{"id":10830,"date":"2019-09-30T10:53:59","date_gmt":"2019-09-30T08:53:59","guid":{"rendered":"https:\/\/www.websupport.sk\/podpora\/?post_type=ht_kb&p=10830"},"modified":"2020-07-16T23:17:40","modified_gmt":"2020-07-16T21:17:40","slug":"nginx-apache-na-jednom-ubuntu-18-04-lts-serveri","status":"publish","type":"ht_kb","link":"https:\/\/www.websupport.sk\/podpora\/kb\/nginx-apache-na-jednom-ubuntu-18-04-lts-serveri\/","title":{"rendered":"Nginx + Apache na jednom Ubuntu 18.04 LTS serveri"},"content":{"rendered":"\n

Tento tutori\u00e1l pon\u00faka praktick\u00fd n\u00e1vod, ak\u00fdm sp\u00f4sobom nain\u0161talova\u0165 a nakonfigurova\u0165 Nginx ako reverzn\u00e9 proxy pred Apache<\/strong> na distrib\u00facii Ubuntu 18.04 LTS (Bionic Beaver). Nginx bude s\u00fa\u010dasne mo\u017en\u00e9 pou\u017e\u00edva\u0165 ako samostatn\u00fd webov\u00fd server pre PHP a in\u00e9 aplik\u00e1cie. S\u00fa\u010das\u0165ou tutori\u00e1lu je aj konfigur\u00e1cia SSL a proxovanie len vybran\u00fdch typov s\u00faborov.<\/p>\n\n\n\n

Pozn\u00e1mka<\/strong>: Tutori\u00e1l je ur\u010den\u00fd pre virtu\u00e1lny server (VPS) od spolo\u010dnosti WebSupport, av\u0161ak je aplikovate\u013en\u00fd aj na in\u00e9 prostredie, plaformy a poskytovate\u013eov s danou distrib\u00faciou opera\u010dn\u00e9ho syst\u00e9mu.<\/p>\n\n\n\n

Nginx<\/a> aj Apache<\/a> patria medzi najroz\u0161\u00edrenej\u0161ie webov\u00e9 servery. V\u00fdhodou pri t\u00fdchto dvoch technol\u00f3gi\u00e1ch je najm\u00e4 to, \u017ee si nemus\u00edte vybera\u0165. Nie je potrebn\u00e9 vlastni\u0165 ani dve IP adresy, aby ka\u017ed\u00fd server be\u017eal na jednej z nich, \u010di dokonca zad\u00e1va\u0165 URL v tvare https:\/\/example.com:80<\/code>, \u010di https:\/\/example.com:81<\/code>.<\/p>\n\n\n\n

Pozn\u00e1mka: <\/strong>Pred v\u00e4\u010d\u0161\u00edmi z\u00e1sahmi do v\u00e1\u0161ho virtu\u00e1lneho servera odpor\u00fa\u010dame v\u017edy vytvori\u0165 snapshot servera<\/a>. Obnovou snapshotu je mo\u017en\u00e9 vr\u00e1ti\u0165 sa presne do stavu, kedy bol snapshot vytvoren\u00fd.<\/p>\n\n\n\n

Ne\u017e za\u010dneme<\/h2>\n\n\n\n

Pozn\u00e1mka: <\/strong>Na z\u00e1kladn\u00fa in\u0161tal\u00e1ciu odpor\u00fa\u010dame aspo\u0148 bal\u00edk virtu\u00e1lneho servera V3<\/strong> – CPU, RAM pam\u00e4\u0165 i SSD disk je samozrejme mo\u017en\u00e9 kedyko\u013evek zv\u00e4\u010d\u0161i\u0165.<\/p>\n\n\n\n

Opera\u010dn\u00fd syst\u00e9m v tomto pr\u00edpade zvol\u00edme Ubuntu 18.04 LTS<\/strong> (jeho ofici\u00e1lna podpora bude do roku 2023), konfigur\u00e1ciu minimal<\/strong>, teda bez predin\u0161talovan\u00fdch bal\u00edkov (v pr\u00edpade zvolenia LAMP alebo LEMP konfigur\u00e1cie je taktie\u017e mo\u017en\u00e9 pokra\u010dova\u0165).<\/p>\n\n\n\n

Vysk\u00fa\u0161a\u0165 WebSupport VPS zdarma<\/strong><\/a><\/p>\n\n\n\n

Ako prv\u00fd krok po vytvoren\u00ed VPS a prihl\u00e1sen\u00ed sa cez root<\/code> \u00fa\u010det (alebo s dostato\u010dn\u00fdmi pr\u00e1vami) vykon\u00e1me update a upgrade bal\u00ed\u010dkov (v pr\u00edpade update-u bal\u00ed\u010dka, napr\u00edklad grub<\/code>, odpor\u00fa\u010dame necha\u0165 aktu\u00e1lne nastavenia):<\/p>\n\n\n\n

apt update && apt upgrade -y<\/pre>\n\n\n\n
In\u0161tal\u00e1cia a konfigur\u00e1cia Apache<\/h2>\n\n\n\n
Po \u00faspe\u0161nom stiahnut\u00ed najnov\u0161\u00edch bal\u00ed\u010dkov nain\u0161talujeme a nakonfigurujeme webov\u00fd server Apache. In\u0161tal\u00e1cia je relat\u00edvne jednoduch\u00e1 \u2013 m\u00f4\u017eete pou\u017ei\u0165 aj in\u0161tal\u00e1ciu z LAMP konfigur\u00e1cie servera.<\/p>\n\n\n\n
Stiahneme d\u00f4le\u017eit\u00e9 bal\u00ed\u010dky \u2013 apache2<\/code> a najnov\u0161iu verziu PHP:<\/p>\n\n\n\n
apt install apache2 php -y<\/pre>\n\n\n\n
Po nain\u0161talovan\u00ed n\u00e1m Apache web-server po\u010d\u00fava na porte 80. Tento port chceme ponecha\u0165 pre server Nginx, ktor\u00fd bude \u201est\u00e1\u0165 pred n\u00edm\u201c<\/em>. Bude teda potrebn\u00e9 port zmeni\u0165 na in\u00fd, napr\u00edklad 8080<\/code> pre nezabezpe\u010den\u00fa komunik\u00e1ciu a 8443<\/code> pre zabezpe\u010den\u00fa. Pre \u00fapravu textov\u00fdch s\u00faborov je mo\u017en\u00e9 pou\u017ei\u0165 r\u00f4zne CLI textov\u00e9 editory, v na\u0161om pr\u00edpade nano<\/code>:<\/p>\n\n\n\n
nano \/etc\/apache2\/apache2.conf<\/pre>\n\n\n\n
Konfigura\u010dn\u00fd s\u00fabor uprav\u00edme nasledovne:<\/p>\n\n\n\n
Listen 8080\n<IfModule ssl_module>\nListen 8443\n<\/IfModule>\n<IfModule mod_gnutls.c>\nListen 8443\n<\/IfModule><\/pre>\n\n\n\n
S\u00fabor n\u00e1sledne ulo\u017e\u00edme. Ako druh\u00fa \u010das\u0165 je potrebn\u00e9 upravi\u0165 samotn\u00fd VirtualHost<\/code>, aby korektne fungoval na novom porte:<\/p>\n\n\n\n
nano \/etc\/apache2\/sites-available\/000-default.conf<\/pre>\n\n\n\n
Uprav\u00edme prv\u00fd riadok:<\/p>\n\n\n\n
nano \/etc\/apache2\/sites-available\/000-default.conf<\/pre>\n\n\n\n
Uprav\u00edme prv\u00fd riadok:<\/p>\n\n\n\n
<VirtualHost *:8080>\n        ServerAdmin webmaster@localhost\n        DocumentRoot \/var\/www\/html\n        ErrorLog ${APACHE_LOG_DIR}\/error.log\n        CustomLog ${APACHE_LOG_DIR}\/access.log combined\n<\/VirtualHost><\/pre>\n\n\n\n
Pre aktiv\u00e1ciu v\u0161etk\u00fdch vykonan\u00fdch zmien je potrebn\u00e9 slu\u017ebu apache2<\/code> re\u0161tartova\u0165:<\/p>\n\n\n\n
\/etc\/init.d\/apache2 restart<\/pre>\n\n\n\n
Preveri\u0165 dostupnos\u0165 apache2<\/code> je mo\u017en\u00e9 pomocou portu priamo v URL prehliada\u010da. Pri dom\u00e9ne s roz\u0161\u00edren\u00fdm DNS z\u00e1znamom (v tomto pr\u00edpade example.com<\/code>) zad\u00e1me http:\/\/example.com:8080<\/code>. Pokia\u013e na\u0161a dom\u00e9na e\u0161te nem\u00e1 roz\u0161\u00edren\u00e9 DNS z\u00e1znamy, m\u00f4\u017eeme pou\u017ei\u0165 priamo IP adresu servera s portom 8080. Priv\u00edta\u0165 by n\u00e1s mala z\u00e1kladn\u00e1 str\u00e1nka Ubuntu.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
In\u0161tal\u00e1cia a konfigur\u00e1cia Nginx<\/h2>\n\n\n\n
Po \u00faspe\u0161nom nakonfigurovan\u00ed Apache m\u00f4\u017eeme nain\u0161talova\u0165 server Nginx:<\/p>\n\n\n\n
apt install nginx -y<\/pre>\n\n\n\n
Po nain\u0161talovan\u00ed sa uist\u00edme, \u017ee sa slu\u017eba nginx<\/code> zapne aj pri re\u0161tartovan\u00ed servera a taktie\u017e, \u017ee aktu\u00e1lne slu\u017eba be\u017e\u00ed:<\/p>\n\n\n\n
systemctl enable nginx.service\n\/etc\/init.d\/nginx restart<\/pre>\n\n\n\n
V z\u00e1kladnej in\u0161tal\u00e1cii by mal server nginx<\/code> po\u010d\u00fava\u0165 na porte 80<\/code> a po nami vykonan\u00fdch zmen\u00e1ch by mal server apache2<\/code> po\u010d\u00fava\u0165 na porte 8080<\/code>. Pre kontrolu t\u00fdchto nastaven\u00ed m\u00f4\u017eeme preveri\u0165 aktu\u00e1lne otvoren\u00e9 porty n\u00e1\u0161ho servera cez pr\u00edkaz netstat<\/code>:<\/p>\n\n\n\n
netstat -tlpn<\/pre>\n\n\n\n
Konfigur\u00e1cia parametrov proxovania z Nginx na Apache sa nach\u00e1dza v s\u00fabore \/etc\/nginx\/proxy_params<\/code>. Medzi z\u00e1kladn\u00fdmi parametrami n\u00e1jdeme nasledovn\u00e9:<\/p>\n\n\n\n
proxy_set_header Host $http_host;\nproxy_set_header X-Real-IP $remote_addr;\nproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\nproxy_set_header X-Forwarded-Proto $scheme;<\/pre>\n\n\n\n
Parametre sa daj\u00fa doplni\u0165 o mnoh\u00e9 u\u017eito\u010dn\u00e9 direkt\u00edvy. Ich kompletn\u00fd zoznam je mo\u017en\u00e9 n\u00e1js\u0165 na adrese nginx.org\/en\/docs\/http\/ngx_http_proxy_module.html<\/a>. Z h\u013eadiska n\u00e1\u0161ho nastavenia prid\u00e1me pod \u0161tyri existuj\u00face direkt\u00edvy \u010fal\u0161ie \u0161tyri na\u0161e:<\/p>\n\n\n\n
proxy_buffering on;\nproxy_buffer_size 64k;\nproxy_buffers 256 8k;\nproxy_read_timeout 120;<\/pre>\n\n\n\n
Parametre sa daj\u00fa \u0161pecifikova\u0165 aj priamo v nastaven\u00ed VirtualHost<\/code> a pod Nginx serverom.
N\u00e1sledne uprav\u00edme v\u00fdchodziu str\u00e1nku Nginx (\/etc\/nginx\/sites-available\/default<\/code>) a to tak, aby v\u0161etky po\u017eiadavky (requesty) na port 80<\/code> boli zaslan\u00e9 (proxovan\u00e9) na server Apache:<\/p>\n\n\n\n
server {\n     listen 80 default_server;\n     index index.html index.htm index.nginx-debian.html;\n     server_name example.com www.example.com;\n     location \/ {\n       proxy_pass http:\/\/localhost:8080;\n       include \/etc\/nginx\/proxy_params;\n     }\n}<\/pre>\n\n\n\n
Aby sme zmeny aplikovali, je potrebn\u00e9 server Nginx re\u0161tartova\u0165:<\/p>\n\n\n\n
\/etc\/init.d\/nginx restart<\/pre>\n\n\n\n
Overi\u0165 spr\u00e1vne proxovanie m\u00f4\u017eeme napr\u00edklad pomocou developer n\u00e1strojov v prehliada\u010di. Sta\u010d\u00ed zada\u0165 n\u00e1zov dom\u00e9ny alebo IP adresu servera do po\u013ea URL (v na\u0161om pr\u00edpade 195.210.29.181<\/code>), pri\u010dom d\u00f4raz kladieme na Response headers \u2013 Server<\/strong>:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Zr\u00fdchlenie konfigur\u00e1cie<\/h2>\n\n\n\n
Ako v\u0161ak zn\u00ed\u017ei\u0165 odozvu VPS ako web servera? Ako od\u013eah\u010di\u0165 Apache server, aby fungoval r\u00fdchlej\u0161ie? Samotn\u00fdm proxovan\u00edm medzi servermi toti\u017e a\u017e tak ve\u013ea nez\u00edskame. Predstav\u00edme si dva sp\u00f4soby zr\u00fdchlenia va\u0161ej konfigur\u00e1cie.<\/p>\n\n\n\n
a) Spracovanie SSL zabezpe\u010denia u\u017e na slu\u017ebe Nginx<\/h3>\n\n\n\n
Medzi \u0161tandardy dne\u0161n\u00fdch webov rozhodne patr\u00ed SSL certifik\u00e1t a protokol HTTPS. Tieto certifik\u00e1ty je mo\u017en\u00e9 bu\u010f k\u00fapi\u0165<\/a>, alebo z\u00edska\u0165 jednu z free verzi\u00ed, napr\u00edklad od spolo\u010dnosti Let\u2019s Encrypt<\/a>. Na VPS vytvor\u00edme prie\u010dinok, v ktorom budeme dr\u017ea\u0165 s\u00fabory certifik\u00e1tov (example.com<\/code> nahrad\u00edme n\u00e1zvom dom\u00e9ny) a do tohto prie\u010dinka vlo\u017e\u00edme dva s\u00fabory \u2013 priv\u00e1tny k\u013e\u00fa\u010d (private.key<\/code>) a certifik\u00e1t spojen\u00fd s certificate chain (certificate.crt<\/code>):<\/p>\n\n\n\n
mkdir -p \/etc\/ssl\/example.com\nnano \/etc\/ssl\/example.com\/private.key\nnano \/etc\/ssl\/example.com\/certificate.crt<\/pre>\n\n\n\n
N\u00e1sledne m\u00f4\u017eeme upravi\u0165 s\u00fabor VirtualHost<\/code> pre slu\u017ebu Nginx (\/etc\/nginx\/sites-available\/default<\/code>) tak, aby bol ka\u017ed\u00fd nezabezpe\u010den\u00fd request cez protokol HTTP na port 80<\/code> presmerovan\u00fd na zabezpe\u010den\u00fd protokol HTTPS a port 443<\/code> jednoduch\u00fdm redirectom a n\u00e1sledne obsl\u00fa\u017een\u00fd backend serverom Apache:<\/p>\n\n\n\n
server {\n        listen 80 default_server;\n        server_name example.com www.example.com;\n        return 301 https:\/\/$server_name;\n}\n\nserver {\n        listen 443 default_server;\n        ssl on;\n        ssl_certificate \/etc\/ssl\/example.com\/certificate.crt;\n        ssl_certificate_key \/etc\/ssl\/example.com\/private.key;\n        ssl_protocols SSLv3 TLSv1.1 TLSv1.2;\n        location \/ {\n            proxy_pass http:\/\/localhost:8080;\n            include \/etc\/nginx\/proxy_params;\n        }\n}<\/pre>\n\n\n\n
Aby sme op\u00e4\u0165 aplikovali vykonan\u00e9 zmeny, je potrebn\u00e9 server Nginx re\u0161tartova\u0165:<\/p>\n\n\n\n
\/etc\/init.d\/nginx restart<\/pre>\n\n\n\n
Po zadan\u00ed dom\u00e9ny do URL n\u00e1s aktu\u00e1lne presmeruje Nginx server na HTTPS protokol a obsl\u00fa\u017ei n\u00e1\u0161 request certifik\u00e1tom napriek tomu, \u017ee po\u017eiadavku prepo\u0161le na backend servera Apache.<\/p>\n\n\n\n
b) Proxovanie po\u017eiadaviek iba pre vybran\u00e9 s\u00fabory<\/h3>\n\n\n\n
Nako\u013eko je Nginx zn\u00e1my najm\u00e4 svojou r\u00fdchlos\u0165ou, oplat\u00ed sa mnoho s\u00faborov obsl\u00fa\u017ei\u0165 u\u017e na tejto slu\u017ebe a neposiela\u0165 ich na backendov\u00fd server Apache. Zvoli\u0165 teda m\u00f4\u017eeme iba proxovanie .php<\/code> s\u00faborov, zatia\u013e \u010do ostatn\u00e9 obsl\u00fa\u017eime priamo. Na otestovanie si vytvor\u00edme s\u00fabor s funkciou phpinfo<\/code>()<\/code> v prie\u010dinku s webom \/var\/www\/html\/info.php<\/code><\/p>\n\n\n\n
Po vytvoren\u00ed sta\u010d\u00ed upravi\u0165 direkt\u00edvy location<\/code>. Prid\u00e1me taktie\u017e direkt\u00edvu index<\/code>, ktorou definujeme, aby Nginx h\u013eadal z\u00e1kladn\u00fa str\u00e1nku pre zobrazenie pr\u00e1ve pod s\u00faborom index.nginx-debian.html<\/code>, \u010do n\u00e1m posl\u00fa\u017ei na jednoduch\u0161ie vyobrazenie rozdielu medzi s\u00fabormi, ktor\u00e9 obsluhuje Nginx a ktor\u00e9 Apache server:<\/p>\n\n\n\n
server {\n        listen 80 default_server;\n        server_name example.com www.example.com;\n        return 301 https:\/\/$server_name;\n}\n\nserver {\n        listen 443 default_server;\n        root \/var\/www\/html;\n        ssl on;\n        ssl_certificate \/etc\/ssl\/example.com\/certificate.crt;\n        ssl_certificate_key \/etc\/ssl\/example.com\/private.key;\n        ssl_protocols SSLv3 TLSv1.1 TLSv1.2;\n        location \/ {\n            index index.nginx-debian.html;\n        }\n        location ~ \\.php {\n            proxy_pass http:\/\/localhost:8080;\n            include \/etc\/nginx\/proxy_params;\n        }\n}<\/pre>\n\n\n\n
Aktu\u00e1lne je teda na\u0161a dom\u00e9na example.com<\/code> presmerovan\u00e1 na HTTPS protokol a zobraz\u00ed n\u00e1m z\u00e1kladn\u00fa str\u00e1nku Nginx. Po zadan\u00ed example.com\/info.php<\/code> sme u\u017e proxovan\u00ed na Apache server, ktor\u00fd spracuje PHP s\u00fabor.<\/p>\n\n\n\n
Proxovanie iba vybran\u00fdch s\u00faborov m\u00e1 ve\u013emi ve\u013ek\u00e9 vyu\u017eitie pri zr\u00fdch\u013eovan\u00ed str\u00e1nok. V praxi je to napr\u00edklad definovanie statick\u00fdch s\u00faborov pod\u013ea koncovky, ktor\u00e9 m\u00f4\u017eu zosta\u0165 v pam\u00e4ti cache a\u017e 3 mesiace a bud\u00fa pod\u00e1van\u00e9 u\u017e komprimovan\u00e9 pomocou gzip<\/code>. Nepotrebujeme, aby sa zapisovali do access logu a budeme im prid\u00e1va\u0165 vlastn\u00fa hlavi\u010dku Cache-Control<\/code>. Tak\u00e1to konfigur\u00e1cia by vyzerala nasledovne:<\/p>\n\n\n\n
server {\n        listen 80 default_server;\n        server_name example.com www.example.com;\n        return 301 https:\/\/$server_name;\n}\n\nserver {\n        listen 443 default_server;\n        root \/var\/www\/html;\n        ssl on;\n        ssl_certificate \/etc\/ssl\/example.com\/certificate.crt;\n        ssl_certificate_key \/etc\/ssl\/example.com\/private.key;\n        ssl_protocols SSLv3 TLSv1.1 TLSv1.2;\n        location ~* .(ico|png|gif|jpg|jpeg|swf|woff|css|js|html)$ {\n            access_log off;\n            gzip_static on;\n            gzip_comp_level 5;\n            expires 3M;\n            add_header Cache-Control private;\n        }\n        location \/ {\n            index index.nginx-debian.html;\n        }\n        location ~ \\.php {\n            proxy_pass http:\/\/localhost:8080;\n            include \/etc\/nginx\/proxy_params;\n        }\n}<\/pre>\n\n\n\n
Pre najbe\u017enej\u0161ie pou\u017eitie je ide\u00e1lne e\u0161te definova\u0165 tzv. \u201efallback\u201c \u2013 teda definova\u0165 na Nginx serveri cesty, kde m\u00e1 ktor\u00e9 s\u00fabory h\u013eada\u0165 a a\u017e ke\u010f sa s\u00fabory nen\u00e1jdu, sk\u00fasi\u0165 ich proxova\u0165 na Apache server. Toto nastavenie sa naj\u010dastej\u0161ie pou\u017e\u00edva pri CMS WordPress alebo in\u00fdch aplik\u00e1ci\u00e1ch, ktor\u00e9 pou\u017e\u00edvaj\u00fa v Apache mod_rewrite<\/code>. Aktivujeme teda mod_rewrite<\/code>:<\/p>\n\n\n\n
a2enmod rewrite\nsystemctl restart apache2<\/pre>\n\n\n\n
Obohat\u00edme posledn\u00fa konfigur\u00e1ciu o fallback na Apache server (t\u00fdmto krokom taktie\u017e sfunk\u010dn\u00edme logo na z\u00e1kladnej str\u00e1nke Apache \u2013 example.com\/index.html<\/code>), a zak\u00e1\u017eeme priamy pr\u00edstup k s\u00faborom s bodkou (ako napr\u00edklad .htaccess<\/code>, .htpasswd<\/code>:<\/p>\n\n\n\n
server {\n        listen 80 default_server;\n        server_name proxyngap.docolomansky.sk www.proxyngap.docolomansky.sk;\n        return 301 https:\/\/$server_name;\n}\n\nserver {\n        listen 443 default_server;\n        root \/var\/www\/html;\n        ssl on;\n        ssl_certificate \/etc\/ssl\/example.com\/certificate.crt;\n        ssl_certificate_key \/etc\/ssl\/example.com\/private.key;\n        ssl_protocols SSLv3 TLSv1.1 TLSv1.2;\n        location ~* .(ico|jpg|png|gif|jpeg|css|swf|js|woff|html)$ {\n            access_log off;\n            gzip_static on;\n            gzip_comp_level 5;\n            expires 3M;\n            add_header Cache-Control private;\n            try_files $uri @proxy;\n        }\n        location @proxy {\n            proxy_pass http:\/\/localhost:8080;\n        }\n        location \/ {\n            index index.nginx-debian.html;\n        }\n        location ~ \\.php {\n            proxy_pass http:\/\/localhost:8080;\n            include \/etc\/nginx\/proxy_params;\n        }\n        location ~ \/\\. {\n            deny all;\n        }\n}<\/pre>\n\n\n\n
Po zmene konfigur\u00e1ci\u00ed je op\u00e4\u0165 potrebn\u00e9 re\u0161tartova\u0165 slu\u017ebu nginx<\/code>:<\/p>\n\n\n\n
\/etc\/init.d\/nginx restart<\/pre>\n\n\n\n
\u010eal\u0161ie zdroje<\/h2>\n\n\n\n