NGINX Open Source - Production Web Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

NGINX Open Source is the high-performance, BSD-licensed web server and reverse proxy that powers a large share of the busiest sites on the internet. This AMI delivers NGINX fully installed and configured from the official nginx.org APT repository on the mainline stable line - the line nginx.org recommends for new deployments. A production-grade web server and reverse proxy is running within minutes of launch, making it ideal for small engineering teams that need a reliable reverse proxy without building and maintaining their own machine image.

## What Is Included

• NGINX Open Source from the official nginx.org repository (mainline 1.27.x at build time), ensuring you receive upstream security patches faster than distro-packaged versions that often lag weeks or months behind.
• The web server is the only workload on the image - no bundled application runtime and no database - so the platform stays lean, predictable, and easy to reason about.
• A cloudimg default landing page served on first boot so you can confirm the server is healthy before deploying your own site.
• The stub_status monitoring endpoint enabled at /nginx_status, restricted to localhost by default for safety.
• A documented reverse-proxy starter configuration at /etc/nginx/conf.d/sample.conf.disabled, ready to be renamed, edited, and reloaded.

## Web Content on Its Own Volume

Customer web content lives on a dedicated, independently resizable EBS volume mounted at /var/www, with the document root at /var/www/html. Site files are kept separate from the operating system disk, so content can be grown, snapshotted, and backed up on its own schedule - unlike many competing AMIs that mix web content with the OS disk, making snapshots risky and rollbacks complex.

## AWS Integration Points

This AMI is designed to work within the broader AWS ecosystem:

• Amazon CloudWatch - Configure the CloudWatch agent to collect NGINX access and error logs, plus stub_status metrics, for centralized monitoring and alerting.
• AWS Certificate Manager (ACM) - Use ACM with an Application Load Balancer in front of NGINX for managed TLS certificates with automatic renewal, or install certificates from Let's Encrypt using Certbot directly on the instance.
• Elastic Load Balancing - Place NGINX instances behind an ALB or NLB for high availability and auto-scaling across Availability Zones.
• Amazon S3 - Serve static assets from S3 as an origin, using NGINX as a caching front end to reduce latency and origin load.
• Amazon VPC - Deploy within private subnets with security groups restricting inbound traffic to ports 80 and 443 only.

## Security Posture

• The stub_status monitoring endpoint is restricted to localhost - nothing sensitive is exposed until you explicitly open it.
• No shared or default application credentials ship in the image; NGINX itself is unauthenticated.
• Unattended security updates are enabled for the underlying OS packages.
• Data in transit is secured by configuring TLS using either ACM with a load balancer or Certbot on the instance. Data at rest is protected by enabling EBS encryption on both the OS and web content volumes at launch time.
• Security groups should restrict SSH access to trusted IP ranges and limit HTTP/HTTPS to expected sources.

## Example Scenario: TLS Termination for a Node.js Application Cluster

A development team running three Node.js application servers behind this NGINX instance configures the sample reverse-proxy file to upstream traffic across the app servers on port 3000. TLS is terminated at NGINX using a Let's Encrypt certificate managed by Certbot with automatic renewal. The stub_status endpoint feeds request-rate metrics into Amazon CloudWatch, triggering an Auto Scaling action when concurrent connections exceed a defined threshold. The result is a secure, observable entry point handling thousands of concurrent connections with minimal configuration effort.

## Ready to Use

The web server, document root, monitoring endpoint, and reverse-proxy starter are all configured. Browse to the instance address to confirm the default page, then replace it with your own site or enable the reverse-proxy configuration, add virtual hosts, and enable HTTPS as described in the user guide.

## cloudimg Support

24/7 technical support by email and live chat. Our engineers help with NGINX deployment, reverse proxy and load balancing configuration, performance tuning, virtual host setup, HTTPS configuration with Let's Encrypt or ACM, and CloudWatch integration. Critical issues receive a one-hour average response time.