Sites

1. Sites, then New site.
2. Give it a name. This is for you and visitors never see it.
3. Under Server names, put the address people will type, such as www.example.com.
4. Choose Proxy as the mode and pick a pool.
5. Press Create site, then Apply config when you are ready.

Put both names on one site, with the one you want to win listed first, and turn on Send the rest to the first one.

Serving both as if they were separate means a search engine sees two copies of every page. The same switch does www to bare or bare to www, depending on which you listed first.

Put *.example.com in the server names. You will need a wildcard certificate to serve it over https, which means dns-01 validation.

Tick Default site on one site. It answers anything whose Host header does not match another site.

Without one, nginx uses whichever server block it loaded first, which is usually not what you meant and moves around as you add sites. People who find your server by its IP then get a random one of your sites. A default that returns a plain 404 keeps that tidy.

Untick Enabled and apply. A disabled site is left out of the configuration entirely and can be put back with one click. Everything about it is kept.

Delete removes it at the next apply. The pools it used are left alone, because other sites may be using them. If you only want it gone for a while, disable it instead.

Make a site with the old names on it, set the mode to Redirect, and give it the target. Choose permanent only when the move is really final, because browsers cache a 301 aggressively and some of them for a very long time.

The generated config keeps the certificate challenge path out of the redirect, so renewal keeps working. Doing this by hand is the usual way renewal quietly breaks.

Set the site or the path to Static and give it a folder. Files have to be on every node, because either node can serve. Keep them in a folder you deploy to both.

Two ways, and the second is better.

• Quick: switch the site mode to Static and point it at a folder with one page in it. Change it back afterwards.
• Better: add a backup member to the pool serving a holding page, and drain the real members. Then the site keeps working for anything that is still up.

Open the site and press Clone this site. You get a copy with everything the same, ready to rename. Change the server names before you apply, because two sites answering for one name is refused.

Open the site, go to the nginx config tab, and turn on Let me write this server block myself. The forms stop driving that site while it is in that mode, so the two cannot fight over the same file.

It goes through the same checks as everything else: nginx tests it on this node before it is even saved, and every node stages and tests it at apply time. The worst case is config that refuses to save.

Each site has a raw configuration box at the bottom. What you put there is stored with the site and survives every apply, which is why it exists and why editing the generated files does not work.

Use the Check it button every time you touch it. Raw config is checked for syntax and not for sense, so a directive that is valid but wrong will apply cleanly and behave strangely.

Turn on Redirect http to https. Leave Listen on http on, because certificate renewal needs port 80 to answer and the redirect already means no real visitor stays there.

HTTP/2 is on by default for https sites. HTTP/3 is available because the build includes the module, and it is a tick box on the site settings tab. Check that UDP 443 is open, because QUIC does not use TCP.

Tick Management network only on the site. It writes an allow line for every node in the cluster plus the management networks from Settings, then deny all. The node list is generated from the roster, so a node you add later lands in it on its own.

Run PHP on your own server and put this in front of it as a normal proxy. Point a pool at the web server that runs the PHP, and the site at the pool. Nothing special is needed.

Two things to get right:

• Raise Maximum upload size under Limits and Timeouts to match what PHP itself allows, or the load balancer refuses uploads that PHP would have accepted.
• Raise Read timeout under Proxy if the site has a slow admin screen, which most content systems do.

Do not try to run PHP on the load balancer. It is a load balancer, and putting an application runtime on the box that fronts every site is exactly the concentration of risk this design exists to avoid.

Open the site, Settings tab, tick Show advanced settings, go to Advanced and use Response text replacement. Say what to look for and what to put in its place.

Genuinely useful for a staging copy of an application that writes its production address into every link, or for an appliance you cannot change that hardcodes its own hostname.

It reads and rewrites every response body it applies to, so it is not free, and it will happily corrupt a compressed or binary response if you point it at one. Use it on a path, on HTML only, and treat it as a patch rather than a fix.

For something like robots.txt, security.txt or a verification file: add a path, matched with Is exactly this, set What happens to Serve files from disk, and point it at the folder holding the file.

It never reaches the backend, so it keeps working during a deploy and while the application is down. That is the point for a verification file, which somebody else fetches on their own schedule and without warning.