Lua-resty-auto-ssl: nginx.conf์˜ ๋‚ด์šฉ์„ ๊ต์ฒดํ•œ ํ›„ Nginx๊ฐ€ ์‹œ์ž‘๋˜์ง€ ์•Š์Œ

์— ๋งŒ๋“  2019๋…„ 02์›” 02์ผ  ยท  11์ฝ”๋ฉ˜ํŠธ  ยท  ์ถœ์ฒ˜: auto-ssl/lua-resty-auto-ssl

Debian 9๋ฅผ ์ƒˆ๋กœ ์„ค์น˜ํ•  ๋•Œ lua-resty-auto-ssl์„ ์„ค์น˜ํ•˜๋ ค๊ณ  ํ–ˆ์Šต๋‹ˆ๋‹ค.

๋‚˜๋Š” ๋‹ค์Œ์„ํ–ˆ๋‹ค

apt update
apt install nginx
apt install build-essential
apt install luarocks
luarocks install lua-resty-auto-ssl
mkdir /etc/resty-auto-ssl
chown www-data /etc/resty-auto-ssl

๊ทธ๋Ÿฐ ๋‹ค์Œ /etc/nginx/nginx.conf๋ฅผ https://github.com/GUI/lua-resty-auto-ssl ์ฝ์–ด๋ณด๊ธฐ์— ๊ฒŒ์‹œ๋œ ์ตœ์†Œ ์˜ˆ์ œ๋กœ ๋Œ€์ฒดํ–ˆ์Šต๋‹ˆ๋‹ค.

๊ทธ๋Ÿฌ๋‚˜ ngix.conf์˜ ๋‚ด์šฉ์„ ์ตœ์†Œํ•œ์˜ ์˜ˆ์ œ๋กœ ๊ต์ฒดํ•œ ํ›„ nginx๋Š” ๋” ์ด์ƒ ์‹œ์ž‘ํ•  ์ˆ˜ ์—†์Šต๋‹ˆ๋‹ค.

๋‚˜๋Š” ์–ป๋‹ค

root<strong i="13">@vultr</strong>:/etc/nginx# /etc/init.d/nginx start
[....] Starting nginx (via systemctl): nginx.serviceJob for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xe" for details.
 failed!
root<strong i="14">@vultr</strong>:/etc
root<strong i="17">@vultr</strong>:/etc/nginx# systemctl status nginx.service
โ— nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sat 2019-02-02 20:17:41 UTC; 50s ago
     Docs: man:nginx(8)
  Process: 6606 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 483 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
  Process: 6923 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
 Main PID: 496 (code=exited, status=0/SUCCESS)

Feb 02 20:17:41 vultr.guest systemd[1]: Starting A high performance web server and a reverse proxy server...
Feb 02 20:17:41 vultr.guest nginx[6923]: nginx: [emerg] unknown directive "lua_shared_dict" in /etc/nginx/nginx.conf:14
Feb 02 20:17:41 vultr.guest nginx[6923]: nginx: configuration file /etc/nginx/nginx.conf test failed
Feb 02 20:17:41 vultr.guest systemd[1]: nginx.service: Control process exited, code=exited status=1
Feb 02 20:17:41 vultr.guest systemd[1]: Failed to start A high performance web server and a reverse proxy server.
Feb 02 20:17:41 vultr.guest systemd[1]: nginx.service: Unit entered failed state.
Feb 02 20:17:41 vultr.guest systemd[1]: nginx.service: Failed with result 'exit-code'.

๋‚ด nginx.conf์˜ ๋‚ด์šฉ

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
  worker_connections 1024;
}

http {
  # The "auto_ssl" shared dict should be defined with enough storage space to
  # hold your certificate data. 1MB of storage holds certificates for
  # approximately 100 separate domains.
  lua_shared_dict auto_ssl 1m;
  # The "auto_ssl_settings" shared dict is used to temporarily store various settings
  # like the secret used by the hook server on port 8999. Do not change or
  # omit it.
  lua_shared_dict auto_ssl_settings 64k;

  # A DNS resolver must be defined for OCSP stapling to function.
  #
  # This example uses Google's DNS server. You may want to use your system's
  # default DNS servers, which can be found in /etc/resolv.conf. If your network
  # is not IPv6 compatible, you may wish to disable IPv6 results by using the
  # "ipv6=off" flag (like "resolver 8.8.8.8 ipv6=off").
  resolver 8.8.8.8;

  # Initial setup tasks.
  init_by_lua_block {
    auto_ssl = (require "resty.auto-ssl").new()

    -- Define a function to determine which SNI domains to automatically handle
    -- and register new certificates for. Defaults to not allowing any domains,
    -- so this must be configured.
    auto_ssl:set("allow_domain", function(domain)
      return true
    end)

    auto_ssl:init()
  }

  init_worker_by_lua_block {
    auto_ssl:init_worker()
  }

  # HTTPS server
  server {
    listen 443 ssl;

    # Dynamic handler for issuing or returning certs for SNI domains.
    ssl_certificate_by_lua_block {
      auto_ssl:ssl_certificate()
    }

    # You must still define a static ssl_certificate file for nginx to start.
    #
    # You may generate a self-signed fallback with:
    #
    # openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
    #   -subj '/CN=sni-support-required-for-valid-ssl' \
    #   -keyout /etc/ssl/resty-auto-ssl-fallback.key \
    #   -out /etc/ssl/resty-auto-ssl-fallback.crt
    ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
    ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;
  }

  # HTTP server
  server {
    listen 80;

    # Endpoint used for performing domain verification with Let's Encrypt.
    location /.well-known/acme-challenge/ {
      content_by_lua_block {
        auto_ssl:challenge_server()
      }
    }
  }

  # Internal server running on port 8999 for handling certificate tasks.
  server {
    listen 127.0.0.1:8999;

    # Increase the body buffer size, to ensure the internal POSTs can always
    # parse the full POST contents into memory.
    client_body_buffer_size 128k;
    client_max_body_size 128k;

    location / {
      content_by_lua_block {
        auto_ssl:hook_server()
      }
    }
  }
}

๋ญ๊ฐ€ ์ž˜๋ชป๋๋Š”์ง€ ์ƒ๊ฐํ•ด?

๋ชจ๋“  11 ๋Œ“๊ธ€

nginx๊ฐ€ lua๋ฅผ ์˜ฌ๋ฐ”๋ฅด๊ฒŒ ๋กœ๋“œํ•˜์ง€ ์•Š๋Š” ๊ฒƒ ๊ฐ™์Šต๋‹ˆ๋‹ค.
์—ฌ๊ธฐ ๋‚ด dockerfile์€ ์šฐ๋ถ„ํˆฌ 16:04๋ฅผ ๊ธฐ๋ฐ˜์œผ๋กœ ํ•ฉ๋‹ˆ๋‹ค. ์•„๋งˆ๋„ ๋„์›€์ด ๋  ๊ฒƒ์ž…๋‹ˆ๋‹ค.
https://pastebin.com/dnENPEaM
์˜ฌ๋ฐ”๋ฅธ ์„ค์ •์œผ๋กœ ๊ตฌ์„ฑ์ด ์ œ๋Œ€๋กœ ์ž‘๋™ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

nginx๊ฐ€ lua๋ฅผ ์˜ฌ๋ฐ”๋ฅด๊ฒŒ ๋กœ๋“œํ•˜์ง€ ์•Š๋Š” ๊ฒƒ ๊ฐ™์Šต๋‹ˆ๋‹ค.
์—ฌ๊ธฐ ๋‚ด dockerfile์€ ์šฐ๋ถ„ํˆฌ 16:04๋ฅผ ๊ธฐ๋ฐ˜์œผ๋กœ ํ•ฉ๋‹ˆ๋‹ค. ์•„๋งˆ๋„ ๋„์›€์ด ๋  ๊ฒƒ์ž…๋‹ˆ๋‹ค.
https://pastebin.com/dnENPEaM
์˜ฌ๋ฐ”๋ฅธ ์„ค์ •์œผ๋กœ ๊ตฌ์„ฑ์ด ์ œ๋Œ€๋กœ ์ž‘๋™ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

๊ฐ์‚ฌํ•ฉ๋‹ˆ๋‹ค. ํŒŒ์ผ์— ์žˆ๋Š” ๋ช…๋ น์„ ์ˆ˜๋™์œผ๋กœ ์‹คํ–‰ํ•˜์—ฌ ์„ค์น˜ํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค. ๋‹ค๋ฅธ ๋ชจ๋“  ๊ฒƒ๋ณด๋‹ค ๋จผ์ € apt๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ nginx๋ฅผ ์„ค์น˜ํ•ด๋„ ๊ดœ์ฐฎ์Šต๋‹ˆ๊นŒ?

๋‚˜๋Š” ๋‹น์‹ ์˜ ํŒŒ์ผ์„ ๋”ฐ๋ผ๊ฐ€๊ธฐ ์‹œ์ž‘ํ–ˆ์ง€๋งŒ ์ด ์ค„์ด ๋ฌด์—‡์„ ํ•˜๋Š”์ง€ ์ดํ•ดํ•˜์ง€ ๋ชปํ•ฉ๋‹ˆ๋‹ค

ADD mime.types /etc/nginx/
ADD fastcgi_params /etc/nginx/

ADD ./start.sh /root/

๋‚˜๋Š” ๊ทธ ์‹œ์ ๊นŒ์ง€ ๋‹ค๋ฅธ ๋ชจ๋“  ๊ฒƒ์„ํ–ˆ๊ณ  ์˜ค๋ฅ˜๊ฐ€ ์—†์—ˆ์Šต๋‹ˆ๋‹ค.

์•„๋งˆ๋„ openresty๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒƒ์ด ๋” ๋‚˜์„ ๊ฒƒ์ž…๋‹ˆ๋‹ค.

๋ถˆํ–‰ํžˆ๋„ ์•„์ง ์„ฑ๊ณตํ•˜์ง€ ๋ชปํ–ˆ์Šต๋‹ˆ๋‹ค. Debian 9๋ฅผ ์ƒˆ๋กœ ์„ค์น˜ํ•  ๋•Œ ๋‹ค์Œ์„ ์ˆ˜ํ–‰ํ–ˆ์Šต๋‹ˆ๋‹ค. ์ด๋ฒˆ์—๋Š” Ngix๋ฅผ ์„ค์น˜ํ•˜์ง€ ์•Š๊ณ  ๋Œ€์‹  Openresty๋ฅผ ์„ค์น˜ํ–ˆ์Šต๋‹ˆ๋‹ค.

apt update
apt upgrade
wget -qO - https://openresty.org/package/pubkey.gpg | apt-key add -
apt-get -y install software-properties-common
add-apt-repository -y "deb http://openresty.org/package/debian $(lsb_release -sc) openresty"
apt-get update
apt-get install openresty
apt install luarocks
apt install build-essential
luarocks install lua-resty-auto-ssl
mkdir /etc/resty-auto-ssl
chown www-data /etc/resty-auto-ssl

๊ทธ๋Ÿฐ ๋‹ค์Œ /etc/openresty/nginx.conf์˜ ๋‚ด์šฉ์„ ๋ณ€๊ฒฝํ–ˆ์Šต๋‹ˆ๋‹ค.

๊ทธ๋Ÿฌ๋‚˜ ๋‚˜๋Š” ๊ทธ๊ฒƒ์„ ์‹œ์ž‘ํ•˜๋ ค๊ณ  ์‹œ๋„ํ•œ ํ›„์— ๋‹ค์Œ์„ ์–ป๋Š”๋‹ค.

root<strong i="10">@vultr</strong>:/etc/openresty# /etc/init.d/openresty start
[....] Starting openresty (via systemctl): openresty.serviceJob for openresty.service failed because the control process exited with error code.
See "systemctl status openresty.service" and "journalctl -xe" for details.
 failed!

๊ทธ๋ฆฌ๊ณ  ์˜ค๋ฅ˜๋Š”

root<strong i="14">@vultr</strong>:~# systemctl status --no-pager --full openresty.service      
โ— openresty.service - full-fledged web platform
   Loaded: loaded (/lib/systemd/system/openresty.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sun 2019-02-03 19:44:22 UTC; 16min ago
  Process: 18855 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /usr/local/openresty/nginx/logs/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 18886 ExecStartPre=/usr/local/openresty/nginx/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
 Main PID: 12782 (code=exited, status=0/SUCCESS)

Feb 03 19:44:22 vultr.guest systemd[1]: Starting full-fledged web platform...
Feb 03 19:44:22 vultr.guest nginx[18886]: nginx: [emerg] BIO_new_file("/etc/ssl/resty-auto-ssl-fallback.crt") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/ssl/resty-auto-ssl-fallback.crt','r') error:2006D080:BIO routines:BIO_new_file:no such file)
Feb 03 19:44:22 vultr.guest nginx[18886]: nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test failed
Feb 03 19:44:22 vultr.guest systemd[1]: openresty.service: Control process exited, code=exited status=1
Feb 03 19:44:22 vultr.guest systemd[1]: Failed to start full-fledged web platform.
Feb 03 19:44:22 vultr.guest systemd[1]: openresty.service: Unit entered failed state.
Feb 03 19:44:22 vultr.guest systemd[1]: openresty.service: Failed with result 'exit-code'.

๋‚˜๋Š” ๊ทธ๊ฒƒ์„ ์‹คํ–‰ํ•˜์—ฌ ์‹œ์ž‘ํ–ˆ์Šต๋‹ˆ๋‹ค.

openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -subj '/CN=sni-support-required-for-valid-ssl' \
> -keyout /etc/ssl/resty-auto-ssl-fallback.key -out /etc/ssl/resty-auto-ssl-fallback.crt

๋‚ด๊ฐ€ ์ง€๊ธˆ ์ง๋ฉดํ•˜๊ณ  ์žˆ๋Š” ์œ ์ผํ•œ ๋ฌธ์ œ๋Š” https://mydomain.com์œผ๋กœ ์ด๋™ํ•˜๋Š” ๊ฒฝ์šฐ ์ธ์ฆ์„œ๊ฐ€ "sni-support-required-for-valid-ssl"์— ์˜ํ•œ ๊ฒƒ์ด๋ฉฐ ๋‚ด ๋„๋ฉ”์ธ์— ๋Œ€ํ•œ letsencrypt ์ธ์ฆ์„œ๋ฅผ ์ƒ์„ฑํ•˜์ง€ ์•Š๋Š” ๊ฒƒ์ฒ˜๋Ÿผ ๋ณด์ž…๋‹ˆ๋‹ค.

๊ถŒํ•œ ๋ฌธ์ œ์ž…๋‹ˆ๋‹ค. nginx ์‚ฌ์šฉ์ž๋ฅผ ๋ฃจํŠธ๋กœ ๋ณ€๊ฒฝํ•˜๋ฉด ๋ชจ๋“  ๊ฒƒ์ด ์ž˜ ์ž‘๋™ํ•ฉ๋‹ˆ๋‹ค. ๊ณ ์น  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์„ ์ฐพ์€ ๋‹ค์Œ ์„ค์น˜ ๊ฐ€์ด๋“œ๋ฅผ ์ž‘์„ฑํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค.

๋‹น์‹ ์˜ ๋„์›€์„ ์ฃผ์…”์„œ ๊ฐ์‚ฌํ•ฉ๋‹ˆ๋‹ค. ๋‚˜์ค‘์— ์ฐธ์กฐํ•  ์ˆ˜ ์žˆ๋„๋ก ๋‹จ๊ณ„๋ณ„ ๊ฐ€์ด๋“œ๋ฅผ ์ž‘์„ฑํ–ˆ์Šต๋‹ˆ๋‹ค.

Debian์— lua resty auto ssl ์„ค์น˜

๋‚ด nginx.conf์˜ ๋‚ด์šฉ

`์‚ฌ์šฉ์ž www-๋ฐ์ดํ„ฐ;
์ž‘์—…์ž ํ”„๋กœ์„ธ์Šค ์ž๋™;
pid /run/nginx.pid;

์ด ๊ตฌ์„ฑ์„ ์‚ฌ์šฉํ•˜๋ ค๋Š” ๊ฒฝ์šฐ ์›๊ฒฉ ์ด์Šค์ผ€์ดํ”„ ๋ฌธ์ž

/etc/nginx/modules-enabled/*.conf ํฌํ•จ;

์ด๋ฒคํŠธ {
์ž‘์—…์ž ์—ฐ๊ฒฐ 768;
}

http {

# ๊ธฐ๋ณธ ๊ตฌ์„ฑ
์„ผ๋“œํŒŒ์ผ ์ผœ๊ธฐ;
tcp_nopush on;
tcp_nodelay ์ผœ์ง;
keepalive_timeout 65;
์œ ํ˜•_ํ•ด์‹œ_์ตœ๋Œ€_ํฌ๊ธฐ 2048;
/etc/nginx/mime.types ํฌํ•จ;
default_type ์‘์šฉ ํ”„๋กœ๊ทธ๋žจ/์˜ฅํ…Ÿ ์ŠคํŠธ๋ฆผ;

# SSL ๊ตฌ์„ฑ
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers ์ผœ์ง;

# ๋กœ๊น… ๊ตฌ์„ฑ
log_format ์‚ฌ์šฉ์ž ์ •์˜ '$remote_addr - $remote_user [$time_local] '
'"$์š”์ฒญ" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log ์‚ฌ์šฉ์ž ์ •์˜;
error_log /var/log/nginx/error.log;

# zip
gzip ์ผœ๊ธฐ;

# ๊ฐ€์ƒ ํ˜ธ์ŠคํŠธ ์„ค์ •
ํฌํ•จ /etc/nginx/conf.d/*.conf;

ํฌํ•จ /etc/nginx/sites-enabled/*;

lua_shared_dict prometheus_metrics 10M;
lua_package_path "/home/kunal/Documents/nginx-lua-prometheus/?.lua;;";
init_worker_by_lua_block {
prometheus = require("prometheus").init("prometheus_metrics")
metric_requests = ํ”„๋กœ๋ฉ”ํ…Œ์šฐ์Šค:์นด์šดํ„ฐ (
"nginx_http_requests_total", "HTTP ์š”์ฒญ ์ˆ˜", {"ํ˜ธ์ŠคํŠธ", "์ƒํƒœ"})
metric_latency = ํ”„๋กœ๋ฉ”ํ…Œ์šฐ์Šค:ํžˆ์Šคํ† ๊ทธ๋žจ (
"nginx_http_request_duration_seconds", "HTTP ์š”์ฒญ ๋Œ€๊ธฐ ์‹œ๊ฐ„", {"ํ˜ธ์ŠคํŠธ"})
metric_connections = ํ”„๋กœ๋ฉ”ํ…Œ์šฐ์Šค:๊ฒŒ์ด์ง€ (
"nginx_http_connections", "HTTP ์—ฐ๊ฒฐ ์ˆ˜", {"state"})
}
log_by_lua_block {
metric_ requests:inc (1, {ngx.var.server_name, ngx.var.status})
metric_ latency:๊ด€์ฐฐ (tonumber(ngx.var.request_time), {ngx.var.server_name})
}
`

์—ฌ๊ธฐ์— ๋ฌด์—‡์ด ์ž˜๋ชป๋˜์—ˆ๋Š”์ง€์— ๋Œ€ํ•œ ์ œ์•ˆ์ด ์žˆ์Šต๋‹ˆ๊นŒ?

๋‹น์‹ ์˜ ๋„์›€์„ ์ฃผ์…”์„œ ๊ฐ์‚ฌํ•ฉ๋‹ˆ๋‹ค. ๋‚˜์ค‘์— ์ฐธ์กฐํ•  ์ˆ˜ ์žˆ๋„๋ก ๋‹จ๊ณ„๋ณ„ ๊ฐ€์ด๋“œ๋ฅผ ์ž‘์„ฑํ–ˆ์Šต๋‹ˆ๋‹ค.

Debian์— lua resty auto ssl ์„ค์น˜

์•ˆ๋…•ํ•˜์„ธ์š” @arya6000 ,

์ €๋„ ๊ฐ™์€ ๋ฌธ์ œ๋ฅผ ๊ฒช๊ณ  ์žˆ์ง€๋งŒ ๊ฒŒ์‹œํ•œ ๋งํฌ๊ฐ€ ์ด์ œ ๊นจ์กŒ์Šต๋‹ˆ๋‹ค :(

๋‹น์‹ ์ด ๋‚˜๋ฅผ ๋„์šธ ์ˆ˜ ์žˆ๋‹ค๊ณ  ์ƒ๊ฐํ•ฉ๋‹ˆ๊นŒ?

์ด ํŽ˜์ด์ง€๊ฐ€ ๋„์›€์ด ๋˜์—ˆ๋‚˜์š”?
0 / 5 - 0 ๋“ฑ๊ธ‰