Lua-resty-auto-ssl: Nginx tidak dimulai setelah mengganti konten nginx.conf

Dibuat pada 2 Feb 2019 · 11Komentar · Sumber: auto-ssl/lua-resty-auto-ssl

Saya mencoba menginstal lua-resty-auto-ssl pada instalasi baru Debian 9

Saya melakukan yang berikut

apt update
apt install nginx
apt install build-essential
apt install luarocks
luarocks install lua-resty-auto-ssl
mkdir /etc/resty-auto-ssl
chown www-data /etc/resty-auto-ssl

Saya kemudian mengganti /etc/nginx/nginx.conf dengan contoh minimal yang diposting di sini di baca saya https://github.com/GUI/lua-resty-auto-ssl

Tapi setelah mengganti isi ngix.conf dengan contoh minimal, nginx tidak bisa lagi dijalankan

saya mendapat

root<strong i="13">@vultr</strong>:/etc/nginx# /etc/init.d/nginx start
[....] Starting nginx (via systemctl): nginx.serviceJob for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xe" for details.
 failed!
root<strong i="14">@vultr</strong>:/etc

root<strong i="17">@vultr</strong>:/etc/nginx# systemctl status nginx.service
● nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sat 2019-02-02 20:17:41 UTC; 50s ago
     Docs: man:nginx(8)
  Process: 6606 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 483 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
  Process: 6923 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
 Main PID: 496 (code=exited, status=0/SUCCESS)

Feb 02 20:17:41 vultr.guest systemd[1]: Starting A high performance web server and a reverse proxy server...
Feb 02 20:17:41 vultr.guest nginx[6923]: nginx: [emerg] unknown directive "lua_shared_dict" in /etc/nginx/nginx.conf:14
Feb 02 20:17:41 vultr.guest nginx[6923]: nginx: configuration file /etc/nginx/nginx.conf test failed
Feb 02 20:17:41 vultr.guest systemd[1]: nginx.service: Control process exited, code=exited status=1
Feb 02 20:17:41 vultr.guest systemd[1]: Failed to start A high performance web server and a reverse proxy server.
Feb 02 20:17:41 vultr.guest systemd[1]: nginx.service: Unit entered failed state.
Feb 02 20:17:41 vultr.guest systemd[1]: nginx.service: Failed with result 'exit-code'.

isi nginx.conf saya

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
  worker_connections 1024;
}

http {
  # The "auto_ssl" shared dict should be defined with enough storage space to
  # hold your certificate data. 1MB of storage holds certificates for
  # approximately 100 separate domains.
  lua_shared_dict auto_ssl 1m;
  # The "auto_ssl_settings" shared dict is used to temporarily store various settings
  # like the secret used by the hook server on port 8999. Do not change or
  # omit it.
  lua_shared_dict auto_ssl_settings 64k;

  # A DNS resolver must be defined for OCSP stapling to function.
  #
  # This example uses Google's DNS server. You may want to use your system's
  # default DNS servers, which can be found in /etc/resolv.conf. If your network
  # is not IPv6 compatible, you may wish to disable IPv6 results by using the
  # "ipv6=off" flag (like "resolver 8.8.8.8 ipv6=off").
  resolver 8.8.8.8;

  # Initial setup tasks.
  init_by_lua_block {
    auto_ssl = (require "resty.auto-ssl").new()

    -- Define a function to determine which SNI domains to automatically handle
    -- and register new certificates for. Defaults to not allowing any domains,
    -- so this must be configured.
    auto_ssl:set("allow_domain", function(domain)
      return true
    end)

    auto_ssl:init()
  }

  init_worker_by_lua_block {
    auto_ssl:init_worker()
  }

  # HTTPS server
  server {
    listen 443 ssl;

    # Dynamic handler for issuing or returning certs for SNI domains.
    ssl_certificate_by_lua_block {
      auto_ssl:ssl_certificate()
    }

    # You must still define a static ssl_certificate file for nginx to start.
    #
    # You may generate a self-signed fallback with:
    #
    # openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
    #   -subj '/CN=sni-support-required-for-valid-ssl' \
    #   -keyout /etc/ssl/resty-auto-ssl-fallback.key \
    #   -out /etc/ssl/resty-auto-ssl-fallback.crt
    ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
    ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;
  }

  # HTTP server
  server {
    listen 80;

    # Endpoint used for performing domain verification with Let's Encrypt.
    location /.well-known/acme-challenge/ {
      content_by_lua_block {
        auto_ssl:challenge_server()
      }
    }
  }

  # Internal server running on port 8999 for handling certificate tasks.
  server {
    listen 127.0.0.1:8999;

    # Increase the body buffer size, to ensure the internal POSTs can always
    # parse the full POST contents into memory.
    client_body_buffer_size 128k;
    client_max_body_size 128k;

    location / {
      content_by_lua_block {
        auto_ssl:hook_server()
      }
    }
  }
}

Apakah ada yang salah?

Sumber

arya6000

Semua 11 komentar

Sepertinya nginx tidak memuat lua dengan benar.
Ini dockerfile saya, berdasarkan ubuntu 16:04. Mungkin itu akan membantu Anda:
https://pastebin.com/dnENPEaM
Dengan pengaturan yang benar, konfigurasi Anda akan berfungsi dengan baik

gjongenelen pada 2 Feb 2019

Sepertinya nginx tidak memuat lua dengan benar.
Ini dockerfile saya, berdasarkan ubuntu 16:04. Mungkin itu akan membantu Anda:
https://pastebin.com/dnENPEaM
Dengan pengaturan yang benar, konfigurasi Anda akan berfungsi dengan baik

Terima kasih, saya akan menjalankan perintah dalam file secara manual untuk menginstalnya. Tidak apa-apa menginstal nginx menggunakan apt sebelum yang lainnya kan?

arya6000 pada 3 Feb 2019

Saya mulai mengikuti file Anda, tetapi tidak mengerti apa yang dilakukan baris-baris ini

ADD mime.types /etc/nginx/
ADD fastcgi_params /etc/nginx/

ADD ./start.sh /root/

Saya melakukan yang lainnya hingga saat itu dan tidak ada kesalahan

arya6000 pada 3 Feb 2019

Anda mungkin lebih baik menggunakan openresty

gjongenelen pada 3 Feb 2019

Sayangnya masih belum berhasil. Saya melakukan hal berikut pada instalasi baru Debian 9, kali ini saya tidak menginstal Ngix tetapi menginstal Openresty sebagai gantinya

apt update
apt upgrade
wget -qO - https://openresty.org/package/pubkey.gpg | apt-key add -
apt-get -y install software-properties-common
add-apt-repository -y "deb http://openresty.org/package/debian $(lsb_release -sc) openresty"
apt-get update
apt-get install openresty
apt install luarocks
apt install build-essential
luarocks install lua-resty-auto-ssl
mkdir /etc/resty-auto-ssl
chown www-data /etc/resty-auto-ssl

Saya kemudian mengubah isi /etc/openresty/nginx.conf

tapi saya mendapatkan yang berikut setelah mencoba memulainya

root<strong i="10">@vultr</strong>:/etc/openresty# /etc/init.d/openresty start
[....] Starting openresty (via systemctl): openresty.serviceJob for openresty.service failed because the control process exited with error code.
See "systemctl status openresty.service" and "journalctl -xe" for details.
 failed!

dan kesalahannya adalah

root<strong i="14">@vultr</strong>:~# systemctl status --no-pager --full openresty.service      
● openresty.service - full-fledged web platform
   Loaded: loaded (/lib/systemd/system/openresty.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sun 2019-02-03 19:44:22 UTC; 16min ago
  Process: 18855 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /usr/local/openresty/nginx/logs/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 18886 ExecStartPre=/usr/local/openresty/nginx/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
 Main PID: 12782 (code=exited, status=0/SUCCESS)

Feb 03 19:44:22 vultr.guest systemd[1]: Starting full-fledged web platform...
Feb 03 19:44:22 vultr.guest nginx[18886]: nginx: [emerg] BIO_new_file("/etc/ssl/resty-auto-ssl-fallback.crt") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/ssl/resty-auto-ssl-fallback.crt','r') error:2006D080:BIO routines:BIO_new_file:no such file)
Feb 03 19:44:22 vultr.guest nginx[18886]: nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test failed
Feb 03 19:44:22 vultr.guest systemd[1]: openresty.service: Control process exited, code=exited status=1
Feb 03 19:44:22 vultr.guest systemd[1]: Failed to start full-fledged web platform.
Feb 03 19:44:22 vultr.guest systemd[1]: openresty.service: Unit entered failed state.
Feb 03 19:44:22 vultr.guest systemd[1]: openresty.service: Failed with result 'exit-code'.

arya6000 pada 3 Feb 2019

Saya memulainya dengan berlari

openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -subj '/CN=sni-support-required-for-valid-ssl' \
> -keyout /etc/ssl/resty-auto-ssl-fallback.key -out /etc/ssl/resty-auto-ssl-fallback.crt

arya6000 pada 3 Feb 2019

👍1

Satu-satunya masalah yang saya hadapi sekarang adalah jika saya pergi ke https://mydomain.com sertifikatnya dengan "sni-support-required-for-valid-ssl" sepertinya tidak menghasilkan sertifikat letsencrypt untuk domain saya.

arya6000 pada 3 Feb 2019

Ini masalah izin. Jika saya mengubah pengguna nginx menjadi root semuanya berfungsi dengan baik. Saya akan menemukan cara untuk memperbaikinya dan kemudian saya akan menulis panduan instalasi.

arya6000 pada 3 Feb 2019

Terima kasih atas bantuan Anda. Saya menulis panduan langkah demi langkah untuk referensi di masa mendatang

Menginstal lua resty auto ssl di Debian

arya6000 pada 3 Feb 2019

👍1

Konten nginx.conf saya

`pengguna www-data;
pekerja_proses otomatis;
pid /run/nginx.pid;

jauhkan escape char jika Anda akan menggunakan konfigurasi ini

sertakan /etc/nginx/modules-enabled/*.conf;

acara {
pekerja_koneksi 768;
}

http {

# konfigurasi dasar
kirim file pada;
tcp_nopush aktif;
tcp_nodelay aktif;
keepalive_timeout 65;
types_hash_max_size 2048;
sertakan /etc/nginx/mime.types;
aplikasi default_type/aliran oktet;

# konfigurasi ssl
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers aktif;

# konfigurasi logging
log_format kustom '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log kustom;
error_log /var/log/nginx/error.log;

#gzip
gzip aktif;

# konfigurasi host virtual
sertakan /etc/nginx/conf.d/*.conf;

sertakan /etc/nginx/sites-enabled/*;

lua_shared_dict prometheus_metrics 10 juta;
lua_package_path "/home/kunal/Documents/nginx-lua-prometheus/?.lua;;";
init_worker_by_lua_block {
prometheus = membutuhkan("prometheus").init("prometheus_metrics")
metric_requests = p rometheus:penghitung (
"nginx_http_requests_total", "Jumlah permintaan HTTP", {"host", "status"})
metric_latency = p rometheus:histogram (
"nginx_http_request_duration_seconds", "latensi permintaan HTTP", {"host"})
metric_connections = p rometheus:gauge (
"nginx_http_connections", "Jumlah koneksi HTTP", {"state"})
}
log_by_lua_block {
metric_ request:inc (1, {ngx.var.server_name, ngx.var.status})
metric_ latency:observe (tonumber(ngx.var.request_time), {ngx.var.server_name})
}
`