198 lines
5.7 KiB
ReStructuredText
198 lines
5.7 KiB
ReStructuredText
new virtual host
|
||
################
|
||
|
||
:date: 2019-09-09 00:00
|
||
:modified: 2019-09-09 00:00
|
||
:tags: infra
|
||
:category: documentation
|
||
:slug: create_vh
|
||
:authors: Ms.Leave-A-Mix
|
||
:summary: How-To install a new virtual host to the webserver
|
||
|
||
This article will explain how to deploy a new service within your web server.
|
||
The service (framadate), is hosted on the same machine than the webserver
|
||
(nginx). You may like to create a new machine, to use the self-included
|
||
webserver of your programming language (php, python, ruby...), as the goal of
|
||
having one webserver is to save time by configuring only one monitoring system
|
||
and security system for many apps.
|
||
|
||
-------------
|
||
The Webserver
|
||
-------------
|
||
|
||
We use NGINX as a webserver. It is modular and aimed to be as small and
|
||
efficient as possible. Since then, it doesn't include the necessary programs to
|
||
run your scripts. You need to have another program to launch and manages your
|
||
processes. For our example, this will be php-fpm_. If you also use `Alpine
|
||
Linux`_ you can follow `this tutorial
|
||
<https://wiki.alpinelinux.org/wiki/Nginx_with_PHP#PHP7_Installation>`__.
|
||
|
||
------
|
||
System
|
||
------
|
||
|
||
I will use the commands with the default Alpine Linux tools, that are not like
|
||
Debian or Arch ones. Adapt this if you use another distro.
|
||
|
||
I suggest that the webserver is already installed, and is working for serving
|
||
php scripts.
|
||
|
||
We will create a new user that has access to the git repository of your program,
|
||
so you can update it's code easily, without having to re-upload at each
|
||
modification.
|
||
|
||
.. code-block:: bash
|
||
|
||
useradd -rm www-git
|
||
|
||
Create an passwordless ssh key for this user :
|
||
|
||
.. code-block:: bash
|
||
|
||
su www-git
|
||
ssh-keygen`
|
||
|
||
If you need the git authentication (i.e. because your repo is private), do as
|
||
usual.
|
||
|
||
--------
|
||
Database
|
||
--------
|
||
|
||
Freepoteries uses one server to handle all database stuff. We will assume in
|
||
this documentation that the DB software is MariaDB_ (ver. 10.1.38, debian).
|
||
|
||
Your DB server needs to be accessible by the webserver machine, you can test
|
||
this on the webserver host by launching the following command :
|
||
|
||
.. code-block:: bash
|
||
|
||
nc db.server db.port
|
||
|
||
If it gives you the MariaDB version, you're ok to go with this.
|
||
|
||
You need to have an administrator access to the MariaDB server. On the DB
|
||
server, try this by launching the following commands :
|
||
|
||
.. code-block:: bash
|
||
|
||
mariadb -u root
|
||
|
||
If this connects you to the MariaDB prompt, you're ok.
|
||
Now, in this prompt, create the user for our app. It will own a database and all
|
||
the rights on it.
|
||
|
||
.. code-block:: MySQL
|
||
|
||
CREATE DATABASE framadate;
|
||
CREATE USER 'framadate'@'www.freepoteries.fr' identified by '7VDYMDXJXHTC107Z61OWCVTWM';
|
||
GRANT ALL PRIVILEGES ON framadate TO 'framadate'@'www.freepoteries.fr';
|
||
|
||
-----------
|
||
Application
|
||
-----------
|
||
|
||
On the webserver, we just need a running php-fpm socket (tcp or unix), that we
|
||
will use to run the php scripts.
|
||
|
||
The following commands are to execute as the www-git user:
|
||
|
||
.. code-block:: bash
|
||
|
||
git clone ssh://git@git.yannweb.net:2222/maxime-alves/framadate.git
|
||
cd framadate
|
||
composer install
|
||
cd /var/www
|
||
ln -s /home/www-git/framadate poll
|
||
|
||
Then, as root, edit **/etc/nginx/conf.d/poll** and put in the following:
|
||
|
||
.. code-block:: nginx
|
||
|
||
server {
|
||
listen 80;
|
||
root /var/www/poll;
|
||
|
||
keepalive_timeout 70;
|
||
|
||
index index.php index.html index.htm index.nginx-debian.html;
|
||
|
||
server_name poll.freepoteries.fr;
|
||
|
||
location / {
|
||
try_files $uri $uri/ =404;
|
||
}
|
||
|
||
location ~ \.php$ {
|
||
## you can put the settings for app/inc/config.php as
|
||
## fastcgi_param VAR value
|
||
fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
|
||
}
|
||
}
|
||
|
||
|
||
Test your config with :code:`nginx -T`, and if no error occurs (it should print
|
||
your whole configuration), restart the webserver with :code:`service nginx
|
||
reload` .
|
||
|
||
---------------
|
||
External Access
|
||
---------------
|
||
|
||
This part will only focus on external access using the standard server
|
||
configuration, hostnames, and domains. It should be noted that you don't need to
|
||
configure this for a testing server that is limited to internal network access
|
||
(or tunnelling).
|
||
|
||
Since the reverse proxy (article required) receives all external contact coming
|
||
from HTTP and HTTPS, we just need to indicate it to contact the right ip with
|
||
the right port. You can do this by adding this virtualhost to
|
||
**/etc/nginx/conf.d/reverse-proxy**.
|
||
|
||
.. code-block:: nginx
|
||
|
||
# Framadate
|
||
# HTTP
|
||
server {
|
||
include /etc/nginx/bots.d/blockbots.conf;
|
||
include /etc/nginx/bots.d/ddos.conf;
|
||
|
||
listen 80;
|
||
listen [::]:80;
|
||
|
||
server_name poll.freepoteries.fr;
|
||
access_log /var/log/nginx/access.poll.log combined;
|
||
|
||
location / {
|
||
add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";
|
||
proxy_set_header X-Forwarded-Proto $schme;
|
||
proxy_set_header X-Forwarded-For $remote_addr;
|
||
proxy_set_header Host $host;
|
||
proxy_pass http://www2.freepoteries.fr;
|
||
}
|
||
location = /robots.txt { return 200 "User-agent: * Disallow: / "; }
|
||
}
|
||
|
||
---
|
||
SSL
|
||
---
|
||
|
||
In the case of SSL, you do **not** need to have the certificates on the
|
||
application server. You may store them only on the reverse-proxy server, that
|
||
will then communicate with your application host via HTTP.
|
||
|
||
So, in the right server block of **/etc/nginx/conf.d/reverse-proxy**, just add
|
||
the following:
|
||
|
||
.. code-block:: nginx
|
||
|
||
listen 443 ssl;
|
||
listen [::]:443 ssl;
|
||
ssl_certificate /etc/ssl/certs/poll_crt.pem;
|
||
ssl_certificate_key /etc/ssl/private/poll_key.pem;
|
||
|
||
|
||
.. _php-fpm: https://php-fpm.org/
|
||
.. _Alpine Linux: https://alpinelinux.org/
|
||
.. _MariaDB: https://mariadb.org/
|