu\u1ea9n b\u1ecb tr\u01b0\u1edbc khi c\u00e0i \u0111\u1eb7t<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>\u0110\u1ec3 qu\u00e1 tr\u00ecnh c\u00e0i \u0111\u1eb7t di\u1ec5n ra su\u00f4n s\u1ebb, b\u1ea1n c\u1ea7n \u0111\u1ea3m b\u1ea3o c\u00e1c y\u1ebfu t\u1ed1 sau:<\/p>\n<ul>\n<li><strong>H\u1ec7 \u0111i\u1ec1u h\u00e0nh:<\/strong> M\u1ed9t m\u00e1y ch\u1ee7 \u0111ang ch\u1ea1y phi\u00ean b\u1ea3n Ubuntu (20.04, 22.04, 24.04) ho\u1eb7c CentOS\/AlmaLinux\/Rocky Linux (7, 8, 9) c\u00f2n \u0111\u01b0\u1ee3c h\u1ed7 tr\u1ee3.<\/li>\n<li><strong>Quy\u1ec1n truy c\u1eadp:<\/strong> T\u00e0i kho\u1ea3n ng\u01b0\u1eddi d\u00f9ng c\u00f3 quy\u1ec1n <code>sudo<\/code>.<\/li>\n<li><strong>H\u1ec7 th\u1ed1ng c\u1eadp nh\u1eadt:<\/strong> Lu\u00f4n c\u1eadp nh\u1eadt h\u1ec7 th\u1ed1ng \u0111\u1ec3 v\u00e1 c\u00e1c l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt v\u00e0 \u0111\u1ea3m b\u1ea3o t\u01b0\u01a1ng th\u00edch g\u00f3i ph\u1ea7n m\u1ec1m.<\/li>\n<li><strong>T\u00ean mi\u1ec1n (T\u00f9y ch\u1ecdn nh\u01b0ng khuy\u1ebfn kh\u00edch):<\/strong> M\u1ed9t t\u00ean mi\u1ec1n \u0111\u00e3 \u0111\u01b0\u1ee3c tr\u1ecf A record v\u1ec1 \u0111\u1ecba ch\u1ec9 IP public c\u1ee7a m\u00e1y ch\u1ee7. \u0110i\u1ec1u n\u00e0y l\u00e0 b\u1eaft bu\u1ed9c n\u1ebfu b\u1ea1n mu\u1ed1n c\u00e0i \u0111\u1eb7t <a href=\"https:\/\/interdata.vn\/blog\/chung-chi-ssl\/\">ch\u1ee9ng ch\u1ec9 SSL<\/a>\/TLS.<\/li>\n<li><strong>M\u1edf Port:<\/strong> \u0110\u1ea3m b\u1ea3o t\u01b0\u1eddng l\u1eeda c\u1ee7a b\u1ea1n cho ph\u00e9p l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp qua port <strong>80 (HTTP)<\/strong> v\u00e0 <strong>443 (HTTPS)<\/strong>.<\/li>\n<li><strong>\u0110\u1ed3ng b\u1ed9 th\u1eddi gian:<\/strong> Th\u1eddi gian h\u1ec7 th\u1ed1ng ch\u00ednh x\u00e1c l\u00e0 y\u1ebfu t\u1ed1 quan tr\u1ecdng cho vi\u1ec7c x\u00e1c th\u1ef1c SSL v\u00e0 ghi log.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Khac-biet-Ubuntu-vs-CentOS-ban-can-nam\"><\/span>Kh\u00e1c bi\u1ec7t Ubuntu vs CentOS b\u1ea1n c\u1ea7n n\u1eafm<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Hi\u1ec3u r\u00f5 s\u1ef1 kh\u00e1c bi\u1ec7t gi\u1eefa hai h\u1ec7 \u0111i\u1ec1u h\u00e0nh s\u1ebd gi\u00fap b\u1ea1n x\u1eed l\u00fd s\u1ef1 c\u1ed1 hi\u1ec7u qu\u1ea3 h\u01a1n.<\/p>\n<figure class=\"table\">\n<table>\n<thead>\n<tr>\n<th>Y\u1ebfu t\u1ed1<\/th>\n<th>Ubuntu (H\u1ec7 Debian)<\/th>\n<th>CentOS\/AlmaLinux\/Rocky (H\u1ec7 RHEL)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Tr\u00ecnh qu\u1ea3n l\u00fd g\u00f3i<\/strong><\/td>\n<td><code>apt<\/code><\/td>\n<td><code>yum<\/code> (CentOS 7) \/ <code>dnf<\/code> (CentOS 8+)<\/td>\n<\/tr>\n<tr>\n<td><strong>T\u01b0\u1eddng l\u1eeda m\u1eb7c \u0111\u1ecbnh<\/strong><\/td>\n<td><code>UFW<\/code> (Uncomplicated Firewall)<\/td>\n<td><code>firewalld<\/code><\/td>\n<\/tr>\n<tr>\n<td><strong>C\u01a1 ch\u1ebf b\u1ea3o m\u1eadt<\/strong><\/td>\n<td><code>AppArmor<\/code><\/td>\n<td><code>SELinux<\/code> (B\u1eadt m\u1eb7c \u0111\u1ecbnh, r\u1ea5t nghi\u00eam ng\u1eb7t)<\/td>\n<\/tr>\n<tr>\n<td><strong>C\u1ea5u tr\u00fac c\u1ea5u h\u00ecnh<\/strong><\/td>\n<td><code>\/etc\/nginx\/sites-available\/<\/code>&lt;br&gt;<code>\/etc\/nginx\/sites-enabled\/<\/code><\/td>\n<td><code>\/etc\/nginx\/conf.d\/<\/code><\/td>\n<\/tr>\n<tr>\n<td><strong>User ch\u1ea1y d\u1ecbch v\u1ee5<\/strong><\/td>\n<td><code>www-data<\/code><\/td>\n<td><code>nginx<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p>\u0110i\u1ec3m kh\u00e1c bi\u1ec7t l\u1edbn nh\u1ea5t b\u1ea1n c\u1ea7n l\u01b0u \u00fd l\u00e0 <strong>SELinux<\/strong> tr\u00ean CentOS. R\u1ea5t nhi\u1ec1u l\u1ed7i &#8220;403 Forbidden&#8221; kh\u00f4ng ph\u1ea3i do quy\u1ec1n file (<code>chmod<\/code>) m\u00e0 do SELinux ch\u1eb7n Nginx truy c\u1eadp v\u00e0o th\u01b0 m\u1ee5c webroot.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Cai-dat-Nginx-tren-Ubuntu-200422042404\"><\/span>C\u00e0i \u0111\u1eb7t Nginx tr\u00ean Ubuntu (20.04\/22.04\/24.04)<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Quy tr\u00ecnh tr\u00ean Ubuntu r\u1ea5t \u0111\u01a1n gi\u1ea3n v\u00ec Nginx c\u00f3 s\u1eb5n trong kho l\u01b0u tr\u1eef m\u1eb7c \u0111\u1ecbnh.<\/p>\n<h3>C\u00e0i \u0111\u1eb7t v\u00e0 kh\u1edfi \u0111\u1ed9ng d\u1ecbch v\u1ee5<\/h3>\n<ol>\n<li><strong>C\u1eadp nh\u1eadt danh s\u00e1ch g\u00f3i:<\/strong> Lu\u00f4n b\u1eaft \u0111\u1ea7u b\u1eb1ng vi\u1ec7c l\u00e0m m\u1edbi danh s\u00e1ch g\u00f3i ph\u1ea7n m\u1ec1m c\u1ee7a b\u1ea1n.\n<pre><code class=\"language-plaintext\">sudo apt update<\/code><\/pre>\n<\/li>\n<li><strong>C\u00e0i \u0111\u1eb7t Nginx:<\/strong> Th\u1ef1c thi l\u1ec7nh sau \u0111\u1ec3 c\u00e0i \u0111\u1eb7t g\u00f3i Nginx.\n<pre><code class=\"language-plaintext\">sudo apt install nginx<\/code><\/pre>\n<\/li>\n<li><strong>Kh\u1edfi \u0111\u1ed9ng v\u00e0 k\u00edch ho\u1ea1t Nginx:<\/strong> L\u1ec7nh <code>enable --now<\/code> s\u1ebd kh\u1edfi \u0111\u1ed9ng Nginx ngay l\u1eadp t\u1ee9c v\u00e0 thi\u1ebft l\u1eadp \u0111\u1ec3 n\u00f3 t\u1ef1 ch\u1ea1y m\u1ed7i khi m\u00e1y ch\u1ee7 kh\u1edfi \u0111\u1ed9ng l\u1ea1i.\n<pre><code class=\"language-plaintext\">sudo systemctl enable --now nginx<\/code><\/pre>\n<\/li>\n<li><strong>Ki\u1ec3m tra tr\u1ea1ng th\u00e1i:<\/strong> B\u1ea1n c\u00f3 th\u1ec3 x\u00e1c nh\u1eadn Nginx \u0111ang ch\u1ea1y \u1ed5n \u0111\u1ecbnh b\u1eb1ng l\u1ec7nh sau.\n<pre><code class=\"language-plaintext\">systemctl status ngin<\/code><\/pre>\n<p>N\u1ebfu th\u1ea5y d\u00f2ng <code>active (running)<\/code> m\u00e0u xanh, b\u1ea1n \u0111\u00e3 th\u00e0nh c\u00f4ng.<\/li>\n<\/ol>\n<h3>M\u1edf t\u01b0\u1eddng l\u1eeda UFW<\/h3>\n<p>N\u1ebfu b\u1ea1n \u0111ang s\u1eed d\u1ee5ng t\u01b0\u1eddng l\u1eeda UFW, b\u1ea1n c\u1ea7n cho ph\u00e9p Nginx \u0111i qua.<\/p>\n<ol>\n<li><strong>Li\u1ec7t k\u00ea c\u00e1c c\u1ea5u h\u00ecnh \u1ee9ng d\u1ee5ng UFW:<\/strong>\n<pre><code class=\"language-plaintext\">sudo ufw app list<\/code><\/pre>\n<p>B\u1ea1n s\u1ebd th\u1ea5y c\u00e1c t\u00f9y ch\u1ecdn: &#8216;Nginx Full&#8217; (cho ph\u00e9p port 80 v\u00e0 443), &#8216;Nginx HTTP&#8217;, &#8216;Nginx HTTPS&#8217;.<\/li>\n<li><strong>Cho ph\u00e9p l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp:<\/strong> C\u00e1ch \u0111\u01a1n gi\u1ea3n nh\u1ea5t l\u00e0 cho ph\u00e9p c\u1ea3 hai.\n<pre><code class=\"language-plaintext\">sudo ufw allow 'Nginx Full'<\/code><\/pre>\n<\/li>\n<li><strong>Ki\u1ec3m tra tr\u1ea1ng th\u00e1i t\u01b0\u1eddng l\u1eeda:<\/strong>\n<pre><code class=\"language-plaintext\">sudo ufw status<\/code><\/pre>\n<p>B\u1ea1n s\u1ebd th\u1ea5y c\u00e1c rule cho Nginx \u0111\u00e3 \u0111\u01b0\u1ee3c th\u00eam v\u00e0o.<\/li>\n<\/ol>\n<h3>C\u1ea5u tr\u00fac th\u01b0 m\u1ee5c &amp; file c\u1ea5u h\u00ecnh<\/h3>\n<ul>\n<li><code>\/etc\/nginx\/nginx.conf<\/code>: File c\u1ea5u h\u00ecnh ch\u00ednh, n\u01a1i b\u1ea1n thi\u1ebft l\u1eadp c\u00e1c th\u00f4ng s\u1ed1 to\u00e0n c\u1ee5c nh\u01b0 s\u1ed1 l\u01b0\u1ee3ng worker processes.<\/li>\n<li><code>\/etc\/nginx\/sites-available\/<\/code>: N\u01a1i ch\u1ee9a t\u1ea5t c\u1ea3 c\u00e1c file c\u1ea5u h\u00ecnh <strong>server block<\/strong> (t\u01b0\u01a1ng t\u1ef1 Virtual Host c\u1ee7a Apache). M\u1ed7i website n\u00ean c\u00f3 m\u1ed9t file ri\u00eang t\u1ea1i \u0111\u00e2y.<\/li>\n<li><code>\/etc\/nginx\/sites-enabled\/<\/code>: N\u01a1i ch\u1ee9a c\u00e1c <strong>li\u00ean k\u1ebft t\u01b0\u1ee3ng tr\u01b0ng (symbolic link)<\/strong> \u0111\u1ebfn c\u00e1c file c\u1ea5u h\u00ecnh trong <code>sites-available<\/code> m\u00e0 b\u1ea1n mu\u1ed1n k\u00edch ho\u1ea1t.<\/li>\n<li><code>\/var\/log\/nginx\/<\/code>: Th\u01b0 m\u1ee5c ch\u1ee9a log truy c\u1eadp (<code>access.log<\/code>) v\u00e0 log l\u1ed7i (<code>error.log<\/code>).<\/li>\n<\/ul>\n<h3>T\u1ea1o server block cho t\u00ean mi\u1ec1n<\/h3>\n<p>Gi\u1ea3 s\u1eed b\u1ea1n c\u00f3 t\u00ean mi\u1ec1n <code>your_domain.com<\/code>.<\/p>\n<ol>\n<li><strong>T\u1ea1o th\u01b0 m\u1ee5c cho website:<\/strong>\n<pre><code class=\"language-plaintext\">sudo mkdir -p \/var\/www\/your_domain.com\/html<\/code><\/pre>\n<\/li>\n<li><strong>T\u1ea1o file index.html \u0111\u1ec3 th\u1eed nghi\u1ec7m:<\/strong>\n<pre><code class=\"language-plaintext\">echo \"&lt;h1&gt;Success! The your_domain.com server block is working!&lt;\/h1&gt;\" | sudo tee \/var\/www\/your_domain.com\/html\/index.html<\/code><\/pre>\n<\/li>\n<li><strong>T\u1ea1o file c\u1ea5u h\u00ecnh server block:<\/strong> S\u1eed d\u1ee5ng m\u1ed9t tr\u00ecnh so\u1ea1n th\u1ea3o v\u0103n b\u1ea3n nh\u01b0 <code>nano<\/code> \u0111\u1ec3 t\u1ea1o file c\u1ea5u h\u00ecnh m\u1edbi.\n<pre><code class=\"language-plaintext\">sudo nano \/etc\/nginx\/sites-available\/your_domain.com<\/code><\/pre>\n<p>D\u00e1n n\u1ed9i dung sau v\u00e0o file:<\/p>\n<pre><code class=\"language-plaintext\">server {\r\n    listen 80;\r\n    listen [::]:80;\r\n\r\n    root \/var\/www\/your_domain.com\/html;\r\n    index index.html index.htm;\r\n\r\n    server_name your_domain.com www.your_domain.com;\r\n\r\n    location \/ {\r\n        try_files $uri $uri\/ =404;\r\n    }\r\n\r\n    access_log \/var\/log\/nginx\/your_domain.com.access.log;\r\n    error_log \/var\/log\/nginx\/your_domain.com.error.log;\r\n}<\/code><\/pre>\n<\/li>\n<li><strong>K\u00edch ho\u1ea1t server block:<\/strong> T\u1ea1o m\u1ed9t symbolic link t\u1eeb <code>sites-available<\/code> sang <code>sites-enabled<\/code>.\n<pre><code class=\"language-plaintext\">sudo ln -s \/etc\/nginx\/sites-available\/your_domain.com \/etc\/nginx\/sites-enabled\/<\/code><\/pre>\n<\/li>\n<li><strong>Ki\u1ec3m tra c\u00fa ph\u00e1p v\u00e0 \u00e1p d\u1ee5ng c\u1ea5u h\u00ecnh:<\/strong> Lu\u00f4n ki\u1ec3m tra c\u00fa ph\u00e1p tr\u01b0\u1edbc khi reload \u0111\u1ec3 tr\u00e1nh l\u00e0m s\u1eadp d\u1ecbch v\u1ee5.\n<pre><code class=\"language-plaintext\">sudo nginx -t<\/code><\/pre>\n<p>N\u1ebfu nh\u1eadn \u0111\u01b0\u1ee3c th\u00f4ng b\u00e1o <code>syntax is ok<\/code> v\u00e0 <code>test is successful<\/code>, h\u00e3y reload Nginx.<\/p>\n<pre><code class=\"language-plaintext\">sudo systemctl reload nginx<\/code><\/pre>\n<p>B\u00e2y gi\u1edd, b\u1ea1n c\u00f3 th\u1ec3 truy c\u1eadp <code>http:\/\/your_domain.com<\/code> tr\u00ean tr\u00ecnh duy\u1ec7t \u0111\u1ec3 th\u1ea5y trang ch\u00e0o m\u1eebng.<\/li>\n<\/ol>\n<h2><span class=\"ez-toc-section\" id=\"Cai-dat-Nginx-tren-CentOSAlmaLinuxRocky\"><\/span>C\u00e0i \u0111\u1eb7t Nginx tr\u00ean CentOS\/AlmaLinux\/Rocky<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Tr\u00ean c\u00e1c b\u1ea3n ph\u00e2n ph\u1ed1i RHEL, Nginx th\u01b0\u1eddng \u0111\u01b0\u1ee3c c\u00e0i t\u1eeb kho EPEL ho\u1eb7c qua Module Stream.<\/p>\n<h3>C\u00e0i \u0111\u1eb7t v\u00e0 kh\u1edfi \u0111\u1ed9ng d\u1ecbch v\u1ee5<\/h3>\n<ul>\n<li><strong>Tr\u00ean CentOS 7:<\/strong> B\u1ea1n c\u1ea7n c\u00e0i kho EPEL (Extra Packages for Enterprise Linux) tr\u01b0\u1edbc.\n<pre><code class=\"language-plaintext\">sudo yum install epel-release\r\nsudo yum install nginx<\/code><\/pre>\n<\/li>\n<li><strong>Tr\u00ean CentOS 8\/9 v\u00e0 c\u00e1c b\u1ea3n clone:<\/strong> Nginx c\u00f3 s\u1eb5n trong AppStream.\n<pre><code class=\"language-plaintext\">sudo dnf install nginx<\/code><\/pre>\n<\/li>\n<\/ul>\n<p>Sau khi c\u00e0i \u0111\u1eb7t, h\u00e3y kh\u1edfi \u0111\u1ed9ng v\u00e0 k\u00edch ho\u1ea1t d\u1ecbch v\u1ee5.<\/p>\n<pre><code class=\"language-plaintext\">sudo systemctl enable --now nginx<\/code><\/pre>\n<h3>M\u1edf t\u01b0\u1eddng l\u1eeda firewalld<\/h3>\n<ol>\n<li><strong>Th\u00eam rule cho HTTP v\u00e0 HTTPS:<\/strong>\n<pre><code class=\"language-plaintext\">sudo firewall-cmd --permanent --add-service=http\r\nsudo firewall-cmd --permanent --add-service=https<\/code><\/pre>\n<\/li>\n<li><strong>Reload t\u01b0\u1eddng l\u1eeda \u0111\u1ec3 \u00e1p d\u1ee5ng:<\/strong>\n<pre><code class=\"language-plaintext\">sudo firewall-cmd --reload<\/code><\/pre>\n<\/li>\n<\/ol>\n<h3>SELinux &amp; quy\u1ec1n truy c\u1eadp<\/h3>\n<p>\u0110\u00e2y l\u00e0 b\u01b0\u1edbc quan tr\u1ecdng nh\u1ea5t v\u00e0 th\u01b0\u1eddng b\u1ecb b\u1ecf qua. N\u1ebfu b\u1ea1n t\u1ea1o th\u01b0 m\u1ee5c webroot \u1edf m\u1ed9t v\u1ecb tr\u00ed kh\u00e1c <code>\/usr\/share\/nginx\/html<\/code>, SELinux s\u1ebd ch\u1eb7n Nginx truy c\u1eadp.<\/p>\n<ol>\n<li><strong>G\u00e1n context cho th\u01b0 m\u1ee5c webroot:<\/strong> Gi\u1ea3 s\u1eed b\u1ea1n t\u1ea1o th\u01b0 m\u1ee5c <code>\/var\/www\/your_domain.com<\/code>.\n<pre><code class=\"language-plaintext\">sudo semanage fcontext -a -t httpd_sys_content_t \"\/var\/www\/your_domain.com(\/.*)?\"\r\nsudo restorecon -Rv \/var\/www\/your_domain.com<\/code><\/pre>\n<\/li>\n<li><strong>Cho ph\u00e9p Nginx k\u1ebft n\u1ed1i m\u1ea1ng (khi l\u00e0m reverse proxy):<\/strong>\n<pre><code class=\"language-plaintext\">sudo setsebool -P httpd_can_network_connect 1<\/code><\/pre>\n<\/li>\n<\/ol>\n<p>N\u1ebfu g\u1eb7p l\u1ed7i <code>403 Forbidden<\/code> d\u00f9 \u0111\u00e3 <code>chmod<\/code> \u0111\u00fang, h\u00e3y ki\u1ec3m tra log c\u1ee7a SELinux b\u1eb1ng <code>audit2why &lt; \/var\/log\/audit\/audit.log<\/code>.<\/p>\n<h3>T\u1ea1o vhost trong \/etc\/nginx\/conf.d\/<\/h3>\n<p>Tr\u00ean CentOS, b\u1ea1n kh\u00f4ng c\u1ea7n <code>sites-available<\/code>. Ch\u1ec9 c\u1ea7n t\u1ea1o file <code>.conf<\/code> trong <code>\/etc\/nginx\/conf.d\/<\/code>.<\/p>\n<ol>\n<li><strong>T\u1ea1o file c\u1ea5u h\u00ecnh:<\/strong>\n<pre><code class=\"language-plaintext\">sudo nano \/etc\/nginx\/conf.d\/your_domain.com.conf<\/code><\/pre>\n<\/li>\n<li><strong>D\u00e1n n\u1ed9i dung c\u1ea5u h\u00ecnh (t\u01b0\u01a1ng t\u1ef1 Ubuntu):<\/strong>\n<pre><code class=\"language-plaintext\">server {\r\n    listen 80;\r\n    listen [::]:80;\r\n\r\n    server_name your_domain.com www.your_domain.com;\r\n\r\n    root \/var\/www\/your_domain.com\/html;\r\n    index index.html index.htm;\r\n\r\n    location \/ {\r\n        try_files $uri $uri\/ =404;\r\n    }\r\n}<\/code><\/pre>\n<\/li>\n<li><strong>Ki\u1ec3m tra v\u00e0 reload Nginx:<\/strong>\n<pre><code class=\"language-plaintext\">sudo nginx -t\r\nsudo systemctl reload nginx<\/code><\/pre>\n<\/li>\n<\/ol>\n<h2><span class=\"ez-toc-section\" id=\"Cau-hinh-reverse-proxy-upstream-co-ban\"><\/span>C\u1ea5u h\u00ecnh reverse proxy &amp; upstream c\u01a1 b\u1ea3n<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Reverse proxy<\/strong> l\u00e0 m\u1ed9t trong nh\u1eefng \u1ee9ng d\u1ee5ng m\u1ea1nh m\u1ebd nh\u1ea5t c\u1ee7a Nginx. Nginx s\u1ebd nh\u1eadn request t\u1eeb client v\u00e0 chuy\u1ec3n ti\u1ebfp \u0111\u1ebfn m\u1ed9t server \u1ee9ng d\u1ee5ng backend (v\u00ed d\u1ee5: m\u1ed9t app Node.js ch\u1ea1y \u1edf port 3000).<\/p>\n<p>Kh\u1ed1i <code>upstream<\/code> cho ph\u00e9p b\u1ea1n \u0111\u1ecbnh ngh\u0129a m\u1ed9t nh\u00f3m c\u00e1c server backend.<\/p>\n<h3>M\u1eabu c\u1ea5u h\u00ecnh reverse proxy<\/h3>\n<p>\u0110\u00e2y l\u00e0 m\u1ed9t v\u00ed d\u1ee5 c\u1ea5u h\u00ecnh Nginx l\u00e0m reverse proxy cho m\u1ed9t \u1ee9ng d\u1ee5ng ch\u1ea1y \u1edf <code>localhost:3000<\/code>.<\/p>\n<pre><code class=\"language-plaintext\">upstream my_backend_app {\r\n    server 127.0.0.1:3000;\r\n    # Th\u00eam c\u00e1c server kh\u00e1c \u1edf \u0111\u00e2y \u0111\u1ec3 c\u00e2n b\u1eb1ng t\u1ea3i\r\n    # server 127.0.0.1:3001;\r\n}\r\n\r\nserver {\r\n    listen 80;\r\n    server_name your_domain.com;\r\n\r\n    location \/ {\r\n        proxy_pass http:\/\/my_backend_app;\r\n        proxy_set_header Host $host;\r\n        proxy_set_header X-Real-IP $remote_addr;\r\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n        proxy_set_header X-Forwarded-Proto $scheme;\r\n\r\n        # T\u00f9y ch\u1ecdn n\u00e2ng cao\r\n        proxy_read_timeout 90;\r\n        proxy_buffering off;\r\n    }\r\n}<\/code><\/pre>\n<ul>\n<li><code>proxy_pass<\/code>: Ch\u1ec9 th\u1ecb c\u1ed1t l\u00f5i, chuy\u1ec3n ti\u1ebfp request \u0111\u1ebfn upstream.<\/li>\n<li><code>proxy_set_header<\/code>: G\u1eedi c\u00e1c header quan tr\u1ecdng \u0111\u1ebfn backend \u0111\u1ec3 \u1ee9ng d\u1ee5ng bi\u1ebft \u0111\u01b0\u1ee3c th\u00f4ng tin g\u1ed1c c\u1ee7a request.<\/li>\n<li><code>proxy_buffering off<\/code>: H\u1eefu \u00edch cho c\u00e1c \u1ee9ng d\u1ee5ng streaming ho\u1eb7c c\u00f3 k\u1ebft n\u1ed1i long-polling.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Bat-HTTPS-voi-Lets-Encrypt-Certbot\"><\/span>B\u1eadt HTTPS v\u1edbi Let\u2019s Encrypt (Certbot)<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Trong m\u00f4i tr\u01b0\u1eddng production, HTTPS l\u00e0 b\u1eaft bu\u1ed9c. <strong>Certbot<\/strong> l\u00e0 c\u00f4ng c\u1ee5 gi\u00fap t\u1ef1 \u0111\u1ed9ng h\u00f3a vi\u1ec7c l\u1ea5y v\u00e0 gia h\u1ea1n ch\u1ee9ng ch\u1ec9 SSL mi\u1ec5n ph\u00ed t\u1eeb Let&#8217;s Encrypt.<\/p>\n<h3>C\u00e0i Certbot tr\u00ean Ubuntu\/CentOS<\/h3>\n<ul>\n<li><strong>Tr\u00ean Ubuntu:<\/strong>\n<pre><code class=\"language-plaintext\">sudo apt install certbot python3-certbot-nginx<\/code><\/pre>\n<\/li>\n<li><strong>Tr\u00ean CentOS:<\/strong>\n<pre><code class=\"language-plaintext\">sudo dnf install certbot python3-certbot-nginx<\/code><\/pre>\n<\/li>\n<\/ul>\n<h3>C\u1ea5p ch\u1ee9ng ch\u1ec9 &amp; c\u1ea5u h\u00ecnh t\u1ef1 \u0111\u1ed9ng<\/h3>\n<p>Ch\u1ea1y Certbot v\u1edbi plugin Nginx. Certbot s\u1ebd t\u1ef1 \u0111\u1ed9ng \u0111\u1ecdc c\u00e1c server block c\u1ee7a b\u1ea1n, c\u1ea5p ch\u1ee9ng ch\u1ec9 v\u00e0 s\u1eeda file c\u1ea5u h\u00ecnh \u0111\u1ec3 b\u1eadt HTTPS.<\/p>\n<pre><code class=\"language-plaintext\">sudo certbot --nginx -d your_domain.com -d www.your_domain.com<\/code><\/pre>\n<p>Certbot s\u1ebd h\u1ecfi b\u1ea1n m\u1ed9t v\u00e0i c\u00e2u h\u1ecfi, bao g\u1ed3m c\u1ea3 vi\u1ec7c c\u00f3 mu\u1ed1n t\u1ef1 \u0111\u1ed9ng chuy\u1ec3n h\u01b0\u1edbng HTTP sang HTTPS kh\u00f4ng (ch\u1ecdn t\u00f9y ch\u1ecdn n\u00e0y).<\/p>\n<p>Sau khi ho\u00e0n t\u1ea5t, Certbot c\u0169ng s\u1ebd t\u1ea1o m\u1ed9t timer systemd \u0111\u1ec3 t\u1ef1 \u0111\u1ed9ng gia h\u1ea1n ch\u1ee9ng ch\u1ec9 tr\u01b0\u1edbc khi h\u1ebft h\u1ea1n. B\u1ea1n c\u00f3 th\u1ec3 ki\u1ec3m tra b\u1eb1ng:<\/p>\n<pre><code class=\"language-plaintext\">systemctl status certbot.timer<\/code><\/pre>\n<h2><span class=\"ez-toc-section\" id=\"Toi-uu-hieu-suat-bao-mat-co-ban\"><\/span>T\u1ed1i \u01b0u hi\u1ec7u su\u1ea5t &amp; b\u1ea3o m\u1eadt c\u01a1 b\u1ea3n<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Sau khi c\u00e0i \u0111\u1eb7t, h\u00e3y \u00e1p d\u1ee5ng c\u00e1c tinh ch\u1ec9nh sau:<\/p>\n<ul>\n<li><strong>B\u1eadt n\u00e9n Gzip:<\/strong> Gi\u1ea3m k\u00edch th\u01b0\u1edbc file text (HTML, CSS, JS) g\u1eedi \u0111\u1ebfn client. Th\u00eam v\u00e0o kh\u1ed1i <code>http<\/code> trong <code>nginx.conf<\/code>:\n<pre><code class=\"language-plaintext\">gzip on;\r\ngzip_vary on;\r\ngzip_proxied any;\r\ngzip_comp_level 6;\r\ngzip_types text\/plain text\/css application\/json application\/javascript text\/xml application\/xml application\/xml+rss text\/javascript;<\/code><\/pre>\n<\/li>\n<li><strong>B\u1eadt HTTP\/2:<\/strong> T\u0103ng t\u1ed1c \u0111\u1ed9 t\u1ea3i trang qua multiplexing. Trong kh\u1ed1i <code>server<\/code>, s\u1eeda d\u00f2ng <code>listen<\/code>:\n<pre><code class=\"language-plaintext\">listen 443 ssl http2;<\/code><\/pre>\n<\/li>\n<li><strong>Thi\u1ebft l\u1eadp Cache cho n\u1ed9i dung t\u0129nh:<\/strong> Y\u00eau c\u1ea7u tr\u00ecnh duy\u1ec7t l\u01b0u cache c\u00e1c file t\u0129nh.\n<pre><code class=\"language-plaintext\">location ~* \\.(jpg|jpeg|png|gif|ico|css|js)$ {\r\n    expires 1y;\r\n}<\/code><\/pre>\n<\/li>\n<li><strong>\u1ea8n phi\u00ean b\u1ea3n Nginx:<\/strong> Tr\u00e1nh \u0111\u1ec3 l\u1ed9 th\u00f4ng tin cho k\u1ebb t\u1ea5n c\u00f4ng. Trong <code>nginx.conf<\/code>, th\u00eam <code>server_tokens off;<\/code>.<\/li>\n<li><strong>Th\u00eam Security Headers:<\/strong> Gi\u1ea3m thi\u1ec3u r\u1ee7i ro t\u1eeb c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng XSS, clickjacking.\n<pre><code class=\"language-plaintext\">add_header X-Frame-Options \"SAMEORIGIN\";\r\nadd_header X-Content-Type-Options \"nosniff\";<\/code><\/pre>\n<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Kiem-tra-xu-ly-loi-thuong-gap\"><\/span>Ki\u1ec3m tra &amp; x\u1eed l\u00fd l\u1ed7i th\u01b0\u1eddng g\u1eb7p<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>L\u1ed7i 403 Forbidden:<\/strong> Th\u01b0\u1eddng do quy\u1ec1n file\/th\u01b0 m\u1ee5c sai (<code>chmod<\/code>) ho\u1eb7c b\u1ecb SELinux (tr\u00ean CentOS) ch\u1eb7n.<\/li>\n<li><strong>L\u1ed7i 502 Bad Gateway:<\/strong> \u1ee8ng d\u1ee5ng backend (upstream) c\u1ee7a b\u1ea1n \u0111\u00e3 b\u1ecb s\u1eadp, kh\u00f4ng ch\u1ea1y ho\u1eb7c c\u1ea5u h\u00ecnh <code>proxy_pass<\/code> sai.<\/li>\n<li><strong><a href=\"https:\/\/interdata.vn\/blog\/504-gateway-time-out-la-loi-gi\/\">L\u1ed7i 504<\/a> Gateway Timeout:<\/strong> \u1ee8ng d\u1ee5ng backend m\u1ea5t qu\u00e1 nhi\u1ec1u th\u1eddi gian \u0111\u1ec3 x\u1eed l\u00fd request. C\u1ea7n t\u1ed1i \u01b0u code ho\u1eb7c t\u0103ng <code>proxy_read_timeout<\/code>.<\/li>\n<li><strong>L\u1ed7i <\/strong><code><strong>failed to bind 0.0.0.0:80<\/strong><\/code><strong>:<\/strong> M\u1ed9t d\u1ecbch v\u1ee5 kh\u00e1c (th\u01b0\u1eddng l\u00e0 Apache) \u0111ang chi\u1ebfm c\u1ed5ng 80. D\u00f9ng <code>sudo lsof -i :80<\/code> \u0111\u1ec3 ki\u1ec3m tra.<\/li>\n<li><strong>L\u1ed7i c\u00fa ph\u00e1p <\/strong><code><strong>nginx: [emerg]<\/strong><\/code><strong>:<\/strong> Lu\u00f4n ch\u1ea1y <code>sudo nginx -t<\/code> sau khi s\u1eeda file c\u1ea5u h\u00ecnh. L\u1ec7nh n\u00e0y s\u1ebd ch\u1ec9 r\u00f5 file v\u00e0 d\u00f2ng b\u1ecb l\u1ed7i.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Giam-sat-log-va-bao-tri-dinh-ky\"><\/span>Gi\u00e1m s\u00e1t, log v\u00e0 b\u1ea3o tr\u00ec \u0111\u1ecbnh k\u1ef3<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>Log:<\/strong> Th\u01b0\u1eddng xuy\u00ean ki\u1ec3m tra <code>\/var\/log\/nginx\/error.log<\/code> \u0111\u1ec3 ph\u00e1t hi\u1ec7n s\u1ef1 c\u1ed1.<\/li>\n<li><strong>Logrotate:<\/strong> H\u1ec7 th\u1ed1ng th\u01b0\u1eddng \u0111\u00e3 c\u1ea5u h\u00ecnh <code>logrotate<\/code> cho Nginx \u0111\u1ec3 n\u00e9n v\u00e0 xoay v\u00f2ng c\u00e1c file log c\u0169, tr\u00e1nh l\u00e0m \u0111\u1ea7y \u1ed5 \u0111\u0129a.<\/li>\n<li><strong>Reload an to\u00e0n:<\/strong> Lu\u00f4n d\u00f9ng <code>sudo systemctl reload nginx<\/code> thay v\u00ec <code>restart<\/code> \u0111\u1ec3 \u00e1p d\u1ee5ng c\u1ea5u h\u00ecnh m\u1edbi m\u00e0 kh\u00f4ng l\u00e0m m\u1ea5t c\u00e1c k\u1ebft n\u1ed1i hi\u1ec7n t\u1ea1i.<\/li>\n<li><strong>C\u1eadp nh\u1eadt:<\/strong> Th\u01b0\u1eddng xuy\u00ean ch\u1ea1y <code>apt upgrade<\/code> ho\u1eb7c <code>dnf update<\/code> \u0111\u1ec3 c\u1eadp nh\u1eadt Nginx l\u00ean phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t, v\u00e1 c\u00e1c l\u1ed7i b\u1ea3o m\u1eadt.<\/li>\n<li><strong>Backup:<\/strong> Sao l\u01b0u th\u01b0 m\u1ee5c <code>\/etc\/nginx\/<\/code> tr\u01b0\u1edbc khi th\u1ef1c hi\u1ec7n c\u00e1c thay \u0111\u1ed5i l\u1edbn.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Cau-hoi-thuong-gap-FAQ\"><\/span>C\u00e2u h\u1ecfi th\u01b0\u1eddng g\u1eb7p (FAQ)<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3>Nginx hay Apache ph\u00f9 h\u1ee3p cho WordPress\/website \u0111\u1ed9ng?<\/h3>\n<p>C\u1ea3 hai \u0111\u1ec1u ho\u1ea1t \u0111\u1ed9ng t\u1ed1t. Tuy nhi\u00ean, Nginx th\u01b0\u1eddng \u0111\u01b0\u1ee3c \u01b0a chu\u1ed9ng h\u01a1n khi k\u1ebft h\u1ee3p v\u1edbi PHP-FPM do hi\u1ec7u n\u0103ng x\u1eed l\u00fd request cao h\u01a1n. M\u1ed9t c\u1ea5u h\u00ecnh ph\u1ed5 bi\u1ebfn l\u00e0 d\u00f9ng Nginx l\u00e0m reverse proxy cho Apache \u0111\u1ec3 t\u1eadn d\u1ee5ng s\u1ee9c m\u1ea1nh c\u1ee7a c\u1ea3 hai.<\/p>\n<h3>C\u00f3 th\u1ec3 host nhi\u1ec1u website\/vhost tr\u00ean m\u1ed9t server Nginx kh\u00f4ng?<\/h3>\n<p>Ho\u00e0n to\u00e0n c\u00f3 th\u1ec3. B\u1ea1n ch\u1ec9 c\u1ea7n t\u1ea1o c\u00e1c file server block ri\u00eang bi\u1ec7t cho m\u1ed7i website nh\u01b0 \u0111\u00e3 h\u01b0\u1edbng d\u1eabn \u1edf tr\u00ean. Nginx s\u1ebd d\u00f9ng <code>server_name<\/code> \u0111\u1ec3 \u0111\u1ecbnh tuy\u1ebfn request \u0111\u1ebfn \u0111\u00fang th\u01b0 m\u1ee5c c\u1ee7a website \u0111\u00f3.<\/p>\n<h3>C\u00e1ch chuy\u1ec3n t\u1eeb Apache sang Nginx m\u00e0 kh\u00f4ng downtime?<\/h3>\n<p>C\u00e1ch an to\u00e0n l\u00e0 c\u00e0i \u0111\u1eb7t Nginx ch\u1ea1y tr\u00ean m\u1ed9t port kh\u00e1c (v\u00ed d\u1ee5: 8080). C\u1ea5u h\u00ecnh v\u00e0 ki\u1ec3m tra to\u00e0n b\u1ed9 website tr\u00ean port \u0111\u00f3. Khi m\u1ecdi th\u1ee9 \u0111\u00e3 s\u1eb5n s\u00e0ng, b\u1ea1n d\u1eebng Apache, \u0111\u1ed5i port c\u1ee7a Nginx v\u1ec1 80\/443 v\u00e0 kh\u1edfi \u0111\u1ed9ng l\u1ea1i Nginx. Qu\u00e1 tr\u00ecnh n\u00e0y ch\u1ec9 m\u1ea5t v\u00e0i gi\u00e2y.<\/p>\n<h3>Ch\u1ecdn Ubuntu hay CentOS\/Alma\/Rocky cho Nginx trong production?<\/h3>\n<p>C\u1ea3 hai \u0111\u1ec1u l\u00e0 l\u1ef1a ch\u1ecdn \u1ed5n \u0111\u1ecbnh. Ubuntu c\u00f3 chu k\u1ef3 ph\u00e1t h\u00e0nh nhanh h\u01a1n v\u00e0 c\u00e1c g\u00f3i ph\u1ea7n m\u1ec1m m\u1edbi h\u01a1n. CentOS\/RHEL n\u1ed5i ti\u1ebfng v\u1ec1 s\u1ef1 \u1ed5n \u0111\u1ecbnh v\u00e0 h\u1ed7 tr\u1ee3 d\u00e0i h\u1ea1n, ph\u00f9 h\u1ee3p cho m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p y\u00eau c\u1ea7u t\u00ednh nh\u1ea5t qu\u00e1n cao. L\u1ef1a ch\u1ecdn ph\u1ee5 thu\u1ed9c v\u00e0o s\u1ef1 quen thu\u1ed9c v\u00e0 ch\u00ednh s\u00e1ch c\u1ee7a \u0111\u1ed9i ng\u0169 qu\u1ea3n tr\u1ecb.<\/p>\n<h3>L\u00e0m sao b\u1eadt HTTP\/3 v\u00e0 t\u1ed1i \u01b0u TLS nhanh ch\u00f3ng?<\/h3>\n<p>HTTP\/3 y\u00eau c\u1ea7u Nginx \u0111\u01b0\u1ee3c bi\u00ean d\u1ecbch v\u1edbi th\u01b0 vi\u1ec7n QUIC. C\u00e1ch d\u1ec5 nh\u1ea5t l\u00e0 s\u1eed d\u1ee5ng c\u00e1c b\u1ea3n build t\u00f9y ch\u1ec9nh t\u1eeb c\u00e1c nh\u00e0 ph\u00e1t tri\u1ec3n c\u1ed9ng \u0111\u1ed3ng ho\u1eb7c d\u00f9ng c\u00e1c container <a href=\"https:\/\/interdata.vn\/blog\/docker-la-gi\/\">Docker<\/a> \u0111\u00e3 \u0111\u01b0\u1ee3c c\u1ea5u h\u00ecnh s\u1eb5n. T\u1ed1i \u01b0u TLS bao g\u1ed3m vi\u1ec7c ch\u1ecdn c\u00e1c b\u1ed9 m\u1eadt m\u00e3 (cipher suite) m\u1ea1nh v\u00e0 b\u1eadt OCSP Stapling.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Checklist-trien-khai-nhanh\"><\/span>Checklist tri\u1ec3n khai nhanh<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>S\u1eed d\u1ee5ng danh s\u00e1ch n\u00e0y \u0111\u1ec3 ki\u1ec3m tra nhanh c\u00e1c b\u01b0\u1edbc khi tri\u1ec3n khai:<\/p>\n<ol>\n<li>[ ] C\u1eadp nh\u1eadt h\u1ec7 th\u1ed1ng (<code>apt\/dnf update<\/code>).<\/li>\n<li>[ ] C\u00e0i \u0111\u1eb7t g\u00f3i Nginx.<\/li>\n<li>[ ] Kh\u1edfi \u0111\u1ed9ng v\u00e0 k\u00edch ho\u1ea1t d\u1ecbch v\u1ee5 Nginx.<\/li>\n<li>[ ] M\u1edf port 80\/443 tr\u00ean t\u01b0\u1eddng l\u1eeda (<code>ufw<\/code>\/<code>firewalld<\/code>).<\/li>\n<li>[ ] T\u1ea1o th\u01b0 m\u1ee5c webroot v\u00e0 g\u00e1n quy\u1ec1n.<\/li>\n<li>[ ] (CentOS) G\u00e1n context SELinux cho webroot.<\/li>\n<li>[ ] T\u1ea1o file c\u1ea5u h\u00ecnh server block cho t\u00ean mi\u1ec1n.<\/li>\n<li>[ ] (Ubuntu) K\u00edch ho\u1ea1t server block b\u1eb1ng symbolic link.<\/li>\n<li>[ ] Ki\u1ec3m tra c\u00fa ph\u00e1p (<code>nginx -t<\/code>).<\/li>\n<li>[ ] Reload Nginx.<\/li>\n<li>[ ] C\u00e0i \u0111\u1eb7t Certbot v\u00e0 l\u1ea5y ch\u1ee9ng ch\u1ec9 SSL.<\/li>\n<li>[ ] \u00c1p d\u1ee5ng c\u00e1c t\u1ed1i \u01b0u c\u01a1 b\u1ea3n (Gzip, HTTP\/2, Cache).<\/li>\n<li>[ ] Th\u01b0\u1eddng xuy\u00ean gi\u00e1m s\u00e1t log.<\/li>\n<\/ol>\n<p>N\u1ebfu b\u1ea1n \u0111ang t\u00ecm d\u1ecbch v\u1ee5 <a href=\"https:\/\/interdata.vn\/blog\/vps-la-gi\/\">VPS<\/a> Linux \u0111\u1ec3 tri\u1ec3n khai d\u1ef1 \u00e1n, h\u00e3y tham kh\u1ea3o <strong><a href=\"https:\/\/interdata.vn\/\">InterData<\/a><\/strong> \u2013 Nh\u00e0 cung c\u1ea5p VPS uy t\u00edn, ch\u1ea5t l\u01b0\u1ee3ng gi\u00e1 r\u1ebb h\u00e0ng \u0111\u1ea7u t\u1ea1i Vi\u1ec7t Nam.<\/p>\n<p><strong>\u0110\u1ec3 t\u00ecm hi\u1ec3u th\u00eam v\u1ec1 d\u1ecbch v\u1ee5, vui l\u00f2ng li\u00ean h\u1ec7 \u0111\u1ebfn InterData:<\/strong><\/p>\n<p><strong>\u2013 Hotline: 1900636822<\/strong><\/p>\n<p><strong>\u2013 Fanpage:<span>\u00a0<\/span><a href=\"https:\/\/www.facebook.com\/interdata.com.vn\" rel=\"nofollow noopener\" target=\"_blank\">https:\/\/www.facebook.com\/interdata.com.vn<\/a><\/strong><\/p>\n<p><strong>\u2013 Website:<span>\u00a0<\/span><a href=\"https:\/\/interdata.vn\/\">https:\/\/interdata.vn<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>B\u00e0i vi\u1ebft n\u00e0y c\u1ee7a InterData s\u1ebd h\u01b0\u1edbng d\u1eabn b\u1ea1n chi ti\u1ebft quy tr\u00ecnh c\u00e0i \u0111\u1eb7t v\u00e0 c\u1ea5u h\u00ecnh Nginx tr\u00ean hai h\u1ec7 \u0111i\u1ec1u h\u00e0nh m\u00e1y ch\u1ee7 ph\u1ed5 bi\u1ebfn nh\u1ea5t: Ubuntu v\u00e0 CentOS. Ch\u00fang t\u00f4i s\u1ebd \u0111i t\u1eeb nh\u1eefng kh\u00e1i ni\u1ec7m c\u01a1 b\u1ea3n, qua c\u00e1c b\u01b0\u1edbc c\u00e0i \u0111\u1eb7t c\u1ee5 th\u1ec3, \u0111\u1ebfn c\u00e1c k\u1ef9 thu\u1eadt n\u00e2ng cao<\/p>\n","protected":false},"author":2,"featured_media":32360,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49],"tags":[],"class_list":["post-32357","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vps"],"_links":{"self":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts\/32357","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/comments?post=32357"}],"version-history":[{"count":3,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts\/32357\/revisions"}],"predecessor-version":[{"id":32361,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts\/32357\/revisions\/32361"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/media\/32360"}],"wp:attachment":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/media?parent=32357"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/categories?post=32357"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/tags?post=32357"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}