To the installed Apache2 web server in the hosting of the ISPConfig 3 panel installed on instruction Today we will install the Nginx web server to significantly speed up the work of sites. The Nginx web server takes care of all the work with static files, giving PHP script processing to the Apache2 web server, due to which we get a significant acceleration of sites on the server.
This configuration is also convenient in that it allows you to use the standard configuration described in this manual for low-load sites, and connect PHP-FPM instead of Apache2 web server for high-load projects.
Let's start installation.
Translating the Apache2 web server to 82 ports, as Nginx will run on 80 ports, we need to replace 80 port with 82 commands:
sed -i 's/80/82/g' /etc/apache2/ports.conf
Or manually using a text editor:
vi /etc/apache2/ports.conf
was:
... NameVirtualHost *:80 Listen 80 ...
became:
... NameVirtualHost *:82 Listen 82 ...
We replace port 80 with port 82 of the ISPConfig 3 panel itself, and we can do this by executing:
sed -i 's/:80/:82/g' /etc/apache2/sites-available/ispconfig.conf
Or change your hands in the text editor:
vi /etc/apache2/sites-available/ispconfig.conf
was:
... NameVirtualHost *:80 ...
became:
... NameVirtualHost *:82 ...
We replace all domains on the Apache2 server port 80 to port 82, for this we check which domains we have by following the command:
ls -l /etc/apache2/sites-enabled/* lrwxrwxrwx 1 root root 39 Янв 11 2014 /etc/apache2/sites-enabled/000-apps.vhost -> /etc/apache2/sites-available/apps.vhost lrwxrwxrwx 1 root root 26 Янв 11 2014 /etc/apache2/sites-enabled/000-default -> ../sites-available/default lrwxrwxrwx 1 root root 43 Янв 11 2014 /etc/apache2/sites-enabled/000-ispconfig.conf -> /etc/apache2/sites-available/ispconfig.conf lrwxrwxrwx 1 root root 44 Янв 11 2014 /etc/apache2/sites-enabled/000-ispconfig.vhost -> /etc/apache2/sites-available/ispconfig.vhost lrwxrwxrwx 1 root root 52 Янв 12 2014 /etc/apache2/sites-enabled/100-email.server.loc.vhost -> /etc/apache2/sites-available/email.server.loc.vhost lrwxrwxrwx 1 root root 51 Янв 12 2014 /etc/apache2/sites-enabled/100-sams.server.loc.vhost -> /etc/apache2/sites-available/sams.server.loc.vhost lrwxrwxrwx 1 root root 51 Июн 27 2014 /etc/apache2/sites-enabled/100-test.server.loc.vhost -> /etc/apache2/sites-available/test.server.loc.vhost lrwxrwxrwx 1 root root 46 Июл 2 2014 /etc/apache2/sites-enabled/900-server.loc.vhost -> /etc/apache2/sites-available/server.loc.vhost
In the server response, we see 000* are system configuration files except for 000-default, and 100*.vhost and 900*.vhost are configuration files of domains on the server added through the ISPConfig 3 hosting control panel, they need to be changed.
Replace in all 100*.vhost and 900*.vhost 80 port by 82, not touching the system files of the panel, but only added domains by executing commands:
sed -i 's/:80/:82/g' /etc/apache2/sites-enabled/100*.vhost sed -i 's/:80/:82/g' /etc/apache2/sites-enabled/900*.vhost
It was in every file.
... <VirtualHost *:80> ...
became:
... <VirtualHost *:82> ...
Also replace 80 port by 82 in the default configuration file by executing the command:
sed -i 's/:80/:82/g' /etc/apache2/sites-enabled/000-defau*
was:
... <VirtualHost *:80> ...
became:
... <VirtualHost *:82> ...
Make changes to the hosting panel ISPConfig 3
Copy the main configuration file and vhost file generator by executing the commands:
cp /usr/local/ispconfig/server/conf/apache_ispconfig.conf.master /usr/local/ispconfig/server/conf-custom/ cp /usr/local/ispconfig/server/conf/vhost.conf.master /usr/local/ispconfig/server/conf-custom/
Replace port 80 in the main config with port 82 manually in the text editor:
vi /usr/local/ispconfig/server/conf-custom/apache_ispconfig.conf.master
was:
...
NameVirtualHost *:80
NameVirtualHost *:443
<tmpl_loop name="ip_adresses">
NameVirtualHost {tmpl_var name="ip_address"}:{tmpl_var name="port"}
...became:
...
NameVirtualHost *:82
NameVirtualHost *:443
<tmpl_loop name="ip_adresses">
NameVirtualHost {tmpl_var name="ip_address"}:82
...Replace ports in the configuration file of the vhost file generator:
vi /usr/local/ispconfig/server/conf-custom/vhost.conf.master
was:
...
<tmpl_loop name="vhosts">
<VirtualHost {tmpl_var name='ip_address'}:{tmpl_var name='port'}>
...became:
...
<tmpl_loop name="vhosts">
<VirtualHost {tmpl_var name='ip_address'}:82>
...Attention!! If you need to update the ISPConfig 3 panel, you will also need to make changes from port 80 to port 82 to the updated files, which we did above.
Installation of the libapache2-mod-rpaf module otherwise in apache2 logs instead of IP visitors will only be local IP 127.0.0.1
Install the libapache2-mod-rpaf module by executing the command:
aptitude install libapache2-mod-rpaf
was:
vi /etc/apache2/mods-enabled/rpaf.conf
<IfModule rpaf_module>
RPAFenable On
# When enabled, take the incoming X-Host header and
# update the virtualhost settings accordingly:
RPAFsethostname On
# Define which IP's are your frontend proxies that sends
# the correct X-Forwarded-For headers:
RPAFproxy_ips 127.0.0.1 ::1
# Change the header name to parse from the default
# X-Forwarded-For to something of your choice:
# RPAFheader X-Real-IP
</IfModule>became:
<IfModule rpaf_module>
RPAFenable On
RPAFsethostname On
RPAFproxy_ips 127.0.0.1 ВАШ_АЙПИ_ВНУТРЕННИЙ ВАШ_АЙПИ_ВНЕШНИЙ_если сервер_наружи
</IfModule>
Installation and configuration of the NGINX web server
Install the NGINX proxing web server by executing the command:
aptitude install nginx
To quickly check the validity of configs, we use the command:
nginx -t
Create a certificate dhparam following the command:
openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048 chown 600 /etc/ssl/certs/dhparam.pem
Delete the contents of the configuration file /etc/nginx/nginx.conf And then I did the command.
cat /dev/null > /etc/nginx/nginx.conf
open the file /etc/nginx/nginx.conf And we paste it between the comments:
vi /etc/nginx/nginx.conf
################################################
user www-data;
# Число рабочих процессов nginx, рекомендуется ставить по количеству процессоров/ядер на вашем сервере
worker_processes 1;
# Уменьшает число системных вызовов gettimeofday(), что приводит к увеличению производительности
timer_resolution 100ms;
# Изменяет ограничение на число используемых файлов RLIMIT_NOFILE для рабочего процесса.
worker_rlimit_nofile 8192;
# Директива задаёт приоритет рабочих процессов от -20 до 20 (отрицательное число означает более высокий приоритет).
worker_priority -5;
# Путь к логу ошибок
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;
events {
worker_connections 2048;
use epoll;
# multi_accept on;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
# log options
log_format main '$remote_addr - $remote_user [$time_local] '
'"$request" $status $bytes_sent '
'"$http_referer" "$http_user_agent" '
'"$gzip_ratio" "$request_time"';
access_log /var/log/nginx/access.log main;
client_max_body_size 16M;
# Включить sendfile(). Использование sendfile() экономит системные вызовы, уменьшает число копирований данных, позволяет использовать меньше физической памяти.
sendfile on;
# Разрешаем использовать TCP_CORK в Linux, что позволяет передавать заголовок ответа и начало файла в одном пакете в Linux
tcp_nopush on;
# Задаём таймаут, в течение которого keep-alive соединение с клиентом не будет закрыто со стороны сервера. Второй параметр задаёт значение в строке "Keep-Alive: timeout=время" в заголовке ответа.
keepalive_timeout 35 45;
types_hash_max_size 2048;
# Разрешаем использовать опцию TCP_NODELAY
tcp_nodelay on;
# Запрещаем выдавать версию nginx'а в сообщениях об ошибках и в строке заголовка ответа "Server".
server_tokens off;
# Разрешаем сжатие ответа методом gzip.
gzip on;
#Разрешаем проверку готового сжатого файла.
gzip_static on;
# Устанавливаем уровень сжатия ответа методом gzip.
gzip_comp_level 5;
# Устанавливаем минимальную длину ответа, для которых будет выполняться сжатие ответа методом gzip
gzip_min_length 1024;
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
gzip_buffers 64 8k;
gzip_http_version 1.1;
gzip_proxied any;
gzip_vary on;
gzip_types
text/plain
text/css
text/x-js
text/xml
text/javascript
application/javascript
application/x-javascript
application/json
aplication/xml
application/xml+rss
application/vnd.ms-fontobject
application/x-font-ttf
font/ttf
font/opentype;
# SSL
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
# ssl_stapling on;
# ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=0;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
################################################
We check for errors in the Nginx server configuration files by following the command:
nginx -t
System response when there are no errors:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful
Delete the contents of the configuration file /etc/nginx/sites-enabled/default And then I did the command.
cat /dev/null > /etc/nginx/sites-enabled/default
Change the default Nginx server configuration file, open the file /etc/nginx/sites-enabled/default And paste the copied between the comments below:
vi /etc/nginx/sites-enabled/default
################################################
server {
listen 80 default;
server_name _;
server_name_in_redirect off;
resolver 127.0.0.1;
error_page 404 = @fallback;
# Все 404 ошибки отдаем на обработку Apache2
location @fallback {
proxy_pass http://127.0.0.1:82;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
}
# Статический контент отдаем на прямую
location ~* ^.+\.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|doc|xls|exe|pdf|ppt|txt|tar|mid|midi|wav|bmp|rtf|js|swf|flv|mp3)$ {
root /var/www/$host/web;
access_log off;
expires 30d;
}
# HTML отдельно поскольку файлы могут быть динамические
location ~* ^.+\.(htm|html)$ {
root /var/www/$host/web;
#try_files $uri /index.php ;
access_log off;
expires 30d;
}
# Основной локейшен
location / {
root /var/www/$host/web;
index index.php index.html index.htm;
access_log off;
proxy_pass http://127.0.0.1:82;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# Настройки для phpmyadmin
location /phpmyadmin {
root /usr/share/;
index index.php index.html index.htm;
location ~ ^/phpmyadmin/(.+\.php)$ {
try_files $uri =404;
root /usr/share/;
proxy_pass http://127.0.0.1:82;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location ~* ^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;
}
}
location /phpMyAdmin {
rewrite ^/* /phpmyadmin last;
}
# WEBMAIL если используется раскоментировать:
location /webmail {
root /var/www/apps;
index index.php index.html index.htm;
proxy_pass http://127.0.0.1:82;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
location ~* ^/webmail/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /var/www/apps;
}
}
# AWSTATS
location ^~ /awstats-icon {
alias /usr/share/awstats/icon/;
access_log off;
}
location ^~ /awstatscss {
alias /usr/share/doc/awstats/examples/css/;
access_log off;
}
location ^~ /awstatsclasses {
alias /usr/share/doc/awstats/examples/classes/;
access_log off;
}
}
################################################
We check for errors in the Nginx server configuration files by following the command:
nginx -t
System response when there are no errors:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful
All the necessary changes we made, now you need to restart both web servers and check the work.
Reboot the Apache2 web server by executing the command:
/etc/init.d/apache2 restart
Check on which ports the Apache2 web server hangs by following the command:
netstat -tunap | grep apache2
The answer of the system where we do not see 80 port means that all changes 80 port to 82 we made correctly:
tcp6 0 0 :::8081 :::* LISTEN 2389/apache2 tcp6 0 0 :::82 :::* LISTEN 2389/apache2 tcp6 0 0 :::8085 :::* LISTEN 2389/apache2 tcp6 0 0 :::443 :::* LISTEN 2389/apache2
Reboot the Nginx web server by executing the command:
/etc/init.d/nginx restart
Check on which ports the Nginx web server hangs by following the command:
netstat -tunap | grep nginx
The answer of the system where we see 80 port means that the web server is configured and works correctly:
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 2465/nginx tcp 0 0 192.168.0.1:80 192.168.0.1:33963 ESTABLISHED 2467/nginx: worker
After all of the above, we have Nginx server is first and takes all the work with visitors on its shoulders, thanks to which our server can now process more requests, and serve more visitors.
Part of the Nginx server config is taken to website.
I was with you. Sergey Lazarenko.
Let’s take a short break and watch a video about the benefits of a good lifestyle:
comment