Nginx Avanzado: Optimización y Configuración Pro

Nginx básico funciona, pero Nginx optimizado vuela. Con la configuración correcta puedes servir miles de peticiones por segundo, cachear contenido y proteger tu servidor de ataques.

Esta guía te lleva al siguiente nivel con Nginx.

Estructura de configuración

Archivos importantes

/etc/nginx/
├── nginx.conf              # Config principal
├── sites-available/        # Configs disponibles
├── sites-enabled/          # Configs activas (symlinks)
├── conf.d/                 # Configs adicionales
├── snippets/               # Fragmentos reutilizables
└── mime.types              # Tipos MIME

nginx.conf optimizado

user www-data;
worker_processes auto;
pid /run/nginx.pid;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
    multi_accept on;
    use epoll;
}

http {
    # Básicos
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    server_tokens off;
    
    # Tamaños
    client_max_body_size 64M;
    client_body_buffer_size 128k;
    
    # MIME types
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # Logging
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
    
    # Gzip
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;
    
    # Includes
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

Compresión Gzip y Brotli

Gzip (incluido)

# En nginx.conf o en bloque http
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_min_length 1000;
gzip_types
    text/plain
    text/css
    text/xml
    text/javascript
    application/json
    application/javascript
    application/x-javascript
    application/xml
    application/xml+rss
    application/atom+xml
    image/svg+xml;

Brotli (más eficiente)

# Instalar módulo Brotli
sudo apt install libnginx-mod-brotli -y

# En nginx.conf
brotli on;
brotli_comp_level 6;
brotli_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;

Caché de archivos estáticos

Headers de caché

# /etc/nginx/snippets/cache-static.conf

# Imágenes, fuentes, etc. - 1 año
location ~* \.(jpg|jpeg|png|gif|ico|webp|svg|woff|woff2|ttf|eot)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    access_log off;
}

# CSS y JS - 1 mes (pueden cambiar)
location ~* \.(css|js)$ {
    expires 1M;
    add_header Cache-Control "public";
    access_log off;
}

# HTML - no cachear
location ~* \.(html|htm)$ {
    expires -1;
    add_header Cache-Control "no-store, no-cache, must-revalidate";
}

Usar snippet

server {
    # ...
    include snippets/cache-static.conf;
}

FastCGI Cache (caché de PHP)

Configurar zona de caché

# En nginx.conf, dentro de http {}
fastcgi_cache_path /var/cache/nginx/fastcgi 
    levels=1:2 
    keys_zone=FASTCGI:100m 
    inactive=60m 
    max_size=1g;
fastcgi_cache_key "$scheme$request_method$host$request_uri";

Activar en server block

server {
    # ...
    
    set $skip_cache 0;
    
    # No cachear POST
    if ($request_method = POST) {
        set $skip_cache 1;
    }
    
    # No cachear queries con parámetros
    if ($query_string != "") {
        set $skip_cache 1;
    }
    
    # No cachear admin ni login (WordPress)
    if ($request_uri ~* "/wp-admin/|/wp-login.php") {
        set $skip_cache 1;
    }
    
    # No cachear usuarios logueados
    if ($http_cookie ~* "wordpress_logged_in") {
        set $skip_cache 1;
    }
    
    location ~ \.php$ {
        # ... config PHP-FPM ...
        
        fastcgi_cache FASTCGI;
        fastcgi_cache_valid 200 60m;
        fastcgi_cache_bypass $skip_cache;
        fastcgi_no_cache $skip_cache;
        
        # Header para debug
        add_header X-FastCGI-Cache $upstream_cache_status;
    }
}

Limpiar caché

# Eliminar toda la caché
sudo rm -rf /var/cache/nginx/fastcgi/*

# O con script
#!/bin/bash
rm -rf /var/cache/nginx/fastcgi/*
echo "FastCGI cache limpiada"

Proxy Reverso

Proxy a aplicación Node.js

upstream nodejs_app {
    server 127.0.0.1:3000;
    keepalive 64;
}

server {
    listen 80;
    server_name app.tudominio.com;
    
    location / {
        proxy_pass http://nodejs_app;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        
        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}

Proxy con WebSockets

location /socket.io/ {
    proxy_pass http://nodejs_app;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_read_timeout 86400;
}

Proxy a múltiples apps

server {
    listen 80;
    server_name tudominio.com;
    
    # Frontend (React/Vue)
    location / {
        proxy_pass http://127.0.0.1:3000;
        # ... headers ...
    }
    
    # API Backend
    location /api/ {
        proxy_pass http://127.0.0.1:4000/;
        # ... headers ...
    }
    
    # WebSockets
    location /ws/ {
        proxy_pass http://127.0.0.1:5000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Load Balancing

Round Robin (defecto)

upstream backend {
    server 10.0.0.1:80;
    server 10.0.0.2:80;
    server 10.0.0.3:80;
}

server {
    location / {
        proxy_pass http://backend;
    }
}

Weighted (por capacidad)

upstream backend {
    server 10.0.0.1:80 weight=3;  # 3x más tráfico
    server 10.0.0.2:80 weight=2;
    server 10.0.0.3:80 weight=1;
}

IP Hash (sticky sessions)

upstream backend {
    ip_hash;
    server 10.0.0.1:80;
    server 10.0.0.2:80;
}

Health checks

upstream backend {
    server 10.0.0.1:80 max_fails=3 fail_timeout=30s;
    server 10.0.0.2:80 max_fails=3 fail_timeout=30s;
    server 10.0.0.3:80 backup;  # Solo si otros fallan
}

Rate Limiting

Limitar peticiones

# En http {}
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;

server {
    # API - 10 req/seg con burst de 20
    location /api/ {
        limit_req zone=api burst=20 nodelay;
        # ...
    }
    
    # Login - 1 req/seg (anti brute force)
    location /wp-login.php {
        limit_req zone=login burst=5;
        # ...
    }
}

Limitar conexiones

# En http {}
limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    # Máximo 10 conexiones simultáneas por IP
    limit_conn addr 10;
}

Headers de Seguridad

# /etc/nginx/snippets/security-headers.conf

# Prevenir clickjacking
add_header X-Frame-Options "SAMEORIGIN" always;

# Prevenir MIME sniffing
add_header X-Content-Type-Options "nosniff" always;

# XSS Protection
add_header X-XSS-Protection "1; mode=block" always;

# Referrer Policy
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Content Security Policy (ajustar según necesidad)
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';" always;

# Permissions Policy
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

# HSTS (solo con SSL)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

server {
    include snippets/security-headers.conf;
    # ...
}

Bloquear bots y ataques

Bloquear user agents maliciosos

# /etc/nginx/snippets/block-bots.conf

if ($http_user_agent ~* (wget|curl|libwww|python|nikto|scan|bot) ) {
    return 403;
}

# Bloquear referrers spam
if ($http_referer ~* (poker|casino|viagra|porn) ) {
    return 403;
}

Bloquear IPs

# /etc/nginx/conf.d/block-ips.conf
deny 1.2.3.4;
deny 5.6.7.0/24;

# O permitir solo algunas
location /admin/ {
    allow 10.0.0.0/8;
    allow 192.168.1.100;
    deny all;
}

Bloquear acceso a archivos sensibles

# Bloquear .htaccess, .git, etc.
location ~ /\. {
    deny all;
    access_log off;
    log_not_found off;
}

# Bloquear archivos de config
location ~* (wp-config\.php|\.env|composer\.json|package\.json) {
    deny all;
}

Logs avanzados

Formato personalizado

# En http {}
log_format detailed '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" '
                    '$request_time $upstream_response_time';

access_log /var/log/nginx/access.log detailed;

Logs condicionales

# No loguear assets estáticos
map $uri $loggable {
    ~*\.(jpg|jpeg|png|gif|ico|css|js|woff)$ 0;
    default 1;
}

access_log /var/log/nginx/access.log combined if=$loggable;

Logs por virtual host

server {
    server_name sitio1.com;
    access_log /var/log/nginx/sitio1.access.log;
    error_log /var/log/nginx/sitio1.error.log;
}

Snippets reutilizables

Crear snippets

# /etc/nginx/snippets/php-fpm.conf
location ~ \.php$ {
    try_files $uri =404;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
    fastcgi_read_timeout 300;
}

# /etc/nginx/snippets/ssl-params.conf
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;

Usar snippets

server {
    listen 443 ssl http2;
    
    ssl_certificate /etc/letsencrypt/live/tudominio.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/tudominio.com/privkey.pem;
    include snippets/ssl-params.conf;
    
    include snippets/php-fpm.conf;
    include snippets/security-headers.conf;
    include snippets/cache-static.conf;
}

Testing y debugging

# Verificar configuración
sudo nginx -t

# Recargar sin downtime
sudo nginx -s reload

# Ver conexiones activas
ss -tuln | grep :80

# Benchmark
ab -n 1000 -c 100 http://tudominio.com/

# Ver procesos Nginx
ps aux | grep nginx

# Logs en tiempo real
tail -f /var/log/nginx/error.log

Preguntas frecuentes

Nuestra recomendación

Optimizaciones esenciales:

1. Gzip/Brotli habilitado
2. Caché de estáticos (1 año)
3. Headers de seguridad
4. Rate limiting en login

Para alto tráfico:

• FastCGI cache
• worker_connections alto
• Logs condicionales
• Snippets organizados

¿Necesitas Nginx optimizado? El hosting de Avantys usa Nginx + LiteSpeed para máximo rendimiento.

---

Conclusión

Nginx bien configurado puede multiplicar el rendimiento de tu VPS. Empieza con compresión y caché de estáticos, añade headers de seguridad, y considera FastCGI cache para sitios de alto tráfico.

La clave está en medir, ajustar y monitorizar.

¿Necesitas un VPS con Nginx optimizado? Explora los VPS de Avantys con configuración profesional incluida.

---