VPS-এ Domain ও SSL Connect

🌐 Domain → VPS Connection

1. Domain registrar বা Cloudflare-এ যান
2. DNS Records:

   A   @     1.2.3.4 (your VPS IP)
   A   www   1.2.3.4
   A   api   1.2.3.4

3. Propagation: 5-60 min (Cloudflare 1 min)
4. Verify: dig example.com

🔧 Nginx Server Block

# /etc/nginx/sites-available/example.com
server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    }
}

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

🔒 Lets Encrypt SSL (Certbot)

sudo apt install certbot python3-certbot-nginx -y

sudo certbot --nginx -d example.com -d www.example.com
# Email + Agree → automatic
# Nginx config auto-update with SSL block

# Test renewal
sudo certbot renew --dry-run

# Cron auto-renew (already setup by certbot, verify)
sudo systemctl status certbot.timer
sudo cat /etc/cron.d/certbot

🌟 Wildcard SSL

sudo certbot certonly --manual \
  --preferred-challenges=dns \
  --email you@email.com \
  --agree-tos \
  -d example.com -d *.example.com

# Need DNS TXT record (Cloudflare automate)
# OR use cloudflare plugin:
sudo apt install python3-certbot-dns-cloudflare
sudo certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials ~/.cf.ini \
  -d "*.example.com" -d example.com

🔄 Redirects

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    server_name www.example.com;
    # ... ssl certs
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;
    # ... actual site
}

🛡️ Security Headers

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Content-Security-Policy "default-src self; script-src self https:" always;

🌐 Multiple Domain

sudo certbot --nginx \
  -d site1.com -d www.site1.com \
  -d site2.com -d api.site2.com

# Each domain → separate /etc/nginx/sites-available/ file
# All certs renewed by single cron

🎓 মূল কথা ⭐

DNS A record → Nginx server block → Certbot SSL — 5 min in production। Auto-renewal automatic by certbot। HTTPS redirect mandatory।