tools/nginx.html


1
2
3
4
5
6
7
8
9
10
-d:booting
<!DOCTYPE html>
<html dir="ltr" lang="en">
    <head>
        <meta charset='utf-8'>
        <title>Nginx</title>
    </head>
    <body>
        <a href="index.html">Tools Index</a>

        <h1>Nginx</h1>

        <h2 id="install">1. Install Nginx</h2>

        <pre>
        $  prt-get depinst nginx
        </pre>

        <p>Allow minimal privileges via mount options, view /etc/fstab;</p>

        <pre>
        UID=xxxxx-xxx-xxx-xxx-xxxxxxxx  /srv/www                ext4 defaults,nosuid,noexec,nodev,noatime       1 2
        </pre>

        <p>Add user nginx to www group;</p>

        <pre>
        # usermod -a -G www nginx
        </pre>

        <p>Change default home directory of nginx user;</p>

        <pre>
        # usermod -m -d /srv/www nginx
        </pre>

        <p>Create configuration directory's for better organization;</p>

        <pre>
        $ sudo mkdir /etc/nginx/conf.d
        $ sudo mkdir /etc/nginx/sites-enable
        $ sudo mkdir /etc/nginx/sites
        </pre>

        <h2 id="certs">2. Certificates</h2>

        <h3 id="letsencrypt">2.1. Lets encrypt</h3>

        <p>Example of nginx location block on public pmwiki setup;</p>

        <pre>
        #ACME challenge
        location ^~ /.well-known {
              allow all;
              alias /srv/www/c9-pmwiki/pub/cert/.well-known/;
              default_type "text/plain";
              try_files $uri =404;
        }
        </pre>

        <p>First run dryrun to test if everything is ok;</p>

        <pre>
        # certbot certonly --dry-run --email user@mail.org --webroot -w /srv/www/c9-pmwiki/pub/cert/-d c9.root.sx
        </pre>

        <pre>
        # certbot certonly --email user@mail.org --webroot -w /srv/www/c9-pmwiki/pub/cert/-d c9.root.sx
        </pre>

        <h3 id="mancert">2.2. Self certificate</h2>
        <p>Certificates allow a more secure connection. Lets create
        self-signed certificate;</p>

        <p>Create private key;</p>

        <pre>
        $ sudo openssl genrsa -des3 -out /etc/ssl/keys/nginx.key 2048
        Password:
        Generating RSA private key, 2048 bit long modulus
        ..............................+++
        ............+++
        e is 65537 (0x10001)
        Enter pass phrase for /etc/ssl/keys/nginx.key:
        Verifying - Enter pass phrase for /etc/ssl/keys/nginx.key:
        </pre>

        <p>Create ceritificate signing request. For "Common Name"
        provide domain name or ip address, leave challange password
        and optional company name blank;</p>

        <pre>
        $ sudo openssl req -new -key /etc/ssl/keys/nginx.key -out /etc/ssl/certs/nginx.csr
        Enter pass phrase for /etc/ssl/keys/nginx.key:
        You are about to be asked to enter information that will be incorporated
        into your certificate request.
        What you are about to enter is what is called a Distinguished Name or a DN.
        There are quite a few fields but you can leave some blank
        For some fields there will be a default value,
        If you enter '.', the field will be left blank.
        -----
        Country Name (2 letter code) [AU]:PT
        State or Province Name (full name) [Some-State]:
        Locality Name (eg, city) []:
        Organization Name (eg, company) [Internet Widgits Pty Ltd]:
        Organizational Unit Name (eg, section) []:
        Common Name (e.g. server FQDN or YOUR name) []:core.privat-network.net
        Email Address []:

        Please enter the following 'extra' attributes
        to be sent with your certificate request
        A challenge password []:
        An optional company name []:
        $
        </pre>

        <p>Having password is a good idea, but requires it every
        time nginx is restarted. To remove;</p>

        <pre>
        $ sudo cp /etc/ssl/keys/nginx.key /etc/ssl/keys/nginx.key.pass
        $ sudo openssl rsa -in /etc/ssl/keys/nginx.key.pass -out /etc/ssl/keys/nginx.key
        </pre>

        <pre>
        Enter pass phrase for /etc/ssl/keys/nginx.key.pass:
        writing RSA key
        </pre>

        <pre>
        $ sudo chown nginx /etc/ssl/keys/nginx.key*
        $ sudo chmod 0600 /etc/ssl/keys/nginx.key*
	# chmod 644 /etc/ssl/certs/exim.cert
        </pre>

        <p>Sign SSL cetificate;</p>

        <pre>
        $ sudo openssl x509 -req -days 365 \
            -in /etc/ssl/certs/nginx.csr \
            -signkey /etc/ssl/keys/nginx.key \
            -out /etc/ssl/certs/nginx.crt
        </pre>

        Signature ok
        subject=/C=PT/ST=Some-State/O=Internet Widgits Pty Ltd/CN=core.privat-network.net
        Getting Private key
        Enter pass phrase for /etc/ssl/keys/nginx.key:
        </pre>

        <pre>
        $ sudo chown nginx:nginx /etc/ssl/keys/nginx.key*
        $ sudo chmod 0600 /etc/ssl/keys/nginx.key*
	$ sudo chmod 644 /etc/ssl/certs/nginx.crt
        </pre>

        <h2 id="nginxconf">3. Nginx Configuration</h2>

        <p>Read <a href="http://wiki.nginx.org/Pitfalls">nginx pitfalls</a>,
        for more information about optimization
        <a href="https://www.digitalocean.com/community/tutorials/how-to-optimize-nginx-configuration">digitalocean</a>,

        <p>Number of worker_processes must be equal or less than
       the number of available cpu cores. This is set to auto.</p>

        <pre>
        $ nproc
        2
        </pre>

        <p>Number of worker_connections must be equal or less than
        the number file-size writing limit, you can get it by;</p>

        <pre>
        $ nlimit -n
        1024
        </pre>

       <p>Example of http block with ssl configured;</p>

        <pre>
        #
        # /etc/nginx/nginx.conf - nginx server configuration
        #


        user nginx;
        worker_processes auto;

        error_log /var/log/nginx/error.log;

        pid /var/run/nginx.pid;


        events {
            worker_connections  1024;
        }


        http {
            include       mime.types;
            default_type  application/octet-stream;

            ##
            # SSL Settings
            ##
            ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
            ssl_prefer_server_ciphers on;

            # ssl on;
            ssl_certificate /etc/ssl/certs/nginx.crt;
            ssl_certificate_key /etc/ssl/keys/nginx.key;

            #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
            #                  '$status $body_bytes_sent "$http_referer" '
            #                  '"$http_user_agent" "$http_x_forwarded_for"';

            access_log /var/log/nginx/access.log;
            error_log  /var/log/nginx/error.log;

            sendfile        on;
            #tcp_nopush     on;

            keepalive_timeout  65;
            client_body_timeout 12;
            client_header_timeout 12;
            send_timeout 65;


            gzip  on;
            gzip_vary on;
            #gzip_proxied any;
            gzip_comp_level 9;
            # gzip_buffers 16 8k;
            # gzip_http_version 1.1;
            gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;


            ##
            # Virtual Host Configs
            ##
            server {
                listen         80 default_server;
                server_name _;
                return         301 https://$host$request_uri;
            }

            include /etc/nginx/conf.d/*.conf;
            include /etc/nginx/sites-enabled/*.conf;

        }
        # End of file
        </pre>


        <h2 id="server">4. Server with PHP</h2>
        <p>To debug configurations check logs and;</p>

        <pre>
        nginx -V
        </pre>

        <h3>4.1. Setup PHP</h3>

        <p> Install php and setup php.ini as development mode;</p>

        <pre>
        $ sudo prt-get depinst php php-fpm php-gd php-pdo-pgsql php-postgresql
        </pre>

        <p>Setup php ini in development mode;<p/>

        <pre>
        $ sudo cp /etc/php/php.ini-development /etc/php/php.ini
        </pre>

        <pre>
        $ php --ini
        Configuration File (php.ini) Path: /etc/php
        Loaded Configuration File:         /etc/php/php.ini
        Scan for additional .ini files in: /etc/php/conf.d
        Additional .ini files parsed:      /etc/php/conf.d/extensions.ini,
        /etc/php/conf.d/pdo_pgsql.ini
        </pre>

        <h3 id="virtual-host">4.2. Setup Virtual Host</h3>

        <p>Server (virtual host) with pmwiki and flyspray, check
        <a href="conf/etc/nginx/sites/">/etc/nginx/sites</a>
        for more examples. Install pmwiki and flyspray;</p>

        <pre>
        $ sudo prt-get depinst pmwiki flyspray
        </pre>

        <p> This server is configured in a way that
        root serves pmwiki and /tasks serves flyspray. In order to
        flyspray to link correctly change index is needed;</p>

        <pre>
        server {
            listen 443 ssl;
            # listen [::]:443 ssl;

            server_name c9.core;

            root /srv/www/default;

            location /distfiles {
                alias /usr/ports/distfiles;
            }


            location /tasks {
                index index.php;
                alias /srv/www/default/flyspray;
                try_files $uri $uri/ index.php$is_args$args;
            }

            location ~  ^/tasks(.+\.php)$ {
                alias /srv/www/default/flyspray;

                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_index index.php;
                try_files $uri /index.php =404;
                include /etc/nginx/fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$1;
                # fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_pass 127.0.0.1:9000;
            }

            location / {
                alias /srv/www/default/pmwiki/;
                index pmwiki.php
                try_files $uri $uri/ /pmwiki.php$is_args$args;
            }

            location ~ \.php$ {
                alias /srv/www/default/pmwiki;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_index pmwiki.php;
                try_files $uri /pmwiki.php =404;
                include /etc/nginx/fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                # fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_pass 127.0.0.1:9000;
            }
        }
        </pre>

        <p>Change /srv/www/default/flyspray/index.php to;</p>

        <pre>
        &lt?php
        /*
           This is the main script that everything else is included
           in.  Mostly what it does is check the user permissions
           to see what they have access to.
        */
        define('IN_FS', true);
        $_SERVER['SCRIPT_NAME'] = "/bug/index.php";
        require_once(dirname(__FILE__).'/header.php');
        </pre>

        <h2 id="userdir">5. User Directory</h2>

        <p><a href="http://wiki.nginx.org/UserDir">Nginx Wiki UserDir</a></p>

        <pre>
         location ~ ^/~(.+?)(/.*)?$ {
            alias /home/$1/public_html$2;
            index  index.html index.htm;
            autoindex on;
         }
        </pre>

        <p>Directories should have 644 or 664 and
        files chmod 755 or 775;</p>

        <pre>
        $ sudo find . -type f -print0 | xargs -0 chmod 644
        $ sudo find . -type d -print0 | xargs -0 chmod 755
        </pre>

        <h2 id="logs">6. Logs</h2>

        <pre>
        $ sudo grep "login" /var/log/nginx/access.log
        $ sudo grep "etc/passwd" /var/log/nginx/access.log
        $ sudo egrep -i "denied|error|warn" /var/log/nginx/error.log
        </pre>


        <a href="index.html">Tools Index</a>

        <p>This is part of the c9-doc Manual.
        Copyright (C) 2016
        c9 team.
        See the file <a href="../fdl-1.3-standalone.html">Gnu Free Documentation License</a>
        for copying conditions.</p>
    </body>
</html>