mu - Soul of a tiny new machine. More thorough tests → More comprehensible and rewrite-friendly software → More resilient society.

	Commit message (Collapse)	Author	Age	Files	Lines
*	3431	Kartik K. Agaram	2016-09-30	12	-170/+166
\| \| \| \| \|	Improvements to syntax highlighting, particularly for Mu code in C++ files.
*	3430	Kartik K. Agaram	2016-09-28	12	-1147/+1216
\|
*	3397	Kartik K. Agaram	2016-09-17	12	-916/+916
\|
*	3395	Kartik K. Agaram	2016-09-17	12	-1771/+1771
\|
*	3371	Kartik K. Agaram	2016-09-16	1	-12/+0
\|
*	3355	Kartik K. Agaram	2016-09-15	12	-450/+450
\|
*	3235	Kartik K. Agaram	2016-08-20	1	-4/+3
\|
*	3174	Kartik K. Agaram	2016-08-12	3	-3/+3
\|
*	3117	Kartik K. Agaram	2016-07-20	2	-4/+10
\|
*	3102	Kartik K. Agaram	2016-07-05	9	-137/+450
\|
*	2996	Kartik K. Agaram	2016-05-21	12	-812/+1186
\|
*	2866	Kartik K. Agaram	2016-04-25	11	-1856/+1952
\|
*	2812	Kartik K. Agaram	2016-03-27	11	-131/+221
\|
*	2745	Kartik K. Agaram	2016-03-09	11	-11/+11
\|
*	2744	Kartik K. Agaram	2016-03-09	11	-22/+22
\| \| \| \|	Tweak colors and font-sizes in generated html.
*	2743	Kartik K. Agaram	2016-03-09	11	-364/+265
\| \| \| \| \|	Looks like "TOhtml \| <other command>" doesn't work on Mac OS X for some reason..
*	2710	Kartik K. Agaram	2016-02-25	3	-17/+0
\|
*	2706 - update html	Kartik K. Agaram	2016-02-25	2	-51/+52
\|
*	2625	Kartik K. Agaram	2016-02-02	6	-65/+146
\|
*	2605	Kartik K. Agaram	2016-01-26	11	-1350/+2291
\|
*	2545	Kartik K. Agaram	2015-12-15	8	-19/+87
\| \| \| \|	update html
*	2611	Kartik K. Agaram	2015-11-29	9	-189/+144
\|
*	2447	Kartik K. Agaram	2015-11-15	6	-77/+77
\|
*	2430 - make room for more transforms	Kartik K. Agaram	2015-11-13	1	-1/+0
\|
*	2423 - describe shape-shifting in html docs	Kartik K. Agaram	2015-11-10	11	-1084/+1143
\|
*	2177	Kartik K. Agaram	2015-09-07	11	-0/+9462

<!DOCTYPE html> <html dir="ltr" lang="en"> <head> <meta charset='utf-8'> <title>Nginx</title> </head> <body> <a href="index.html">Tools Index</a> <h1>Nginx</h1> <h2 id="install">1. Install Nginx</h2> <pre> $ prt-get depinst nginx </pre> <p>Allow minimal privileges via mount options, view /etc/fstab;</p> <pre> UID=xxxxx-xxx-xxx-xxx-xxxxxxxx /srv/www ext4 defaults,nosuid,noexec,nodev,noatime 1 2 </pre> <p>Add user nginx to www group;</p> <pre> # usermod -a -G www nginx </pre> <p>Change default home directory of nginx user;</p> <pre> # usermod -m -d /srv/www nginx </pre> <p>Create configuration directory's for better organization;</p> <pre> $ sudo mkdir /etc/nginx/conf.d $ sudo mkdir /etc/nginx/sites-enable $ sudo mkdir /etc/nginx/sites </pre> <h2 id="certs">2. Certificates</h2> <h3 id="letsencrypt">2.1. Lets encrypt</h3> <p>Example of nginx location block on public pmwiki setup;</p> <pre> #ACME challenge location ^~ /.well-known { allow all; alias /srv/www/machine-pmwiki/pub/cert/.well-known/; default_type "text/plain"; try_files $uri =404; } </pre> <p>First run dryrun to test if everything is ok;</p> <pre> # certbot certonly --dry-run --email user@mail.org --webroot -w /srv/www/machine-pmwiki/pub/cert/-d machine.example.org </pre> <pre> # certbot certonly --email user@mail.org --webroot -w /srv/www/machine-pmwiki/pub/cert/-d machine.example.org </pre> <h3 id="mancert">2.2. Self certificate</h2> <p>Certificates allow a more secure connection. Lets create self-signed certificate;</p> <p>Create private key;</p> <pre> $ sudo openssl genrsa -des3 -out /etc/ssl/keys/nginx.key 2048 Password: Generating RSA private key, 2048 bit long modulus ..............................+++ ............+++ e is 65537 (0x10001) Enter pass phrase for /etc/ssl/keys/nginx.key: Verifying - Enter pass phrase for /etc/ssl/keys/nginx.key: </pre> <p>Create ceritificate signing request. For "Common Name" provide domain name or ip address, leave challange password and optional company name blank;</p> <pre> $ sudo openssl req -new -key /etc/ssl/keys/nginx.key -out /etc/ssl/certs/nginx.csr Enter pass phrase for /etc/ssl/keys/nginx.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:PT State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []:machine.example.org Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: $ </pre> <p>Having password is a good idea, but requires it every time nginx is restarted. To remove;</p> <pre> $ sudo cp /etc/ssl/keys/nginx.key /etc/ssl/keys/nginx.key.pass $ sudo openssl rsa -in /etc/ssl/keys/nginx.key.pass -out /etc/ssl/keys/nginx.key </pre> <pre> Enter pass phrase for /etc/ssl/keys/nginx.key.pass: writing RSA key </pre> <pre> $ sudo chown nginx /etc/ssl/keys/nginx.key* $ sudo chmod 0600 /etc/ssl/keys/nginx.key* # chmod 644 /etc/ssl/certs/exim.cert </pre> <p>Sign SSL cetificate;</p> <pre> $ sudo openssl x509 -req -days 365 \ -in /etc/ssl/certs/nginx.csr \ -signkey /etc/ssl/keys/nginx.key \ -out /etc/ssl/certs/nginx.crt </pre> Signature ok subject=/C=PT/ST=Some-State/O=Internet Widgits Pty Ltd/CN=machine.example.org Getting Private key Enter pass phrase for /etc/ssl/keys/nginx.key: </pre> <pre> $ sudo chown nginx:nginx /etc/ssl/keys/nginx.key* $ sudo chmod 0600 /etc/ssl/keys/nginx.key* $ sudo chmod 644 /etc/ssl/certs/nginx.crt </pre> <h2 id="nginxconf">3. Nginx Configuration</h2> <p>Read <a href="http://wiki.nginx.org/Pitfalls">nginx pitfalls</a>, for more information about optimization <a href="https://www.digitalocean.com/community/tutorials/how-to-optimize-nginx-configuration">digitalocean</a>, <p>Number of worker_processes must be equal or less than the number of available cpu cores. This is set to auto.</p> <pre> $ nproc 2 </pre> <p>Number of worker_connections must be equal or less than the number file-size writing limit, you can get it by;</p> <pre> $ nlimit -n 1024 </pre> <p>Edit ngnix configutarion;</p> <pre> # # /etc/nginx/nginx.conf - nginx server configuration # user www; worker_processes auto; error_log /var/log/nginx/error.log; pid /var/run/nginx.pid; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' # '$status $body_bytes_sent "$http_referer" ' # '"$http_user_agent" "$http_x_forwarded_for"'; sendfile on; #tcp_nopush on; # Allow attach iso to wiki #client_max_body_size 8M; client_max_body_size 30M; #keepalive_timeout 65; keepalive_timeout 120; #client_body_timeout 12; client_body_timeout 24; #client_header_timeout 12; client_header_timeout 24; #client_max_body_size 10000M; #keepalive_timeout 10000; #client_body_timeout 10000; #client_header_timeout 10000; send_timeout 65; gzip on; gzip_vary on; #gzip_proxied any; gzip_comp_level 9; # gzip_buffers 16 8k; # gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*.conf; } # End of file </pre> <h2 id="server">4. Server with PHP</h2> <p>To debug configurations check logs and;</p> <pre> nginx -V </pre> <h3>4.1. Setup PHP</h3> <p> Install php and setup php.ini as development mode;</p> <pre> $ sudo prt-get depinst php php-fpm php-gd php-pdo-pgsql php-postgresql </pre> <p>Setup php ini in development mode;<p/> <pre> $ sudo cp /etc/php/php.ini-development /etc/php/php.ini </pre> <pre> $ php --ini Configuration File (php.ini) Path: /etc/php Loaded Configuration File: /etc/php/php.ini Scan for additional .ini files in: /etc/php/conf.d Additional .ini files parsed: /etc/php/conf.d/extensions.ini, /etc/php/conf.d/pdo_pgsql.ini </pre> <h3 id="virtual-host">4.2. Setup Virtual Host</h3> <p>Server (virtual host) with pmwiki and flyspray, check <a href="conf/etc/nginx/sites/">/etc/nginx/sites</a> for more examples. Install pmwiki and flyspray;</p> <pre> $ sudo prt-get depinst pmwiki flyspray </pre> <p> This server is configured in a way that root serves pmwiki and /tasks serves flyspray. In order to flyspray to link correctly change index is needed. Create /etc/nginx/sites-enabled/machine.example.org.conf;</p> <pre> server { listen 443 ssl; listen 80; server_name machine.example.org; # listen [::]:443 ssl http2; ssl_certificate /etc/letsencrypt/live/machine.example.org/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/machine.example.org/privkey.pem; ssl_trusted_certificate /etc/letsencrypt/live/machine.example.org/chain.pem; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; ssl_protocols TLSv1.2; ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; ssl_prefer_server_ciphers on; add_header Strict-Transport-Security max-age=15768000; ssl_stapling on; ssl_stapling_verify on; access_log /var/log/nginx/example_access.log; error_log /var/log/nginx/example_error.log; root /srv/www/; location /mirror { #alias /usr/ports/releases; proxy_pass http://10.0.0.3:80/; } location /builder { rewrite ^/blog(.*) /$1 break; proxy_pass http://10.0.0.3:80; } location /doc { alias /srv/www/doc; index index.html; } location /git/static { # static files (png/css) served from /usr/share/gitweb/static alias /srv/www/gitweb/static; } location /git { alias /srv/www/gitweb; index gitweb.cgi; fastcgi_split_path_info ^/git()(/?.+)$; fastcgi_param GITWEB_CONFIG /etc/gitweb.conf; fastcgi_param DOCUMENT_ROOT /srv/www/gitweb; fastcgi_param SCRIPT_NAME /gitweb.cgi$fastcgi_path_info; include fastcgi_params; fastcgi_pass unix:/var/run/fcgiwrap.sock; } location /chat { index index.php; alias /srv/www/chat; try_files $uri $uri/ index.php$is_args$args; } location ~ ^/chat(.+\.php)$ { ### This location block was the solution alias /srv/www/chat; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_index index.php; try_files $uri /index.php =404; include /etc/nginx/fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$1; # fastcgi_pass unix:/var/run/php5-fpm.sock; fastcgi_pass 127.0.0.1:9000; } location /task { index index.php; alias /srv/www/flyspray; try_files $uri $uri/ index.php$is_args$args; } location ~ ^/task(.+\.php)$ { ### This location block was the solution alias /srv/www/flyspray; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_index index.php; try_files $uri /index.php =404; include /etc/nginx/fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$1; # fastcgi_pass unix:/var/run/php5-fpm.sock; fastcgi_pass 127.0.0.1:9000; } location /pub { alias /srv/www/pmwiki/pub; } location /wiki { alias /srv/www/pmwiki/; index pmwiki.php; try_files $uri $uri/ /pmwiki.php$is_args$args; } location ~ ^/wiki(.+\.php)$ { alias /srv/www/pmwiki; index pmwiki.php; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_index pmwiki.php; try_files $uri /pmwiki.php =404; include /etc/nginx/fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; # fastcgi_pass unix:/var/run/php5-fpm.sock; fastcgi_pass 127.0.0.1:9000; } # ACME challenge location ^~ /.well-known { allow all; alias /srv/www/pmwiki/pub/cert/.well-known/; default_type "text/plain"; try_files $uri =404; } location / { alias /srv/www/frontpage/; index index.html; try_files $uri $uri/ /index.html$is_args$args; } } </pre> <p>Change /srv/www/default/flyspray/index.php to;</p> <pre> &lt?php /* This is the main script that everything else is included in. Mostly what it does is check the user permissions to see what they have access to. */ define('IN_FS', true); $_SERVER['SCRIPT_NAME'] = "/bug/index.php"; require_once(dirname(__FILE__).'/header.php'); </pre> <h2 id="userdir">5. User Directory</h2> <p><a href="http://wiki.nginx.org/UserDir">Nginx Wiki UserDir</a></p> <pre> location ~ ^/~(.+?)(/.*)?$ { alias /home/$1/public_html$2; index index.html index.htm; autoindex on; } </pre> <p>Directories should have 644 or 664 and files chmod 755 or 775;</p> <pre> $ sudo find . -type f -print0 | xargs -0 chmod 644 $ sudo find . -type d -print0 | xargs -0 chmod 755 </pre> <h2 id="logs">6. Logs</h2> <pre> $ sudo grep "login" /var/log/nginx/access.log $ sudo grep "etc/passwd" /var/log/nginx/access.log $ sudo egrep -i "denied|error|warn" /var/log/nginx/error.log </pre> <a href="index.html">Tools Index</a> <p>This is part of the Hive System Documentation. Copyright (C) 2018 Hive Team. See the file <a href="../fdl-1.3-standalone.html">Gnu Free Documentation License</a> for copying conditions.</p> </body> </html>