Installation:
#
# nginx installation:
#
root@tealby:~# apt-get install --yes nginx
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Solving dependencies... Done
The following package was automatically installed and is no longer required:
pollinate
Use 'apt autoremove' to remove it.
The following additional packages will be installed:
nginx-common
Suggested packages:
fcgiwrap nginx-doc ssl-cert
The following NEW packages will be installed:
nginx nginx-common
0 upgraded, 2 newly installed, 0 to remove and 13 not upgraded.
Need to get 655 kB of archives.
After this operation, 1860 kB of additional disk space will be used.
Get:1 http://mirrors.digitalocean.com/ubuntu resolute-updates/main amd64 nginx-common all 1.28.3-2ubuntu1.10 [37.8 kB]
Get:2 http://mirrors.digitalocean.com/ubuntu resolute-updates/main amd64 nginx amd64 1.28.3-2ubuntu1.10 [617 kB]
Fetched 655 kB in 0s (4747 kB/s)
Preconfiguring packages ...
Selecting previously unselected package nginx-common.
(Reading database ... 132330 files and directories currently installed.)
Preparing to unpack .../nginx-common_1.28.3-2ubuntu1.10_all.deb ...
Unpacking nginx-common (1.28.3-2ubuntu1.10) ...
Selecting previously unselected package nginx.
Preparing to unpack .../nginx_1.28.3-2ubuntu1.10_amd64.deb ...
Unpacking nginx (1.28.3-2ubuntu1.10) ...
Setting up nginx-common (1.28.3-2ubuntu1.10) ...
Created symlink '/etc/systemd/system/multi-user.target.wants/nginx.service' → '/usr/lib/systemd/system/nginx.service'.
Setting up nginx (1.28.3-2ubuntu1.10) ...
* Upgrading binary nginx [ OK ]
Processing triggers for man-db (2.13.1-1build1) ...
Processing triggers for ufw (0.36.2-9build1) ...
Scanning processes...
Scanning candidates...
Scanning linux images...
Pending kernel upgrade!
Running kernel version:
7.0.0-27-generic
Diagnostics:
The currently running kernel version is not the expected kernel version 7.0.0-30-generic.
Restarting the system to load the new kernel will not be handled automatically, so you should consider
rebooting.
Restarting services...
Service restarts being deferred:
/etc/needrestart/restart.d/dbus.service
systemctl restart getty@tty1.service
systemctl restart networkd-dispatcher.service
systemctl restart serial-getty@ttyS0.service
systemctl restart systemd-logind.service
systemctl restart unattended-upgrades.service
No containers need to be restarted.
No user sessions are running outdated binaries.
No VM guests are running outdated hypervisor (qemu) binaries on this host.
root@tealby:~# systemctl status nginx.service
● nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
Active: active (running) since Fri 2026-08-21 14:00:39 UTC; 1min 47s ago
Invocation: 37a48f4a092f4879951b34d51f43af11
Docs: man:nginx(8)
Process: 55459 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
Process: 55461 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
Main PID: 55489 (nginx)
Tasks: 2 (limit: 453)
Memory: 2.9M (peak: 6.2M)
CPU: 79ms
CGroup: /system.slice/nginx.service
├─55489 "nginx: master process /usr/sbin/nginx -g daemon on; master_process on;"
└─55492 "nginx: worker process"
Aug 21 14:00:39 rocky systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Aug 21 14:00:39 rocky systemd[1]: Started nginx.service - A high performance web server and a reverse proxy server.
root@tealby:~# lsof -P -i TCP:80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 55489 root 5u IPv4 390403 0t0 TCP *:80 (LISTEN) ---only port 80 is listening
nginx 55489 root 6u IPv6 390404 0t0 TCP *:80 (LISTEN)
nginx 55492 www-data 5u IPv4 390403 0t0 TCP *:80 (LISTEN)
nginx 55492 www-data 6u IPv6 390404 0t0 TCP *:80 (LISTEN)
#
# certbot installation:
#
root@tealby:~# apt install --yes certbot python3-certbot-nginx
The following package was automatically installed and is no longer required:
pollinate
Use 'apt autoremove' to remove it.
Installing:
certbot python3-certbot-nginx
Installing dependencies:
python3-acme python3-configargparse python3-josepy python3-pytz
python3-certbot python3-icu python3-parsedatetime python3-rfc3339
Suggested packages:
python-certbot-doc python3-certbot-apache python-acme-doc python-certbot-nginx-doc
Summary:
Upgrading: 0, Installing: 10, Removing: 0, Not Upgrading: 16
Download size: 1248 kB
Space needed: 6391 kB / 5849 MB available
Get:1 http://mirrors.digitalocean.com/ubuntu resolute/universe amd64 python3-josepy all 2.2.0-1 [22.3 kB]
Get:2 http://mirrors.digitalocean.com/ubuntu resolute/universe amd64 python3-pytz all 2025.2-5 [32.4 kB]
Get:3 http://mirrors.digitalocean.com/ubuntu resolute/universe amd64 python3-rfc3339 all 2.0.1-2 [6530 B]
Get:4 http://mirrors.digitalocean.com/ubuntu resolute/universe amd64 python3-acme all 4.0.0-2 [49.3 kB]
Get:5 http://mirrors.digitalocean.com/ubuntu resolute/main amd64 python3-configargparse all 1.7-2 [31.7 kB]
Get:6 http://mirrors.digitalocean.com/ubuntu resolute/universe amd64 python3-parsedatetime all 2.6-3build1 [32.1 kB]
Get:7 http://mirrors.digitalocean.com/ubuntu resolute/universe amd64 python3-certbot all 4.0.0-4 [267 kB]
Get:8 http://mirrors.digitalocean.com/ubuntu resolute/universe amd64 certbot all 4.0.0-4 [91.5 kB]
Get:9 http://mirrors.digitalocean.com/ubuntu resolute/universe amd64 python3-certbot-nginx all 4.0.0-3 [67.7 kB]
Get:10 http://mirrors.digitalocean.com/ubuntu resolute/main amd64 python3-icu amd64 2.16.1-1build1 [647 kB]
Fetched 1248 kB in 0s (3335 kB/s)
Preconfiguring packages ...
Selecting previously unselected package python3-josepy.
(Reading database ... 132378 files and directories currently installed.)
Preparing to unpack .../0-python3-josepy_2.2.0-1_all.deb ...
Unpacking python3-josepy (2.2.0-1) ...
Selecting previously unselected package python3-pytz.
Preparing to unpack .../1-python3-pytz_2025.2-5_all.deb ...
Unpacking python3-pytz (2025.2-5) ...
Selecting previously unselected package python3-rfc3339.
Preparing to unpack .../2-python3-rfc3339_2.0.1-2_all.deb ...
Unpacking python3-rfc3339 (2.0.1-2) ...
Selecting previously unselected package python3-acme.
Preparing to unpack .../3-python3-acme_4.0.0-2_all.deb ...
Unpacking python3-acme (4.0.0-2) ...
Selecting previously unselected package python3-configargparse.
Preparing to unpack .../4-python3-configargparse_1.7-2_all.deb ...
Unpacking python3-configargparse (1.7-2) ...
Selecting previously unselected package python3-parsedatetime.
Preparing to unpack .../5-python3-parsedatetime_2.6-3build1_all.deb ...
Unpacking python3-parsedatetime (2.6-3build1) ...
Selecting previously unselected package python3-certbot.
Preparing to unpack .../6-python3-certbot_4.0.0-4_all.deb ...
Unpacking python3-certbot (4.0.0-4) ...
Selecting previously unselected package certbot.
Preparing to unpack .../7-certbot_4.0.0-4_all.deb ...
Unpacking certbot (4.0.0-4) ...
Selecting previously unselected package python3-certbot-nginx.
Preparing to unpack .../8-python3-certbot-nginx_4.0.0-3_all.deb ...
Unpacking python3-certbot-nginx (4.0.0-3) ...
Selecting previously unselected package python3-icu.
Preparing to unpack .../9-python3-icu_2.16.1-1build1_amd64.deb ...
Unpacking python3-icu (2.16.1-1build1) ...
Setting up python3-configargparse (1.7-2) ...
Setting up python3-parsedatetime (2.6-3build1) ...
Setting up python3-icu (2.16.1-1build1) ...
Setting up python3-pytz (2025.2-5) ...
Setting up python3-josepy (2.2.0-1) ...
Setting up python3-rfc3339 (2.0.1-2) ...
Setting up python3-acme (4.0.0-2) ...
Setting up python3-certbot (4.0.0-4) ...
Setting up certbot (4.0.0-4) ...
Created symlink '/etc/systemd/system/timers.target.wants/certbot.timer' → '/usr/lib/systemd/system/certbot.timer'.
Setting up python3-certbot-nginx (4.0.0-3) ...
Processing triggers for man-db (2.13.1-1build1) ...
Scanning processes...
Scanning candidates...
Scanning linux images...
Pending kernel upgrade!
Running kernel version:
7.0.0-27-generic
Diagnostics:
The currently running kernel version is not the expected kernel version 7.0.0-30-generic.
Restarting the system to load the new kernel will not be handled automatically, so you should consider
rebooting.
Restarting services...
Service restarts being deferred:
/etc/needrestart/restart.d/dbus.service
systemctl restart getty@tty1.service
systemctl restart networkd-dispatcher.service
systemctl restart serial-getty@ttyS0.service
systemctl restart systemd-logind.service
systemctl restart unattended-upgrades.service
No containers need to be restarted.
No user sessions are running outdated binaries.
No VM guests are running outdated hypervisor (qemu) binaries on this host.
Configuration:
root@tealby:~# ls -ld /etc/nginx/sites-available
drwxr-xr-x 2 root root 4096 Aug 21 14:00 /etc/nginx/sites-available
root@tealby:~# ls -l /etc/nginx/sites-available
-rw-r--r-- 1 root root 2412 Mar 27 14:26 default
root@tealby:~# ls -ld /etc/nginx/sites-enabled
drwxr-xr-x 2 root root 4096 Aug 21 14:00 /etc/nginx/sites-enabled
root@tealby:~# ls -l /etc/nginx/sites-enabled
lrwxrwxrwx 1 root root 34 Aug 21 14:00 default -> /etc/nginx/sites-available/default
}root@tealby:~# rm /etc/nginx/sites-enabled/default
root@tealby:~# ls -l /etc/nginx/sites-enabled
total 0
root@tealby:~# vi /etc/nginx/sites-available/hugo
::
::
root@tealby:~# cat /etc/nginx/sites-available/hugo
[[blue:server {]]
[[blue: listen 80;]]
[[blue: server_name hugo.kmaau.com;]]
[[blue: location / {]]
[[blue: proxy_pass http://127.0.0.1:1313;]]
[[blue: proxy_set_header Host $host;]]
[[blue: proxy_set_header X-Real-IP $remote_addr;]]
[[blue: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;]]
[[blue: proxy_set_header X-Forwarded-Proto $scheme;]]
[[blue: }]]
[[blue:}]]
root@tealby:~# (cd /etc/nginx/sites-enabled; ln -nfs ../sites-available/hugo)
root@tealby:~# ls -l /etc/nginx/sites-enabled
lrwxrwxrwx 1 root root 23 Aug 22 04:39 hugo -> ../sites-available/hugo
root@tealby:~# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
root@tealby:~# systemctl reload nginx.service
#
# certbot configuration:
#
root@tealby:~# certbot --nginx -d hugo.kmaau.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
(Enter 'c' to cancel): [[yellow:kianming.aau@gmail.com]]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.8-July-06-2026.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: [[yellow:Y]]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: [[yellow:Y]]
Account registered.
Requesting a certificate for hugo.kmaau.com
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/hugo.kmaau.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/hugo.kmaau.com/privkey.pem
This certificate expires on 2026-11-20.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate
Successfully deployed certificate for hugo.kmaau.com to /etc/nginx/sites-enabled/hugo
Congratulations! You have successfully enabled HTTPS on https://hugo.kmaau.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
root@tealby:~# cat /etc/nginx/sites-available/hugo
[[blue:server {]]
[[blue: server_name hugo.kmaau.com;]]
[[blue: location / {]]
[[blue: proxy_pass http://127.0.0.1:1313;]]
[[blue: proxy_set_header Host $host;]]
[[blue: proxy_set_header X-Real-IP $remote_addr;]]
[[blue: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;]]
[[blue: proxy_set_header X-Forwarded-Proto $scheme;]]
[[blue: }]]
[[blue: listen 443 ssl; # managed by Certbot]]
[[blue: ssl_certificate /etc/letsencrypt/live/hugo.kmaau.com/fullchain.pem; # managed by Certbot]]
[[blue: ssl_certificate_key /etc/letsencrypt/live/hugo.kmaau.com/privkey.pem; # managed by Certbot]]
[[blue: include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot]]
[[blue: ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot]]
[[blue:}]]
[[blue:server {]]
[[blue: if ($host = hugo.kmaau.com) {]]
[[blue: return 301 https://$host$request_uri;]]
[[blue: } # managed by Certbot]]
[[blue: server_name hugo.kmaau.com;]]
[[blue: listen 80;]]
[[blue: return 404; # managed by Certbot]]
[[blue:}]]
root@tealby:~# lsof -P -i TCP:80,443
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 288821 root 5u IPv4 2831402 0t0 TCP *:80 (LISTEN)
nginx 288821 root 10u IPv4 2839604 0t0 TCP *:443 (LISTEN) ---port 443 is also listening
nginx 289685 www-data 5u IPv4 2831402 0t0 TCP *:80 (LISTEN)
nginx 289685 www-data 10u IPv4 2839604 0t0 TCP *:443 (LISTEN)