Kunnskapsbase

This guide covers installing and configuring Nginx on AlmaLinux or Rocky Linux, including the firewalld and SELinux considerations specific to RHEL-family distributions.

Prerequisites

• AlmaLinux 9 or Rocky Linux 9 VPS
• Root or sudo access

Step 1 — Install Nginx

sudo dnf install nginx -y

Step 2 — Enable and Start Nginx

sudo systemctl enable --now nginx

Step 3 — Allow HTTP/HTTPS Through firewalld

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Step 4 — Test in a Browser

http://YOUR_SERVER_IP

You should see the default Nginx welcome page.

Key File Locations (Same as Ubuntu/Debian)

Note: AlmaLinux/Rocky Linux's Nginx package uses /etc/nginx/conf.d/*.conf directly, rather than Ubuntu/Debian's sites-available/sites-enabled symlink pattern.

Creating a Virtual Host

sudo nano /etc/nginx/conf.d/example.com.conf

server {
    listen 80;
    server_name example.com;
    root /var/www/example.com/html;
    index index.html;
}

sudo nginx -t
sudo systemctl reload nginx

Step 5 — Handling SELinux for Custom Web Roots

If you serve content from a directory outside the default web root, SELinux will block access by default even with correct file permissions:

sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/example.com/html(/.*)?"
sudo restorecon -Rv /var/www/example.com/html

If semanage isn't installed:

sudo dnf install policycoreutils-python-utils -y

Allowing Nginx to Make Network Connections (For Reverse Proxy Setups)

SELinux blocks Nginx from proxying to backend applications by default:

sudo setsebool -P httpd_can_network_connect 1

Required if using Nginx as a reverse proxy (see Nginx as a Reverse Proxy for Node.js/Docker Apps) on AlmaLinux/Rocky Linux.

Adding SSL with Certbot

sudo dnf install epel-release -y
sudo dnf install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com

Common Errors

403 Forbidden despite correct file permissions — almost always an SELinux context issue on AlmaLinux/Rocky Linux; run the semanage fcontext/restorecon commands above.

sudo ausearch -m avc -ts recent

Reviewing SELinux audit denials directly confirms whether SELinux is the actual blocker.

502 Bad Gateway on a reverse proxy setup — likely httpd_can_network_connect is disabled; enable it as shown above.

Best Practices

• Don't disable SELinux to work around permission issues — use the correct SELinux context commands instead
• Check ausearch -m avc whenever encountering an unexplained permission error
• Follow the same Nginx tuning and security practices covered for Ubuntu/Debian, adapted to this OS's paths

Continue Reading

• Understanding SELinux Basics on AlmaLinux/Rocky Linux
• How to Configure firewalld on AlmaLinux/Rocky Linux
• How to Set Up Let's Encrypt SSL on AlmaLinux/Rocky Linux

Browse more articles in AlmaLinux & Rocky Linux.