Lua-resty-auto-ssl: Nginx no se inicia después de reemplazar el contenido de nginx.conf

Creado en 2 feb. 2019 · 11Comentarios · Fuente: auto-ssl/lua-resty-auto-ssl

Intenté instalar lua-resty-auto-ssl en una nueva instalación de Debian 9

Hice lo siguiente

apt update
apt install nginx
apt install build-essential
apt install luarocks
luarocks install lua-resty-auto-ssl
mkdir /etc/resty-auto-ssl
chown www-data /etc/resty-auto-ssl

Luego reemplacé /etc/nginx/nginx.conf con el ejemplo mínimo publicado aquí en léame https://github.com/GUI/lua-resty-auto-ssl

Pero después de reemplazar el contenido de ngix.conf con el ejemplo mínimo, nginx ya no puede iniciarse

yo obtengo

root<strong i="13">@vultr</strong>:/etc/nginx# /etc/init.d/nginx start
[....] Starting nginx (via systemctl): nginx.serviceJob for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xe" for details.
 failed!
root<strong i="14">@vultr</strong>:/etc

root<strong i="17">@vultr</strong>:/etc/nginx# systemctl status nginx.service
● nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sat 2019-02-02 20:17:41 UTC; 50s ago
     Docs: man:nginx(8)
  Process: 6606 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 483 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
  Process: 6923 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
 Main PID: 496 (code=exited, status=0/SUCCESS)

Feb 02 20:17:41 vultr.guest systemd[1]: Starting A high performance web server and a reverse proxy server...
Feb 02 20:17:41 vultr.guest nginx[6923]: nginx: [emerg] unknown directive "lua_shared_dict" in /etc/nginx/nginx.conf:14
Feb 02 20:17:41 vultr.guest nginx[6923]: nginx: configuration file /etc/nginx/nginx.conf test failed
Feb 02 20:17:41 vultr.guest systemd[1]: nginx.service: Control process exited, code=exited status=1
Feb 02 20:17:41 vultr.guest systemd[1]: Failed to start A high performance web server and a reverse proxy server.
Feb 02 20:17:41 vultr.guest systemd[1]: nginx.service: Unit entered failed state.
Feb 02 20:17:41 vultr.guest systemd[1]: nginx.service: Failed with result 'exit-code'.

contenido de mi nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
  worker_connections 1024;
}

http {
  # The "auto_ssl" shared dict should be defined with enough storage space to
  # hold your certificate data. 1MB of storage holds certificates for
  # approximately 100 separate domains.
  lua_shared_dict auto_ssl 1m;
  # The "auto_ssl_settings" shared dict is used to temporarily store various settings
  # like the secret used by the hook server on port 8999. Do not change or
  # omit it.
  lua_shared_dict auto_ssl_settings 64k;

  # A DNS resolver must be defined for OCSP stapling to function.
  #
  # This example uses Google's DNS server. You may want to use your system's
  # default DNS servers, which can be found in /etc/resolv.conf. If your network
  # is not IPv6 compatible, you may wish to disable IPv6 results by using the
  # "ipv6=off" flag (like "resolver 8.8.8.8 ipv6=off").
  resolver 8.8.8.8;

  # Initial setup tasks.
  init_by_lua_block {
    auto_ssl = (require "resty.auto-ssl").new()

    -- Define a function to determine which SNI domains to automatically handle
    -- and register new certificates for. Defaults to not allowing any domains,
    -- so this must be configured.
    auto_ssl:set("allow_domain", function(domain)
      return true
    end)

    auto_ssl:init()
  }

  init_worker_by_lua_block {
    auto_ssl:init_worker()
  }

  # HTTPS server
  server {
    listen 443 ssl;

    # Dynamic handler for issuing or returning certs for SNI domains.
    ssl_certificate_by_lua_block {
      auto_ssl:ssl_certificate()
    }

    # You must still define a static ssl_certificate file for nginx to start.
    #
    # You may generate a self-signed fallback with:
    #
    # openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
    #   -subj '/CN=sni-support-required-for-valid-ssl' \
    #   -keyout /etc/ssl/resty-auto-ssl-fallback.key \
    #   -out /etc/ssl/resty-auto-ssl-fallback.crt
    ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
    ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;
  }

  # HTTP server
  server {
    listen 80;

    # Endpoint used for performing domain verification with Let's Encrypt.
    location /.well-known/acme-challenge/ {
      content_by_lua_block {
        auto_ssl:challenge_server()
      }
    }
  }

  # Internal server running on port 8999 for handling certificate tasks.
  server {
    listen 127.0.0.1:8999;

    # Increase the body buffer size, to ensure the internal POSTs can always
    # parse the full POST contents into memory.
    client_body_buffer_size 128k;
    client_max_body_size 128k;

    location / {
      content_by_lua_block {
        auto_ssl:hook_server()
      }
    }
  }
}

¿Alguna idea de lo que está mal?

Fuente

arya6000

Todos 11 comentarios

Parece que nginx no carga lua correctamente.
Aquí está mi dockerfile, basado en ubuntu 16:04. Quizás te ayude:
https://pastebin.com/dnENPEaM
Con la configuración correcta, su configuración debería funcionar bien

gjongenelen en 2 feb. 2019

Parece que nginx no carga lua correctamente.
Aquí está mi dockerfile, basado en ubuntu 16:04. Quizás te ayude:
https://pastebin.com/dnENPEaM
Con la configuración correcta, su configuración debería funcionar bien

Gracias, ejecutaré manualmente los comandos en el archivo para instalarlo. Está bien instalar nginx usando apt antes que todo lo demás, ¿verdad?

arya6000 en 3 feb. 2019

Empecé a seguir su archivo, pero no entiendo qué hacen estas líneas

ADD mime.types /etc/nginx/
ADD fastcgi_params /etc/nginx/

ADD ./start.sh /root/

Hice todo lo demás hasta ese momento y sin errores.

arya6000 en 3 feb. 2019

Probablemente sea mejor usar openresty

gjongenelen en 3 feb. 2019

Lamentablemente, todavía no ha tenido éxito. Hice lo siguiente en una instalación nueva de Debian 9, esta vez no instalé Ngix sino que instalé Openresty en su lugar

apt update
apt upgrade
wget -qO - https://openresty.org/package/pubkey.gpg | apt-key add -
apt-get -y install software-properties-common
add-apt-repository -y "deb http://openresty.org/package/debian $(lsb_release -sc) openresty"
apt-get update
apt-get install openresty
apt install luarocks
apt install build-essential
luarocks install lua-resty-auto-ssl
mkdir /etc/resty-auto-ssl
chown www-data /etc/resty-auto-ssl

Luego cambié el contenido de /etc/openresty/nginx.conf

pero obtengo lo siguiente después de intentar iniciarlo

root<strong i="10">@vultr</strong>:/etc/openresty# /etc/init.d/openresty start
[....] Starting openresty (via systemctl): openresty.serviceJob for openresty.service failed because the control process exited with error code.
See "systemctl status openresty.service" and "journalctl -xe" for details.
 failed!

y el error es

root<strong i="14">@vultr</strong>:~# systemctl status --no-pager --full openresty.service      
● openresty.service - full-fledged web platform
   Loaded: loaded (/lib/systemd/system/openresty.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sun 2019-02-03 19:44:22 UTC; 16min ago
  Process: 18855 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /usr/local/openresty/nginx/logs/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 18886 ExecStartPre=/usr/local/openresty/nginx/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
 Main PID: 12782 (code=exited, status=0/SUCCESS)

Feb 03 19:44:22 vultr.guest systemd[1]: Starting full-fledged web platform...
Feb 03 19:44:22 vultr.guest nginx[18886]: nginx: [emerg] BIO_new_file("/etc/ssl/resty-auto-ssl-fallback.crt") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/ssl/resty-auto-ssl-fallback.crt','r') error:2006D080:BIO routines:BIO_new_file:no such file)
Feb 03 19:44:22 vultr.guest nginx[18886]: nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test failed
Feb 03 19:44:22 vultr.guest systemd[1]: openresty.service: Control process exited, code=exited status=1
Feb 03 19:44:22 vultr.guest systemd[1]: Failed to start full-fledged web platform.
Feb 03 19:44:22 vultr.guest systemd[1]: openresty.service: Unit entered failed state.
Feb 03 19:44:22 vultr.guest systemd[1]: openresty.service: Failed with result 'exit-code'.

arya6000 en 3 feb. 2019

Lo tengo para empezar corriendo

openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -subj '/CN=sni-support-required-for-valid-ssl' \
> -keyout /etc/ssl/resty-auto-ssl-fallback.key -out /etc/ssl/resty-auto-ssl-fallback.crt

arya6000 en 3 feb. 2019

👍1

El único problema al que me enfrento ahora es que si voy a https://mydomain.com, el certificado es de "sni-support-required-for-valid-ssl", parece que no está generando el certificado letsencrypt para mi dominio.

arya6000 en 3 feb. 2019

Es una cuestión de permiso. Si cambio el usuario de nginx a root, todo funciona bien. Encontraré una manera de solucionarlo y luego escribiré una guía de instalación.

arya6000 en 3 feb. 2019

Gracias por tu ayuda. Escribí una guía paso a paso para referencia futura

Instalar lua resty auto ssl en Debian

arya6000 en 3 feb. 2019

👍1

Contenido de mi nginx.conf

`usuario www-data;
worker_processes auto;
pid /run/nginx.pid;

Remota el carácter de escape si vas a usar esta configuración

incluir /etc/nginx/modules-enabled/*.conf;

eventos {
conexiones_trabajador 768;
}

http {

# configuración básica
enviar archivo encendido;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
incluir /etc/nginx/mime.types;
tipo_predeterminado application / octet-stream;

# ssl config
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;

# configuración de registro
log_format personalizado '$ remote_addr - $ remote_user [$ time_local]'
'"$ request" $ status $ body_bytes_sent'
'"$ http_referer" "$ http_user_agent" "$ http_x_fordered_for"';

access_log /var/log/nginx/access.log personalizado;
error_log /var/log/nginx/error.log;

# gzip
gzip encendido;

# configuración de host virtual
incluir /etc/nginx/conf.d/*.conf;

incluir / etc / nginx / sites-enabled / *;

lua_shared_dict prometheus_metrics 10M;
lua_package_path "/home/kunal/Documents/nginx-lua-prometheus/?.lua ;;";
init_worker_by_lua_block {
prometheus = require ("prometheus"). init ("prometheus_metrics")
metric_requests = p rometheus: contador (
"nginx_http_requests_total", "Número de solicitudes HTTP", {"host", "status"})
latencia_metrica = p rometheus: histograma (
"nginx_http_request_duration_seconds", "Latencia de solicitud HTTP", {"host"})
conexiones_métricas = p rometheus: gauge (
"nginx_http_connections", "Número de conexiones HTTP", {"estado"})
}
log_by_lua_block {
solicitudes_metric: inc (1, {ngx.var.server_name, ngx.var.status})
latencia de metric_
}
'