$ prt-get depinst nginx
Allow minimal privileges via mount options, view /etc/fstab;
UID=xxxxx-xxx-xxx-xxx-xxxxxxxx /srv/www ext4 defaults,nosuid,noexec,nodev,noatime 1 2
Add user nginx to www group;
# usermod -a -G www nginx
Change default home directory of nginx user;
# usermod -m -d /srv/www nginx
Create configuration directory's for better organization;
$ sudo mkdir /etc/nginx/conf.d
$ sudo mkdir /etc/nginx/sites-enable
$ sudo mkdir /etc/nginx/sites
Example of nginx location block on public pmwiki setup;
#ACME challenge
location ^~ /.well-known {
allow all;
alias /srv/www/machine-pmwiki/pub/cert/.well-known/;
default_type "text/plain";
try_files $uri =404;
}
First run dryrun to test if everything is ok;
# certbot certonly --dry-run --email user@mail.org --webroot -w /srv/www/machine-pmwiki/pub/cert/-d machine.example.org
# certbot certonly --email user@mail.org --webroot -w /srv/www/machine-pmwiki/pub/cert/-d machine.example.org
Certificates allow a more secure connection. Lets create self-signed certificate;
Create private key;
$ sudo openssl genrsa -des3 -out /etc/ssl/keys/nginx.key 2048
Password:
Generating RSA private key, 2048 bit long modulus
..............................+++
............+++
e is 65537 (0x10001)
Enter pass phrase for /etc/ssl/keys/nginx.key:
Verifying - Enter pass phrase for /etc/ssl/keys/nginx.key:
Create ceritificate signing request. For "Common Name" provide domain name or ip address, leave challange password and optional company name blank;
$ sudo openssl req -new -key /etc/ssl/keys/nginx.key -out /etc/ssl/certs/nginx.csr
Enter pass phrase for /etc/ssl/keys/nginx.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:PT
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:machine.example.org
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
$
Having password is a good idea, but requires it every time nginx is restarted. To remove;
$ sudo cp /etc/ssl/keys/nginx.key /etc/ssl/keys/nginx.key.pass
$ sudo openssl rsa -in /etc/ssl/keys/nginx.key.pass -out /etc/ssl/keys/nginx.key
Enter pass phrase for /etc/ssl/keys/nginx.key.pass:
writing RSA key
$ sudo chown nginx /etc/ssl/keys/nginx.key*
$ sudo chmod 0600 /etc/ssl/keys/nginx.key*
# chmod 644 /etc/ssl/certs/exim.cert
Sign SSL cetificate;
$ sudo openssl x509 -req -days 365 \
-in /etc/ssl/certs/nginx.csr \
-signkey /etc/ssl/keys/nginx.key \
-out /etc/ssl/certs/nginx.crt
Signature ok
subject=/C=PT/ST=Some-State/O=Internet Widgits Pty Ltd/CN=machine.example.org
Getting Private key
Enter pass phrase for /etc/ssl/keys/nginx.key:
$ sudo chown nginx:nginx /etc/ssl/keys/nginx.key*
$ sudo chmod 0600 /etc/ssl/keys/nginx.key*
$ sudo chmod 644 /etc/ssl/certs/nginx.crt
This is the "main" nginx configuration not the servers, the way this configuration is setup nginx will load virtual servers configuration files with extension .conf from /etc/nginx/sites-enabled/.
Number of worker_processes must be equal or less than the number of available cpu cores. This is set to auto.
$ nproc
2
Number of worker_connections must be equal or less than the number file-size writing limit, you can get it by;
$ nlimit -n
1024
Edit ngnix configutarion;
#
# /etc/nginx/nginx.conf - nginx server configuration
#
user www;
worker_processes auto;
error_log syslog:server=unix:/dev/log debug;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
sendfile on;
#tcp_nopush on;
# Allow attach iso to wiki
#client_max_body_size 8M;
client_max_body_size 30M;
#keepalive_timeout 65;
keepalive_timeout 120;
#client_body_timeout 12;
client_body_timeout 24;
#client_header_timeout 12;
client_header_timeout 24;
send_timeout 65;
gzip on;
gzip_vary on;
#gzip_proxied any;
gzip_comp_level 9;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*.conf;
}
# End of file
Read nginx pitfalls and configuration optimization.
This setup uses default virtual server as a proxy, this allows to have a clean configuration file and delegate application specific settings to other servers. Other virtual servers can run on same machine or other machines, allowing greater compartmentalization.
When testing or debugging configurations is useful to run nginx with following option;
nginx -V
Install php and setup php.ini as development mode;
$ sudo prt-get depinst php php-fpm php-gd php-pdo-pgsql php-postgresql
Setup php ini in development mode;
$ sudo cp /etc/php/php.ini-development /etc/php/php.ini
$ php --ini
Configuration File (php.ini) Path: /etc/php
Loaded Configuration File: /etc/php/php.ini
Scan for additional .ini files in: /etc/php/conf.d
Additional .ini files parsed: /etc/php/conf.d/extensions.ini,
/etc/php/conf.d/pdo_pgsql.ini
Default server that acts as a proxy except for /doc, with ssl certificates (serves port 443 and 80). Each location is proxy ed to correspondent virtual server.
server {
#if ($http_user_agent ~* (AhrefsBot|SemrushBot|MJ12Bot|DotBot)) {
# return 410;
#}
server_name tribu.semdestino.org;
listen 80 default_server;
listen 443 ssl default_server;
access_log syslog:server=unix:/dev/log,facility=daemon,tag=nginx_vhost,nohostname main;
error_log syslog:server=unix:/dev/log,facility=daemon,tag=nginx_vhost_err,nohostname debug;
root /etc/nginx/html/;
ssl_certificate /etc/letsencrypt/live/tribu.semdestino.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/tribu.semdestino.org/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/tribu.semdestino.org/chain.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security max-age=15768000;
ssl_stapling on;
ssl_stapling_verify on;
#proxy_redirect off;
#proxy_set_header Host $http_host;
#proxy_set_header X-Forwarded-Host $http_host;
#proxy_set_header X-Real-IP $remote_addr;
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
location /doc {
alias /srv/www/doc;
index index.html;
autoindex on;
}
location /mirror {
proxy_pass http://ports.ank;
}
location /pub {
proxy_pass http://wiki.server.ank:8080;
}
location ^~ /.well-known {
# ACME challenge
proxy_pass http://wiki.server.ank;
}
location /wiki {
proxy_pass http://wiki.server.ank:8080;
}
location /git {
proxy_pass http://git.server.ank:8080;
}
location /forum/ {
proxy_pass http://forum.server.ank:8080/;
}
location /task {
proxy_pass http://task.server.ank:8080;
}
location /shop {
proxy_pass http://shop.server.ank:8080;
}
location /vexim/ {
proxy_pass http://vexim.server.ank:8080/;
}
location /email {
proxy_pass http://email.server.ank:8080;
}
location /awstats {
proxy_pass http://awstats.server.ank:8080;
}
location /stats {
proxy_pass http://stats.server.ank:8080;
}
location / {
proxy_pass http://frontpage.server.ank:8080/;
}
}
Example of pmwiki virtual server, check /etc/nginx/sites-enabled for the rest of examples mentioned default server. If wiki server is running on same machine add following to /etc/hosts;
127.0.0.1 wiki.c2.ank
Edit /etc/nginx/sites-enabled/wiki.c2.ank.conf;
server {
listen 8080;
server_name wiki.server.ank;
access_log syslog:server=unix:/dev/log,facility=daemon,tag=vh_tribu,nohostname main;
error_log syslog:server=unix:/dev/log,facility=daemon,tag=vh_tribu_err,nohostname debug;
root /srv/www/;
location /pub {
alias /srv/www/wiki/pub;
}
# ACME challenge
location ^~ /.well-known {
allow all;
alias /srv/www/wiki/pub/cert/.well-known/;
default_type "text/plain";
try_files $uri =404;
}
location @pmwiki {
rewrite ^/wiki/(.*) /wiki/pmwiki.php?n=$1;
}
location /wiki {
index pmwiki.php;
try_files $uri $uri/ @pmwiki;
}
location ~ ^\/wiki(.+\.php)$ {
index pmwiki.php;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_index pmwiki.php;
try_files $uri /pmwiki.php =404;
include /etc/nginx/fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass 127.0.0.1:9000;
}
}
location ~ ^/~(.+?)(/.*)?$ {
alias /home/$1/public_html$2;
index index.html index.htm;
autoindex on;
}
Directories should have 644 or 664 and files chmod 755 or 775;
$ sudo find . -type f -print0 | xargs -0 chmod 644
$ sudo find . -type d -print0 | xargs -0 chmod 755
$ sudo grep "login" /var/log/nginx/vhost_access
$ sudo grep "etc/passwd" /var/log/nginx/vhost_access
$ sudo egrep -i "denied|error|warn" /var/log/nginx_error
Tools Index
This is part of the Tribu System Documentation. Copyright (C) 2020 Tribu Team. See the file Gnu Free Documentation License for copying conditions.