From 3610744c6a2324cbffeb49bd2e8a2b7c58a2e9e6 Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Mon, 10 Aug 2026 09:36:28 -0500 Subject: nginx: add catch-all default_server returning 404 for unmatched hosts Without an explicit default_server, nginx falls back to the first alphabetically-loaded vhost for any request whose Host or SNI matches no server_name. Add an explicit catch-all that returns a plain 404 over HTTP and rejects the TLS handshake (ssl_reject_handshake, nginx >= 1.19.4) so unmatched HTTPS requests are not served a mismatched cert. --- nginx/files/nginx.conf | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/nginx/files/nginx.conf b/nginx/files/nginx.conf index 08b1f31..dd7885a 100644 --- a/nginx/files/nginx.conf +++ b/nginx/files/nginx.conf @@ -54,6 +54,25 @@ http { gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; + ## + # Default catch-all: any request whose Host/SNI matches no + # server_name lands here instead of the first-loaded vhost. + ## + + server { + listen 80 default_server; + listen [::]:80 default_server; + listen 443 ssl default_server; + listen [::]:443 ssl default_server; + + server_name _; + + # Reject unmatched TLS handshakes without a cert (nginx >= 1.19.4). + ssl_reject_handshake on; + + return 404; + } + ## # Virtual Host Configs ## -- cgit v1.2.3