Tools Index


1. Install Nginx

        $  prt-get depinst nginx

Allow minimal privileges via mount options, view /etc/fstab;

        UID=xxxxx-xxx-xxx-xxx-xxxxxxxx  /srv/www                ext4 defaults,nosuid,noexec,nodev,noatime       1 2

Add user nginx to www group;

        # usermod -a -G www nginx

Change default home directory of nginx user;

        # usermod -m -d /srv/www nginx

Create configuration directory's for better organization;

        $ sudo mkdir /etc/nginx/conf.d
        $ sudo mkdir /etc/nginx/sites-enable
        $ sudo mkdir /etc/nginx/sites

2. Certificates

2.1. Lets encrypt

Example of nginx location block on public pmwiki setup;

        #ACME challenge
        location ^~ /.well-known {
              allow all;
              alias /srv/www/machine-pmwiki/pub/cert/.well-known/;
              default_type "text/plain";
              try_files $uri =404;

First run dryrun to test if everything is ok;

        # certbot certonly --dry-run --email --webroot -w /srv/www/machine-pmwiki/pub/cert/-d
        # certbot certonly --email --webroot -w /srv/www/machine-pmwiki/pub/cert/-d

2.2. Self certificate

Certificates allow a more secure connection. Lets create self-signed certificate;

Create private key;

        $ sudo openssl genrsa -des3 -out /etc/ssl/keys/nginx.key 2048
        Generating RSA private key, 2048 bit long modulus
        e is 65537 (0x10001)
        Enter pass phrase for /etc/ssl/keys/nginx.key:
        Verifying - Enter pass phrase for /etc/ssl/keys/nginx.key:

Create ceritificate signing request. For "Common Name" provide domain name or ip address, leave challange password and optional company name blank;

        $ sudo openssl req -new -key /etc/ssl/keys/nginx.key -out /etc/ssl/certs/nginx.csr
        Enter pass phrase for /etc/ssl/keys/nginx.key:
        You are about to be asked to enter information that will be incorporated
        into your certificate request.
        What you are about to enter is what is called a Distinguished Name or a DN.
        There are quite a few fields but you can leave some blank
        For some fields there will be a default value,
        If you enter '.', the field will be left blank.
        Country Name (2 letter code) [AU]:PT
        State or Province Name (full name) [Some-State]:
        Locality Name (eg, city) []:
        Organization Name (eg, company) [Internet Widgits Pty Ltd]:
        Organizational Unit Name (eg, section) []:
        Common Name (e.g. server FQDN or YOUR name) []
        Email Address []:

        Please enter the following 'extra' attributes
        to be sent with your certificate request
        A challenge password []:
        An optional company name []:

Having password is a good idea, but requires it every time nginx is restarted. To remove;

        $ sudo cp /etc/ssl/keys/nginx.key /etc/ssl/keys/nginx.key.pass
        $ sudo openssl rsa -in /etc/ssl/keys/nginx.key.pass -out /etc/ssl/keys/nginx.key
        Enter pass phrase for /etc/ssl/keys/nginx.key.pass:
        writing RSA key
        $ sudo chown nginx /etc/ssl/keys/nginx.key*
        $ sudo chmod 0600 /etc/ssl/keys/nginx.key*
	# chmod 644 /etc/ssl/certs/exim.cert

Sign SSL cetificate;

        $ sudo openssl x509 -req -days 365 \
            -in /etc/ssl/certs/nginx.csr \
            -signkey /etc/ssl/keys/nginx.key \
            -out /etc/ssl/certs/nginx.crt
Signature ok subject=/C=PT/ST=Some-State/O=Internet Widgits Pty Ltd/ Getting Private key Enter pass phrase for /etc/ssl/keys/nginx.key:
        $ sudo chown nginx:nginx /etc/ssl/keys/nginx.key*
        $ sudo chmod 0600 /etc/ssl/keys/nginx.key*
	$ sudo chmod 644 /etc/ssl/certs/nginx.crt

3. Nginx Configuration

This is the "main" nginx configuration not the servers, the way this configuration is setup nginx will load virtual servers configuration files with extension .conf from /etc/nginx/sites-enabled/.

Number of worker_processes must be equal or less than the number of available cpu cores. This is set to auto.

        $ nproc

Number of worker_connections must be equal or less than the number file-size writing limit, you can get it by;

        $ nlimit -n

Edit ngnix configutarion;

        # /etc/nginx/nginx.conf - nginx server configuration

        user www;
        worker_processes auto;

        error_log syslog:server=unix:/dev/log debug;

        pid /var/run/;

        events {
            worker_connections  1024;

        http {
            include       mime.types;
            default_type  application/octet-stream;

            log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                              '$status $body_bytes_sent "$http_referer" '
                              '"$http_user_agent" "$http_x_forwarded_for"';

            sendfile        on;
            #tcp_nopush     on;

            # Allow attach iso to wiki
            #client_max_body_size 8M;
            client_max_body_size 30M;
            #keepalive_timeout  65;
            keepalive_timeout  120;
            #client_body_timeout 12;
            client_body_timeout 24;
            #client_header_timeout 12;
            client_header_timeout 24;

            send_timeout 65;

            gzip  on;
            gzip_vary on;
            #gzip_proxied any;
            gzip_comp_level 9;
            # gzip_buffers 16 8k;
            # gzip_http_version 1.1;
            gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

            include /etc/nginx/conf.d/*.conf;
            include /etc/nginx/sites-enabled/*.conf;
        # End of file

4. Virtual servers

Read nginx pitfalls and configuration optimization.

This setup uses default virtual server as a proxy, this allows to have a clean configuration file and delegate application specific settings to other servers. Other virtual servers can run on same machine or other machines, allowing greater compartmentalization.

When testing or debugging configurations is useful to run nginx with following option;

        nginx -V

4.1. Setup PHP

Install php and setup php.ini as development mode;

        $ sudo prt-get depinst php php-fpm php-gd php-pdo-pgsql php-postgresql

Setup php ini in development mode;

        $ sudo cp /etc/php/php.ini-development /etc/php/php.ini
        $ php --ini
        Configuration File (php.ini) Path: /etc/php
        Loaded Configuration File:         /etc/php/php.ini
        Scan for additional .ini files in: /etc/php/conf.d
        Additional .ini files parsed:      /etc/php/conf.d/extensions.ini,

4.2. Setup default server

Default server that acts as a proxy except for /doc, with ssl certificates (serves port 443 and 80). Each location is proxy ed to correspondent virtual server.

        server {
        #if ($http_user_agent ~* (AhrefsBot|SemrushBot|MJ12Bot|DotBot)) {
        #     return 410;
            listen 80 default_server;
            listen 443 ssl default_server;

            access_log syslog:server=unix:/dev/log,facility=daemon,tag=nginx_vhost,nohostname main;
            error_log syslog:server=unix:/dev/log,facility=daemon,tag=nginx_vhost_err,nohostname debug;

            root /etc/nginx/html/;

            ssl_certificate /etc/letsencrypt/live/;
            ssl_certificate_key /etc/letsencrypt/live/;
            ssl_trusted_certificate /etc/letsencrypt/live/;

            ssl_session_timeout 1d;
            ssl_session_cache shared:SSL:50m;
            ssl_session_tickets off;
            ssl_protocols TLSv1.2;
            ssl_prefer_server_ciphers on;
            add_header Strict-Transport-Security max-age=15768000;
            ssl_stapling on;
            ssl_stapling_verify on;

            #proxy_redirect off;
            #proxy_set_header Host $http_host;
            #proxy_set_header X-Forwarded-Host $http_host;
            #proxy_set_header X-Real-IP $remote_addr;
            #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

           location /doc {
               alias /srv/www/doc;
               index index.html;
                autoindex on;

           location /mirror {
               proxy_pass http://ports.ank;

           location /pub {
               proxy_pass http://wiki.server.ank:8080;
           location ^~ /.well-known {
               # ACME challenge
               proxy_pass http://wiki.server.ank;
           location /wiki {
                proxy_pass http://wiki.server.ank:8080;

           location /git {
               proxy_pass http://git.server.ank:8080;

           location /forum/ {
                proxy_pass http://forum.server.ank:8080/;

           location /task {
               proxy_pass http://task.server.ank:8080;

           location /shop {
                proxy_pass http://shop.server.ank:8080;

           location /vexim/ {
               proxy_pass http://vexim.server.ank:8080/;

           location /email {
               proxy_pass http://email.server.ank:8080;

           location /awstats {
               proxy_pass http://awstats.server.ank:8080;

           location /stats {
               proxy_pass http://stats.server.ank:8080;

           location / {
                proxy_pass http://frontpage.server.ank:8080/;

4.3. Setup virtual server

Example of pmwiki virtual server, check /etc/nginx/sites-enabled for the rest of examples mentioned default server. If wiki server is running on same machine add following to /etc/hosts; wiki.c2.ank

Edit /etc/nginx/sites-enabled/wiki.c2.ank.conf;

        server {
            listen 8080;
            server_name wiki.server.ank;

            access_log syslog:server=unix:/dev/log,facility=daemon,tag=vh_tribu,nohostname main;
            error_log syslog:server=unix:/dev/log,facility=daemon,tag=vh_tribu_err,nohostname debug;

            root /srv/www/;

            location /pub {
                alias /srv/www/wiki/pub;
            # ACME challenge
            location ^~ /.well-known {
                allow all;
                alias /srv/www/wiki/pub/cert/.well-known/;
                default_type "text/plain";
                try_files $uri =404;

            location @pmwiki {
                rewrite ^/wiki/(.*) /wiki/pmwiki.php?n=$1;

            location /wiki {
                index pmwiki.php;
                try_files $uri $uri/ @pmwiki;

            location ~  ^\/wiki(.+\.php)$ {
                index pmwiki.php;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_index pmwiki.php;
                try_files $uri /pmwiki.php =404;
                include /etc/nginx/fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

5. User Directory

Nginx Wiki UserDir

         location ~ ^/~(.+?)(/.*)?$ {
            alias /home/$1/public_html$2;
            index  index.html index.htm;
            autoindex on;

Directories should have 644 or 664 and files chmod 755 or 775;

        $ sudo find . -type f -print0 | xargs -0 chmod 644
        $ sudo find . -type d -print0 | xargs -0 chmod 755

6. Logs

        $ sudo grep "login" /var/log/nginx/vhost_access
        $ sudo grep "etc/passwd" /var/log/nginx/vhost_access
        $ sudo egrep -i "denied|error|warn" /var/log/nginx_error
Tools Index

This is part of the Tribu System Documentation. Copyright (C) 2020 Tribu Team. See the file Gnu Free Documentation License for copying conditions.