I would compare the nginx setup on the two machines if you have the old machine’s configuration backed up, if not I would do another cloudpanel install and compare them:
/etc/nginx/nginx.conf
/etc/nginx/sites-enabled/site
On one of my cloudpanel’s it has a LOT in nginx.conf:
user root;
worker_processes auto;
pid /run/nginx.pid;
worker_rlimit_nofile 8192;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 2000;
# multi_accept on;
}
http {
##
# Basic Settings
##
geoip_country /etc/nginx/geoip/GeoIP.dat; # the country IP database
geoip_city /etc/nginx/geoip/GeoLiteCity.dat; # the city IP database
real_ip_recursive on;
set_real_ip_from 127.0.0.1;
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from 0.0.0.0/0;
#real_ip_header X-Forwarded-For;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
log_format cloudflare '$http_cf_connecting_ip - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
sendfile on;
tcp_nopush on;
tcp_nodelay on;
client_body_buffer_size 1K;
client_header_buffer_size 1k;
client_max_body_size 64M;
keepalive_timeout 65;
types_hash_max_size 2048;
server_names_hash_bucket_size 128;
server_tokens off;
port_in_redirect off;
access_log off;
disable_symlinks if_not_owner from=/home/;
map $scheme $fastcgi_https { ## Detect when HTTPS is used
default off;
https on;
}
include /etc/nginx/blocked_ips;
pagespeed off;
pagespeed XHeaderValue 1;
##
# SSL Settings
##
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 10m;
ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
ssl_prefer_server_ciphers on;
ssl_conf_command Options KTLS;
# ssl_stapling on;
# ssl_stapling_verify on;
ssl_dhparam /etc/nginx/ssl/dhparams.pem;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
##
# Limit the requests for php
##
limit_req_zone $binary_remote_addr zone=limit:10m rate=1r/s;
##
# Gzip Settings
##
gzip on;
gzip_disable "msie6";
gzip_vary on;
gzip_proxied any;
gzip_comp_level 8;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript image/png image/gif image/jpeg application/javascript image/svg+xml;
##
# Brotli Settings
##
brotli on;
brotli_comp_level 8;
brotli_static on;
brotli_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript image/png image/gif image/jpeg application/javascript image/svg+xm
l;
##
# Virtual Host Configs
##
# Declare if request came from a trusted network (WAF).
# Added by Sucuri/GoDaddy WAF team.
# geo $realip_remote_addr $untrusted {
# default 1;
# 127.0.0.1 0;
# 192.88.134.0/23 0;
# 185.93.228.0/22 0;
# 66.248.200.0/22 0;
# 208.109.0.0/22 0;
# 2a02:fe80::/29 0;
# }
include /etc/nginx/sites-enabled/*.conf;
}
In one of the sites, domain name changed, can see:
server {
listen 80;
listen [::]:80;
listen 443 quic;
listen 443 ssl;
listen [::]:443 quic;
listen [::]:443 ssl;
http2 on;
http3 off;
ssl_certificate_key /etc/nginx/ssl-certificates/abc.org.key;
ssl_certificate /etc/nginx/ssl-certificates/abc.org.crt;
server_name www.abc.org;
return 301 https://abc.org$request_uri;
if ($http_x_sucuri_clientip = “”) {
return 403;
}
if ($http_x_sucuri_country = “”) {
return 403;
}
}
server {
listen 80;
listen [::]:80;
listen 443 quic;
listen 443 ssl;
listen [::]:443 quic;
listen [::]:443 ssl;
http2 on;
http3 off;
ssl_certificate_key /etc/nginx/ssl-certificates/abc.org.key;
ssl_certificate /etc/nginx/ssl-certificates/abc.org.crt;
server_name abc.org www1.abc.org;
root /home/abc/htdocs/abc.org;
access_log /home/abc/logs/nginx/access.log main;
error_log /home/abc/logs/nginx/error.log;
if ($scheme != “https”) {
rewrite ^ https://$host$request_uri permanent;
}
location ~ /.well-known {
auth_basic off;
allow all;
}
location / {
# Access control
allow 192.88.134.0/23;
allow 185.93.228.0/22;
allow 2a02:fe80::/29;
allow 66.248.200.0/22;
allow 208.109.0.0/22;
deny all;
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_hide_header X-Varnish;
proxy_redirect off;
proxy_max_temp_file_size 0;
proxy_connect_timeout 720;
proxy_send_timeout 720;
proxy_read_timeout 720;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
}
location ~* ^.+.(css|js|jpg|jpeg|gif|png|ico|gz|svg|svgz|ttf|otf|woff|woff2|eot|mp4|ogg|ogv|webm|webp|zip|swf|map|mjs)$ {
add_header Access-Control-Allow-Origin “*”;
add_header alt-svc ‘h3=“:443”; ma=86400’;
expires max;
access_log off;
}
location ~ /.(ht|svn|git) {
deny all;
}
if (-f $request_filename) {
break;
}
if ($http_x_sucuri_clientip = “”) {
return 403;
}
if ($http_x_sucuri_country = “”) {
return 403;
}
}
server {
listen 8080;
listen [::]:8080;
server_name abc.org www1.abc.org;
root /home/abc/htdocs/abc.org;
include /etc/nginx/global_settings;
try_files $uri $uri/ /index.php?$args;
index index.php index.html;
location ~ .php$ {
include fastcgi_params;
fastcgi_intercept_errors on;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
try_files $uri =404;
fastcgi_read_timeout 3600;
fastcgi_send_timeout 3600;
fastcgi_param HTTPS “on”;
fastcgi_param SERVER_PORT 443;
fastcgi_pass 127.0.0.1:14001;
fastcgi_param PHP_VALUE "
error_log=/home/abc/logs/php/error.log;
memory_limit=512M;
max_execution_time=300;
max_input_time=300;
max_input_vars=10000;
post_max_size=256M;
upload_max_filesize=128M;
date.timezone=UTC;
display_errors=off;";
if ($http_x_sucuri_clientip = “”) {
return 403;
}
if ($http_x_sucuri_country = “”) {
return 403;
}
}
if (-f $request_filename) {
break;
}
}
This might help.
Oh wow, seems like quite a task to compare them, perhaps I will get around to it one of these days. Perhaps some admin here already has, please comment!
