Ubuntu 18.04: Nginx

Installation

Immer neuste (stabile) Version über PPA

https://launchpad.net/~nginx

# add-apt-repository ppa:nginx/stable
# apt-get update
# aptitude install nginx

Version aus der Distribution

# apt-get update
# aptitude install nginx

Prüfung

# service nginx status
● nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2019-04-06 14:50:15 CEST; 9min ago
     Docs: man:nginx(8)
  Process: 8408 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 8826 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
  Process: 8820 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
 Main PID: 8828 (nginx)
    Tasks: 2 (limit: 2319)
   CGroup: /system.slice/nginx.service
           ├─8828 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
           └─8830 nginx: worker process

Apr 06 14:50:15 xxx systemd[1]: Starting A high performance web server and a reverse proxy server...
Apr 06 14:50:15 xxx systemd[1]: nginx.service: Failed to parse PID from file /run/nginx.pid: Invalid argument
Apr 06 14:50:15 xxx systemd[1]: Started A high performance web server and a reverse proxy server.

# netstat -anptu
Aktive Internetverbindungen (Server und stehende Verbindungen)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      8828/nginx: master
tcp6       0      0 :::80                   :::*                    LISTEN      8828/nginx: master

Konfiguration

nginx.conf

[...]
        server_tokens off;
[...]

HTTPS mit Let's Encrypt

Certbot installieren

Als root ausführen:

# apt-get update
# apt-get install software-properties-common
# add-apt-repository universe
# add-apt-repository ppa:certbot/certbot
# apt-get update
# apt-get install python3-certbot-nginx

Cerbot: Zertifikate anfordern und Webserver anpassen

certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email example@domain.de --domain example-website.de

Cronjob zur Erneuerung der Zertifikate

# whereis certbot
certbot: /usr/bin/certbot /usr/share/man/man1/certbot.1.gz
# crontab -e

In die Crontab kommt dann beispielsweise folgendes rein:

# m h  dom mon dow   command
30 4 * * * /usr/bin/certbot renew >> /var/log/le-renew.log

Dann lassen wir noch unser Logfile rotieren:

/etc/logrotate.d/le-renew

/var/log/le-renew.log
{
    rotate 12
    weekly
    compress
    missingok
}

PHP

Installation

PHP im CGI-Modus mit einigen Modulen:

# aptitude install php7.2-bz2 php7.2-cli php7.2-common php7.2-curl php7.2-fpm php7.2-gd php7.2-intl php7.2-json php7.2-mbstring php7.2-mysql php7.2-opcache php7.2-readline php7.2-xml php7.2-zip