On Rocky Linux, an Nginx server block maps a hostname and listening port to a document root or application upstream. To host several domains, install the Rocky-packaged Nginx, include a directory of enabled configuration files, create one server block per site, test with nginx -t, then reload Nginx. Firewalld, DNS, SELinux labels and (for HTTPS) certificate permissions must also be correct; otherwise a syntactically valid configuration can still be unreachable or return the wrong site.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an Nginx server block controls
A server { ... } block defines how Nginx handles requests arriving on a particular address and port. Its server_name values are compared with the hostname in the request’s Host header, and the matching block supplies the site root, index files, logging, TLS settings and request-handling rules. Nginx supports exact names, wildcard names and regular-expression names.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteFor a simple static site, the important directives are:
listenselects the port and address family.server_namelists the domain names handled by the block.rootpoints to the site’s files.indexidentifies the default file.locationrules decide whether a request serves a file, returns an error or is passed to an upstream application.access_loganderror_logkeep each site’s diagnostics separate.
The first matching rule is not simply “the first file alphabetically.” Listener address and port, exact-name precedence, wildcard precedence and regular-expression rules determine the result. A stock catch-all block can therefore display a default page when the intended name is misspelled or its configuration is not enabled.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prerequisites and the Rocky Linux package
This procedure assumes a Rocky Linux host on which you can use sudo, control system services and edit files under /etc. The Rocky Linux Web Services guidance dated September 11, 2024 recommends the Nginx package from Rocky’s repositories as the stable base. Older instructions that begin by adding a separate mainline repository do not describe the supported default path for that guide.
Install and start Nginx:
sudo dnf update
sudo dnf install nginx
sudo systemctl enable --now nginx
nginx -vThe main packaged configuration is /etc/nginx/nginx.conf. The default document root is commonly /usr/share/nginx/html/. Package revisions can change details, so confirm the installed version and inspect the active configuration on the target machine rather than assuming a guide written for another release.
Choose a maintainable multi-site layout
Rocky Linux does not require a particular “sites available/sites enabled” convention; the names are organizational choices. A clean layout keeps every site’s full configuration in /etc/nginx/sites-available/ and enables selected files with symbolic links in /etc/nginx/sites-enabled/.
-
Create both directories:
sudo mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled -
Edit the packaged configuration:
sudoedit /etc/nginx/nginx.conf -
Inside the existing
http { ... }block, add this include:include /etc/nginx/sites-enabled/*.conf; -
Inspect the stock configuration for a default
server { ... server_name _; ... }block. Comment it out or remove it when it would otherwise claim requests intended for your named sites.
Leaving an unused file in sites-available has no effect; only files linked into sites-enabled and matched by the include are loaded. This makes it possible to prepare a site, test it, and enable it with one link operation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCreate a site root and test page
Give each site its own directory. The following creates a root for site1.example, assigns ownership to the Nginx service account and writes a page that makes testing unambiguous:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo mkdir -p /usr/share/nginx/site1.example/html
sudo chown -R nginx:nginx /usr/share/nginx/site1.example
printf '<h1>site1.example</h1>n' | sudo tee /usr/share/nginx/site1.example/html/index.htmlUse a path that fits your host’s policy. If you later move content outside the standard locations, apply the persistent SELinux labeling procedure described below before diagnosing a 403 response as an Nginx problem.
Write and enable the first server block
Create /etc/nginx/sites-available/site1.example.conf with a separate HTTP listener for the site’s exact names:
server {
listen 80;
listen [::]:80;
server_name site1.example www.site1.example;
root /usr/share/nginx/site1.example/html;
index index.html;
location / {
try_files $uri $uri/ =404;
}
access_log /var/log/nginx/site1.example.access.log;
error_log /var/log/nginx/site1.example.error.log;
}The IPv4 and IPv6 listeners ensure that requests reaching either address family can be handled. The try_files rule serves an existing file or directory and returns a 404 instead of passing an unknown path elsewhere. The log paths are optional, but per-site logs make it much easier to separate a domain’s errors from other hosted sites.
Recommended Free Tools
Enable the file with a symbolic link:
sudo ln -s /etc/nginx/sites-available/site1.example.conf
/etc/nginx/sites-enabled/site1.example.confFor each additional domain or subdomain, create another file, give it the correct server_name values and root, then create a corresponding link. Do not copy a block without changing its names, paths and log files; otherwise two domains can serve the same content or write into the same diagnostics.
Validate before every reload
Always test the complete configuration before asking the running service to use it:
sudo nginx -t
sudo systemctl reload nginx
sudo systemctl status nginx --no-pagernginx -t reports the file and line containing syntax errors such as a missing semicolon, an unmatched brace or an invalid directive. Fix the reported line and run the test again. A reload applies a valid configuration without unnecessarily stopping workers; do not skip the test before a restart either, because an invalid replacement can interrupt service.
If Nginx refuses to start or reload, run sudo nginx -t first, then inspect the exact path and line it names. The status command supplies the systemd-level error, while the site’s error log can show request-time failures after the service is running.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Test names before public DNS is ready
Name-based routing depends on the hostname sent by the client. Opening the server’s bare IP address does not test a block whose server_name is site1.example; it may select a default block instead.
For a local test, add the domain and server IP to the workstation’s hosts file, then browse to the name. This simulates DNS while keeping the test private. Once public DNS is configured, verify that every A and, where used, AAAA record points to the intended host. A correct Nginx file cannot compensate for a record pointing at another server.
Keep multiple sites distinct
Use the same comparison points whenever you add or audit a site:
| Dimension | Static site block | Reverse-proxy site block |
|---|---|---|
| Hostname pattern | Exact or wildcard names that identify the files to serve | Names that identify the application receiving the request |
| Listening socket | Usually port 80, and 443 when TLS is enabled | The same public listeners; the upstream listens separately |
| Content handling | root, index and a try_files rule |
A location that passes requests to an upstream with proxy_pass |
| TLS policy | Certificate and key paths in the 443 block, optionally with an HTTP redirect | Certificate and key at Nginx; the application may have its own internal policy |
| Diagnostics | Dedicated access and error logs identify file-serving problems | Dedicated logs must be read with the upstream application’s logs |
| SELinux consideration | Content paths need an appropriate httpd_sys_content_t label |
Content labels still matter, and outbound network access may require a boolean |
| Firewall exposure | Permit the public HTTP/HTTPS services that clients use | Permit public services; keep the private upstream port restricted to the required local or trusted network |
These differences are per block, so one site’s certificate, root, proxy behavior or logs do not have to be shared with another site’s settings.
Free tools Windows power users keep installed
One-click scans. No signup required.
Open HTTP and HTTPS in firewalld
Nginx listening and network reachability are separate layers. Confirm that the service is bound to the expected port, then allow the corresponding services in firewalld:
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-servicesThe --permanent changes are not active until firewall-cmd --reload. Keep SSH permitted while editing zones. Removing SSH from a remote host can lock out the administrator before the web service is finished.
If Rocky Linux runs inside a container or another managed environment, the outer host may own the firewall policy. In that case, opening the guest’s firewalld alone is insufficient. Cloud security groups or network ACLs must also allow ports 80 and 443 when the host is behind a provider network.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Add HTTPS to each site
Rocky Linux’s HTTPS guidance requires adding or modifying a server block. After obtaining a certificate, create a 443 listener with the site’s names, certificate chain and private key:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name site1.example www.site1.example;
ssl_certificate /etc/letsencrypt/live/site1.example/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/site1.example/privkey.pem;
root /usr/share/nginx/site1.example/html;
index index.html;
location / { try_files $uri $uri/ =404; }
}The ssl parameter must be present on the 443 listening socket, and both certificate paths must point to readable files. Restrict private-key access while keeping the key readable by the Nginx master process, which loads it when the configuration is applied. A wrong path or overly restrictive permission commonly prevents a reload.
If all traffic should use HTTPS, keep a separate port-80 block for the same names and configure it to redirect to the HTTPS URL. Decide that redirect policy deliberately; a plain HTTP block is also useful during initial certificate and DNS testing.
For a certificate warning, check three things together: the requested hostname must match a name in the 443 block, the block must actually be enabled, and the certificate and key must belong together and be readable. If another 443 block is marked default_server, a request with an unexpected name can receive that block’s certificate instead.
Apply SELinux labels instead of disabling SELinux
SELinux can deny Nginx access even when Unix ownership and mode bits look correct. This is most common after moving a document root to a nonstandard path. Inspect a file’s current context with:
ls -Z /usr/share/nginx/site1.exampleCreate a persistent file-context rule and apply it recursively:
sudo semanage fcontext -a -t httpd_sys_content_t '/usr/share/nginx/site1.example(/.*)?'
sudo restorecon -Rv /usr/share/nginx/site1.exampleThe regular-expression suffix covers the directory and its contents, and the semanage rule survives relabeling or a reboot. Do not treat disabling SELinux as a routine fix; correct the label and inspect audit denials instead.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
A reverse proxy has a different SELinux requirement: Nginx must be allowed to make an outbound connection to the upstream. Inspect the audit log first and enable the boolean only when the proxy use case requires it:
sudo setsebool -P httpd_can_network_connect 1The -P option makes the boolean persistent. Limit this change to hosts that actually proxy to an upstream, and still verify the upstream socket or port independently.
Troubleshoot common failures
The wrong site appears
- Check the spelling of
server_name, including whether the client useswwwor the bare name. - Confirm the file is linked under
/etc/nginx/sites-enabled/and matched by the include inhttp { ... }. - Look for duplicate
default_serverlisteners or a stockserver_name _;block that still claims the request. - Verify DNS or the local hosts-file entry points to this machine, then run
sudo nginx -tand reload after corrections.
Nginx will not load the configuration
Run sudo nginx -t and fix the exact file and line reported. Missing semicolons, unmatched braces, duplicate listener declarations and invalid certificate paths should be corrected before any restart.
The page works locally but not remotely
Check that Nginx is listening on the expected address and port, firewalld lists http and https where required, and any cloud-provider security group permits 80 and 443. A successful request from the host itself does not prove that an external network path is open.
A moved document root returns 403 or files are missing
Inspect contexts with ls -Z, add the persistent semanage fcontext rule for the new path and run restorecon. Also verify that each parent directory permits traversal and that the root directive names the directory containing the expected files.
A reverse proxy returns 502
Confirm that the upstream process is running and that its socket or port matches proxy_pass. Then inspect SELinux audit messages and enable httpd_can_network_connect only if SELinux is blocking the required outbound connection.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →HTTPS shows a warning or the wrong certificate
Verify the enabled 443 block, certificate and key paths, private-key permissions and the requested hostname. A name that does not match server_name, or a request routed to another default 443 block, can produce a valid but unintended certificate.
Quick Recap
Operational checklist
- Install the Rocky repository package and enable Nginx at boot.
- Keep the packaged
/etc/nginx/nginx.confas the main entry point and include/etc/nginx/sites-enabled/*.confinsidehttp { ... }. - Give every domain its own root, names, logs and enabled configuration link.
- Remove or disable a catch-all default block when it would intercept named sites.
- Run
sudo nginx -tbefore every reload or restart. - Test with the actual hostname, using a hosts-file mapping before DNS is live if necessary.
- Open HTTP and HTTPS in the correct firewall layer, reload firewalld and preserve SSH access.
- For HTTPS, configure a 443 SSL listener, matching names, certificate chain and protected private key.
- For nonstandard roots, persist SELinux labels with
semanage fcontextand apply them withrestorecon. - For proxying, verify the upstream and enable the SELinux network-connect boolean only when required.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
