The reliable way to host several domains on Rocky Linux is to give each site its own Nginx server block. Each block matches a hostname and listening port, then defines the document root, request handling, logs, and—when needed—TLS or a reverse-proxy upstream. Install Nginx from Rocky’s repositories, organize per-site files under /etc/nginx/sites-available/, enable them with links in /etc/nginx/sites-enabled/, test with nginx -t, and only then reload the service.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide follows the Rocky Linux package layout and the documented multisite approach. Package versions, DNS, certificates, cloud security groups, and application ports vary by host, so verify those details on the server you are configuring.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What an Nginx server block does
A server block is Nginx’s virtual-host configuration. It associates one or more hostnames and a listening address with a set of rules. When a request arrives, Nginx examines the address and port, then compares the request’s Host header with server_name. The matching block supplies the content root or proxy destination, logging paths, TLS settings, and location rules.
Names can be exact, wildcard, or regular-expression patterns. Exact names are usually easiest to audit:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
server_name site1.example www.site1.example;A request for a hostname that does not match a more specific name can fall into the default server for that address and port. That is why the stock catch-all block can appear to “steal” requests from a newly configured site.
Prerequisites and package installation
You need a Rocky Linux host with administrative access, a hostname that will resolve to the host (or a temporary entry in your workstation’s hosts file), and ports 80 and 443 available if you intend to serve HTTP and HTTPS. The Rocky Linux guide dated September 11, 2024 recommends the Nginx package from Rocky’s repositories as the stable starting point; older instructions aimed at a separate mainline repository do not describe the current supported default path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Update package metadata and install Nginx:
sudo dnf update
sudo dnf install nginx- Enable Nginx at boot and start it immediately:
sudo systemctl enable --now nginx- Confirm the installed version:
nginx -vThe main configuration file is /etc/nginx/nginx.conf. A default static root is commonly under /usr/share/nginx/html/. Do not assume that every server uses the same package version or local policy; inspect the active configuration on the target host.
Choose a predictable multi-site layout
Rocky’s multisite documentation uses two directories:
/etc/nginx/sites-available/stores configuration files that are prepared but not necessarily active./etc/nginx/sites-enabled/contains symbolic links to the files that Nginx should load.
These names are conventions rather than requirements. The important part is that the enabled directory is included from the http context and that only intended files are linked there.
Create the directories:
sudo mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabledOpen the main configuration:
sudoedit /etc/nginx/nginx.confInside the existing http { ... } block, add this include:
include /etc/nginx/sites-enabled/*.conf;Check the same file for the distribution’s stock server { ... server_name _; ... } block. Comment it out or remove it when it would otherwise become the default for requests intended for your named sites. Keep a deliberate default block only if you understand which unmatched requests it should handle. The exact folder and filename conventions are optional, but a consistent layout makes audits and rollback much safer.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Create a site root and a test page
Give each domain a separate root so files, ownership, logs, and future deployment steps do not overlap. For the example domain:
sudo mkdir -p /usr/share/nginx/site1.example/html
sudo chown -R nginx:nginx /usr/share/nginx/site1.example
printf '<h1>site1.example</h1>n' | sudo tee /usr/share/nginx/site1.example/html/index.htmlThe path is an example, not a requirement. You can use another location that fits your host’s storage and deployment policy. If it is outside the paths already labeled for web content, apply a persistent SELinux context before testing, as described later.
Write the first HTTP server block
Create /etc/nginx/sites-available/site1.example.conf with a complete, minimal block:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsserver {
listen 80;
listen [::]:80;
server_name site1.example www.site1.example;
root /usr/share/nginx/site1.example/html;
index index.html;
location / {
try_files $uri $uri/ =404;
}
access_log /var/log/nginx/site1.example.access.log;
error_log /var/log/nginx/site1.example.error.log;
}How each directive affects requests
listen 80;accepts IPv4 HTTP connections on port 80.listen [::]:80;accepts IPv6 HTTP connections when IPv6 is enabled on the host.server_namelists the names that should select this block. Use every DNS name that clients will send, including awwwalias only if you intend to serve it.rootmaps the URL path to files below the site directory.indexidentifies the file returned for a directory request.try_filesserves an existing file or directory and returns 404 instead of passing an unknown path to another handler.- The per-site logs make it possible to diagnose one domain without mixing its traffic with other sites.
Enable the file with a symbolic link:
sudo ln -s /etc/nginx/sites-available/site1.example.conf
/etc/nginx/sites-enabled/site1.example.confFor a second domain, create another root and another configuration file with its own server_name, root, and log paths. Do not combine unrelated sites merely to reduce the number of files; separate blocks make differences in TLS, proxying, and access policy visible.
Validate before every reload
Always test the complete configuration before asking Nginx to reload it:
sudo nginx -tA successful test reports that the syntax is okay and the test is successful. A missing semicolon, misspelled directive, invalid include, or unreadable certificate will be reported with the file and line number. Correct that exact location and run the test again. Only after a successful test should you reload:
sudo systemctl reload nginx
sudo systemctl status nginx --no-pagerA reload lets existing workers finish current requests while new workers use the corrected configuration. A restart is more disruptive and should not be your first response to a configuration change. If Nginx will not start after a failed change, restore the last known-good file, run nginx -t, and then start or reload the service.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Test name matching before changing DNS
DNS must send the requested hostname to the Rocky host for normal clients to select the intended block. During setup, you can simulate that result by adding the domain and server IP to the workstation’s hosts file. Then request the hostname in a browser or with an HTTP client and verify that the page contains the marker from the test file.
Also inspect the server’s effective configuration when behavior is surprising:
sudo nginx -TThis prints the parsed configuration, including included files, so you can confirm that the symbolic link is valid and that no duplicate listener or catch-all block is taking precedence. Remove or correct stale links rather than editing a file that is not actually included.
Open HTTP and HTTPS in firewalld
Two separate conditions control reachability: Nginx must be listening, and the firewall must permit the traffic. On a host managed directly with firewalld, add the services permanently and then reload the firewall:
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-servicesThe --permanent changes do not affect the running firewall until firewall-cmd --reload. Keep SSH allowed while editing zones. Removing SSH from a remote server’s active zone can lock out the administrator before the web configuration is finished.
If Rocky runs inside a container or virtual machine, the host, orchestration layer, or cloud security group may own the external firewall policy. In that case, verify all layers: the container’s Nginx listener, the guest firewall, the host’s forwarding rules, and any provider rule allowing ports 80 and 443.
Add HTTPS to each site
Rocky Linux’s web-services documentation states that an HTTPS service requires a server block or a modification to an existing one. After you have obtained a certificate and its private key, add a TLS listener for the same names:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name site1.example www.site1.example;
ssl_certificate /etc/letsencrypt/live/site1.example/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/site1.example/privkey.pem;
root /usr/share/nginx/site1.example/html;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}The ssl parameter must be present on the 443 listener, and both certificate paths must point to readable files. Protect the private key with restrictive permissions while ensuring that the Nginx master process can read it. Do not place private keys in a web root or make them world-readable.
Free tools Windows power users keep installed
One-click scans. No signup required.
To enforce HTTPS, keep a separate port-80 block for the same hostnames and redirect requests:
server {
listen 80;
listen [::]:80;
server_name site1.example www.site1.example;
return 301 https://$host$request_uri;
}Use a redirect only when every URL is intended to be HTTPS and the certificate covers every name in the block. After editing, run sudo nginx -t, reload Nginx, and confirm that the requested hostname matches the certificate’s names. A certificate for one domain cannot safely serve an unrelated domain merely because both blocks share an IP address.
Keep SELinux enforcing while serving files
SELinux can deny Nginx access even when Unix ownership and mode bits look correct. This is expected protection, not a reason to disable SELinux.
Label a nonstandard document root
For a root outside the standard labeled paths, define a persistent file-context rule and apply it:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallsudo semanage fcontext -a -t httpd_sys_content_t '/usr/share/nginx/site1.example(/.*)?'
sudo restorecon -Rv /usr/share/nginx/site1.exampleThe regular expression covers the directory and its contents. Check labels when diagnosing permission errors:
ls -Z /usr/share/nginx/site1.example/htmlA persistent semanage fcontext rule survives relabeling; manually changing a context without a rule can be undone later.
Allow a reverse proxy to reach its upstream
A static site normally needs no outbound network permission. A block using proxy_pass may need SELinux’s network-connect boolean:
sudo setsebool -P httpd_can_network_connect 1Enable it only for a proxy use case that requires it. Before changing policy, inspect audit denials and confirm that the upstream address and port are correct. A narrow policy change is preferable to disabling SELinux globally.
Use a server block as a reverse proxy
The same hostname-matching model can front an application rather than static files. Replace the file-serving location with a proxy location and keep the site-specific logs:
server {
listen 80;
listen [::]:80;
server_name app.example;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
access_log /var/log/nginx/app.example.access.log;
error_log /var/log/nginx/app.example.error.log;
}The upstream process must actually be listening on the address and port. If the application binds only to a Unix socket, use the socket path supported by that application and check its ownership and SELinux labeling. A 502 response usually means that Nginx cannot connect to the configured upstream, the process is down, or SELinux is blocking the connection.
Compare site blocks with the same checklist
As the number of domains grows, review each block using identical axes. The table below shows what should be explicit for a static site, a proxied application, and an HTTPS-enabled site.
| Configuration axis | Static HTTP site | Reverse-proxy site | HTTPS site |
|---|---|---|---|
| Hostname pattern | Exact or wildcard names in server_name |
Exact or wildcard names in server_name |
Names covered by the certificate and block |
| Listener | Port 80, optionally IPv4 and IPv6 | Port 80, optionally IPv4 and IPv6 | Port 443 with ssl, optionally IPv4 and IPv6 |
| Request destination | root plus try_files |
proxy_pass plus forwarded headers |
Static root or proxy settings under TLS |
| TLS policy | Not used unless redirecting | Usually terminates TLS at Nginx when public | Certificate and private-key paths; optional port-80 redirect |
| Logs | Separate access and error files | Separate access and error files | Separate files or a deliberate shared policy |
| SELinux | Content label for nonstandard roots | Content label plus network-connect policy when required | Readable certificate and key paths with appropriate labels and permissions |
| Firewall exposure | HTTP service on port 80 | HTTP or HTTPS according to the public design | HTTPS service on port 443, and HTTP only if redirecting |
Troubleshoot the common failures
The wrong site appears
- Check the requested hostname spelling, including the
wwwprefix. - Confirm DNS or the temporary hosts-file entry points to the intended server.
- Look for more than one
default_serveron the same address and port. - Verify that the intended file is linked below
/etc/nginx/sites-enabled/and included bynginx -T. - Remove a stock
server_name _;block when it is claiming traffic that should match a named block.
Nginx refuses to load a configuration
Run sudo nginx -t and fix the first reported file and line. Typical causes include a missing semicolon, a directive in the wrong context, a broken symbolic link, or a certificate path that does not exist. Do not reload until the test succeeds.
Recommended Free Tools
The page works locally but not remotely
- Confirm that Nginx is listening with the expected address and port.
- Check that firewalld lists
httpand/orhttpsin the active zone. - Confirm that you ran
firewall-cmd --reloadafter permanent changes. - Check any cloud-provider security group, load balancer rule, or host firewall for ports 80 and 443.
- Preserve SSH access while changing remote firewall policy.
A moved document root returns 403 or missing files
Inspect the context with ls -Z, add the persistent semanage fcontext rule, and run restorecon. Then verify directory traversal permissions and the Nginx worker’s ability to read the files. Do not solve a labeling problem by disabling SELinux.
A proxied application returns 502
Check that the upstream process is running and listening on the exact address or socket named in proxy_pass. Test the upstream locally, inspect the Nginx error log, and review SELinux audit messages. Enable httpd_can_network_connect only when the denial and proxy design justify it.
HTTPS shows a warning or the wrong certificate
- Confirm that the request reaches the intended 443 listener.
- Check that
server_namematches the hostname entered by the client. - Verify the certificate and private-key paths and their permissions.
- Ensure the certificate covers every name listed in the block.
- Run
nginx -tafter every certificate-path change and reload only after a successful test.
Operate the layout safely
Keep one source file per site, use descriptive names, and treat the symbolic link as the enable/disable switch. To disable a site without deleting its configuration, remove only the link and test the result:
sudo rm /etc/nginx/sites-enabled/site1.example.conf
sudo nginx -t
sudo systemctl reload nginxBefore editing production files, copy the last known-good version or use version control. Review changes for duplicate listeners, unintended wildcards, exposed private files, and paths that do not exist on the host. Recheck package and TLS details periodically because repository contents and certificate tooling change over time; the procedural baseline here should be verified against the target Rocky Linux release after substantial updates.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Final verification checklist
- Nginx is installed from the intended Rocky repository and enabled at boot.
- The
httpblock includes/etc/nginx/sites-enabled/*.conf. - The stock default block does not intercept named production sites.
- Each site has a distinct root or upstream, hostname list, and log files.
- DNS or a hosts-file entry sends the test hostname to this server.
sudo nginx -tsucceeds before every reload or restart.- Firewalld and any external firewall allow the listeners, while SSH remains permitted.
- Nonstandard roots have persistent SELinux labels.
- Proxy blocks have a reachable upstream and only the required SELinux network permission.
- HTTPS blocks use port 443 with
ssl, valid certificate and key paths, and restrictive key permissions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
