{"id":926,"date":"2021-04-28T12:41:59","date_gmt":"2021-04-28T12:41:59","guid":{"rendered":"https:\/\/dev.sourcecode.sk\/wsczkb\/?post_type=ht_kb&p=926"},"modified":"2021-10-12T13:55:58","modified_gmt":"2021-10-12T11:55:58","slug":"nginx-apache-na-jednom-ubuntu-18-04-lts-serveru","status":"publish","type":"ht_kb","link":"https:\/\/www.websupport.cz\/podpora\/kb\/nginx-apache-na-jednom-ubuntu-18-04-lts-serveru\/","title":{"rendered":"Nginx + Apache na jednom Ubuntu 18.04 LTS serveru"},"content":{"rendered":"\n

Tento tutori\u00e1l nab\u00edz\u00ed praktick\u00fd n\u00e1vod, jak\u00fdm zp\u016fsobem nainstalovat a nakonfigurovat Nginx jako reverzn\u00ed proxy p\u0159ed Apache<\/strong> na distribuci Ubuntu 18.04 LTS (Bionic Beaver). Nginx bude sou\u010dasn\u011b mo\u017en\u00e9 pou\u017e\u00edvat jako samostatn\u00fd webov\u00fd server pro PHP a jin\u00e9 aplikace. Sou\u010d\u00e1st\u00ed tutori\u00e1lu je i konfigurace SSL a proxov\u00e1n\u00ed jen vybran\u00fdch typ\u016f soubor\u016f.<\/p>\n\n\n\n

Pozn\u00e1mka<\/strong>: Tutori\u00e1l je ur\u010den\u00fd pro virtu\u00e1ln\u00ed server (VPS) od spole\u010dnosti WebSupport, av\u0161ak je aplikovateln\u00fd i na jin\u00e9 prost\u0159ed\u00ed, platformy a poskytovatele s danou distribuc\u00ed opera\u010dn\u00edho syst\u00e9mu.<\/p>\n\n\n\n

Nginx<\/a> i Apache<\/a> pat\u0159\u00ed mezi nejroz\u0161\u00ed\u0159en\u011bj\u0161\u00ed webov\u00e9 servery. V\u00fdhodou t\u011bchto dvou technologi\u00ed je zejm\u00e9na to, \u017ee si nemus\u00edte vyb\u00edrat. Nen\u00ed pot\u0159eba vlastnit ani dv\u011b IP adresy, aby ka\u017ed\u00fd server b\u011b\u017eel na jedn\u00e9 z nich, \u010di dokonce zad\u00e1vat URL ve tvaru https:\/\/example.com:80<\/code>, \u010di https:\/\/example.com:81<\/code>.<\/p>\n\n\n\n

Pozn\u00e1mka: <\/strong>P\u0159ed v\u011bt\u0161\u00edmi z\u00e1sahy do va\u0161eho virtu\u00e1ln\u00edho serveru doporu\u010dujeme v\u017edy vytvo\u0159it snapshot serveru<\/a>. Obnovou snapshotu je mo\u017en\u00e9 vr\u00e1tit se p\u0159esn\u011b do stavu, kdy byl snapshot vytvo\u0159en\u00fd.<\/p>\n\n\n\n

Ne\u017e za\u010dneme<\/h2>\n\n\n\n

Pozn\u00e1mka: <\/strong>Na z\u00e1kladn\u00ed instalaci doporu\u010dujeme alespo\u0148 bal\u00edk virtu\u00e1ln\u00edho serveru V3<\/strong> – CPU, RAM pam\u011b\u0165 i SSD disk je samoz\u0159ejm\u011b mo\u017en\u00e9 kdykoliv zv\u011bt\u0161it.<\/p>\n\n\n\n

Opera\u010dn\u00ed syst\u00e9m v tomto p\u0159\u00edpad\u011b zvol\u00edme Ubuntu 18.04 LTS<\/strong> (jeho ofici\u00e1ln\u00ed podpora bude do roku 2023), konfiguraci minimal<\/strong>, tedy bez p\u0159edinstalovan\u00fdch bal\u00edk\u016f (v p\u0159\u00edpad\u011b zvolen\u00ed LAMP nebo LEMP konfigurace je tak\u00e9 mo\u017en\u00e9 pokra\u010dovat).<\/p>\n\n\n\n

Vyzkou\u0161et WebSupport VPS zdarma<\/strong><\/a><\/p>\n\n\n\n

Jako prvn\u00ed krok po vytvo\u0159en\u00ed VPS a p\u0159ihl\u00e1\u0161en\u00ed se p\u0159es root<\/code> \u00fa\u010det (nebo s dostate\u010dn\u00fdmi pr\u00e1vy) vykon\u00e1me update a upgrade bal\u00ed\u010dk\u016f (v p\u0159\u00edpad\u011b update-u bal\u00ed\u010dku, nap\u0159\u00edklad grub<\/code>, doporu\u010dujeme nechat aktu\u00e1ln\u00ed nastaven\u00ed):<\/p>\n\n\n\n

apt update && apt upgrade -y<\/pre>\n\n\n\n
Instalace a konfigurace Apache<\/h2>\n\n\n\n
Po \u00fasp\u011b\u0161n\u00e9m st\u00e1hnut\u00ed nejnov\u011bj\u0161\u00edch bal\u00ed\u010dk\u016f nainstalujeme a nakonfigurujeme webov\u00fd server Apache. Instalace je relativn\u011b jednoduch\u00e1 \u2013 m\u016f\u017eete pou\u017e\u00edt i instalaci z LAMP konfigurace serveru.<\/p>\n\n\n\n
St\u00e1hneme d\u016fle\u017eit\u00e9 bal\u00ed\u010dky \u2013 apache2<\/code> a nejnov\u011bj\u0161\u00ed verzi PHP:<\/p>\n\n\n\n
apt install apache2 php -y<\/pre>\n\n\n\n
Po nainstalovan\u00ed n\u00e1m Apache web-server spo\u010d\u00edv\u00e1 na portu 80. Tento port chceme ponechat pro server Nginx, kter\u00fd bude \u201est\u00e1t p\u0159ed n\u00edm\u201c<\/em>. Bude tedy pot\u0159eba port zm\u011bnit na jin\u00fd, nap\u0159\u00edklad 8080<\/code> pro nezabezpe\u010denou komunikaci a 8443<\/code> pro zabezpe\u010denou. Pro \u00fapravu textov\u00fdch soubor\u016f je mo\u017en\u00e9 pou\u017e\u00edt r\u016fzn\u00e9 CLI textov\u00e9 editory, v na\u0161em p\u0159\u00edpad\u011b nano<\/code>:<\/p>\n\n\n\n
nano \/etc\/apache2\/apache2.conf<\/pre>\n\n\n\n
Konfigura\u010dn\u00ed soubor uprav\u00edme n\u00e1sledovn\u011b:<\/p>\n\n\n\n
Listen 8080\n<IfModule ssl_module>\nListen 8443\n<\/IfModule>\n<IfModule mod_gnutls.c>\nListen 8443\n<\/IfModule><\/pre>\n\n\n\n
Soubor n\u00e1sledn\u011b ulo\u017e\u00edme. Jako druhou \u010d\u00e1st je pot\u0159eba upravit samotn\u00fd VirtualHost<\/code>, aby korektn\u011b fungoval na nov\u00e9m portu:<\/p>\n\n\n\n
nano \/etc\/apache2\/sites-available\/000-default.conf<\/pre>\n\n\n\n
Uprav\u00edme prvn\u00ed \u0159\u00e1dek:<\/p>\n\n\n\n
nano \/etc\/apache2\/sites-available\/000-default.conf<\/pre>\n\n\n\n
Uprav\u00edme prvn\u00ed \u0159\u00e1dek:<\/p>\n\n\n\n
<VirtualHost *:8080>\n        ServerAdmin webmaster@localhost\n        DocumentRoot \/var\/www\/html\n        ErrorLog ${APACHE_LOG_DIR}\/error.log\n        CustomLog ${APACHE_LOG_DIR}\/access.log combined\n<\/VirtualHost><\/pre>\n\n\n\n
Pro aktivaci v\u0161ech vykonan\u00fdch zm\u011bn je pot\u0159eba slu\u017ebu apache2<\/code> restartovat:<\/p>\n\n\n\n
\/etc\/init.d\/apache2 restart<\/pre>\n\n\n\n
Prov\u011b\u0159it dostupnost apache2<\/code> je mo\u017en\u00e9 pomoc\u00ed portu p\u0159\u00edmo v URL prohl\u00ed\u017ee\u010de. U dom\u00e9ny s roz\u0161\u00ed\u0159en\u00fdm DNS z\u00e1znamem (v tomto p\u0159\u00edpad\u011b example.com<\/code>) zad\u00e1me http:\/\/example.com:8080<\/code>. Pokud na\u0161e dom\u00e9na je\u0161t\u011b nem\u00e1 roz\u0161\u00ed\u0159en\u00e9 DNS z\u00e1znamy, m\u016f\u017eeme pou\u017e\u00edt p\u0159\u00edmo IP adresu serveru s portem 8080. P\u0159iv\u00edtat by n\u00e1s m\u011bla z\u00e1kladn\u00ed str\u00e1nka Ubuntu.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Instalace a konfigurace Nginx<\/h2>\n\n\n\n
Po \u00fasp\u011b\u0161n\u00e9m nakonfigurovan\u00ed Apache m\u016f\u017eeme nainstalovat server Nginx:<\/p>\n\n\n\n
apt install nginx -y<\/pre>\n\n\n\n
Po nainstalovan\u00ed se ujist\u00edme, \u017ee se slu\u017eba nginx<\/code> zapne i p\u0159i restartovan\u00ed serveru a tak\u00e9, \u017ee aktu\u00e1ln\u011b slu\u017eba b\u011b\u017e\u00ed:<\/p>\n\n\n\n
systemctl enable nginx.service\n\/etc\/init.d\/nginx restart<\/pre>\n\n\n\n
V z\u00e1kladn\u00ed instalaci by m\u011bl server nginx<\/code> spo\u010d\u00edvat na portu 80<\/code> a po n\u00e1mi vykonan\u00fdch zm\u011bn\u00e1ch by m\u011bl server apache2<\/code> spo\u010d\u00edvat na portu 8080<\/code>. Pro kontrolu t\u011bchto nastaven\u00ed m\u016f\u017eeme prov\u011b\u0159it aktu\u00e1ln\u011b otev\u0159en\u00e9 porty na\u0161eho serveru p\u0159es p\u0159\u00edkaz netstat<\/code>:<\/p>\n\n\n\n
netstat -tlpn<\/pre>\n\n\n\n
Konfigurace parametr\u016f proxov\u00e1n\u00ed z Nginx na Apache se nach\u00e1z\u00ed v souboru \/etc\/nginx\/proxy_params<\/code>. Mezi z\u00e1kladn\u00edmi parametry najdeme n\u00e1sledovn\u00e9:<\/p>\n\n\n\n
proxy_set_header Host $http_host;\nproxy_set_header X-Real-IP $remote_addr;\nproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\nproxy_set_header X-Forwarded-Proto $scheme;<\/pre>\n\n\n\n
Parametre se daj\u00ed doplnit o mnoh\u00e9 u\u017eite\u010dn\u00e9 direktivy. Jejich kompletn\u00ed seznam je mo\u017en\u00e9 naj\u00edt na adrese nginx.org\/en\/docs\/http\/ngx_http_proxy_module.html<\/a>. Z hlediska na\u0161eho nastaven\u00ed p\u0159id\u00e1me pod \u010dty\u0159i existuj\u00edc\u00ed direktivy dal\u0161\u00ed \u010dty\u0159i na\u0161e:<\/p>\n\n\n\n
proxy_buffering on;\nproxy_buffer_size 64k;\nproxy_buffers 256 8k;\nproxy_read_timeout 120;<\/pre>\n\n\n\n
Parametry se daj\u00ed specifikovat i p\u0159\u00edmo v nastaven\u00ed VirtualHost<\/code> a pod Nginx serverem.
N\u00e1sledn\u011b uprav\u00edme v\u00fdchoz\u00ed str\u00e1nku Nginx (\/etc\/nginx\/sites-available\/default<\/code>) a to tak, aby v\u0161echny po\u017eadavky (requesty) na port 80<\/code> byly zaslan\u00e9 (proxovan\u00e9) na server Apache:<\/p>\n\n\n\n
server {\n     listen 80 default_server;\n     index index.html index.htm index.nginx-debian.html;\n     server_name example.com www.example.com;\n     location \/ {\n       proxy_pass http:\/\/localhost:8080;\n       include \/etc\/nginx\/proxy_params;\n     }\n}<\/pre>\n\n\n\n
Abychom zm\u011bny aplikovali, je pot\u0159eba server Nginx restartovat:<\/p>\n\n\n\n
\/etc\/init.d\/nginx restart<\/pre>\n\n\n\n
Ov\u011b\u0159it spr\u00e1vn\u00e9 proxov\u00e1n\u00ed m\u016f\u017eeme nap\u0159\u00edklad pomoc\u00ed developer n\u00e1stroj\u016f v prohl\u00ed\u017ee\u010di. Sta\u010d\u00ed zadat n\u00e1zev dom\u00e9ny nebo IP adresu serveru do pole URL (v na\u0161em p\u0159\u00edpad\u011b 195.210.29.181<\/code>), p\u0159i\u010dem\u017e d\u016fraz klademe na Response headers \u2013 Server<\/strong>:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Zrychlen\u00ed konfigurace<\/h2>\n\n\n\n
Jak v\u0161ak sn\u00ed\u017eit odezvu VPS jako web serveru? Jak odleh\u010dit Apache server, aby fungoval r\u00fdchleji? Samotn\u00fdm proxov\u00e1n\u00edm mezi servery toti\u017e a\u017e tak moc nez\u00edsk\u00e1me. P\u0159edstav\u00edme si dva zp\u016fsoby zrychlen\u00ed va\u0161\u00ed konfigurace.<\/p>\n\n\n\n
a) Zpracov\u00e1n\u00ed SSL zabezpe\u010den\u00ed u\u017e na slu\u017eb\u011b Nginx<\/h3>\n\n\n\n
Mezi standardy dne\u0161n\u00edch web\u016f rozhodn\u011b pat\u0159\u00ed SSL certifik\u00e1t a protokol HTTPS. Tyto certifik\u00e1ty je mo\u017en\u00e9 bu\u010f koupit<\/a>, nebo z\u00edskat jednu z free verz\u00ed, nap\u0159\u00edklad od spole\u010dnosti Let\u2019s Encrypt<\/a>. Na VPS vytvo\u0159\u00edme slo\u017eku, ve kter\u00e9 budeme dr\u017eet soubory certifik\u00e1t\u016f (example.com<\/code> nahrad\u00edme n\u00e1zvem dom\u00e9ny) a do t\u00e9to slo\u017eky vlo\u017e\u00edme dva soubory \u2013 priv\u00e1tn\u00ed kl\u00ed\u010d (private.key<\/code>) a certifik\u00e1t spojen\u00fd s certificate chain (certificate.crt<\/code>):<\/p>\n\n\n\n
mkdir -p \/etc\/ssl\/example.com\nnano \/etc\/ssl\/example.com\/private.key\nnano \/etc\/ssl\/example.com\/certificate.crt<\/pre>\n\n\n\n
N\u00e1sledn\u011b m\u016f\u017eeme upravit soubor VirtualHost<\/code> pro slu\u017ebu Nginx (\/etc\/nginx\/sites-available\/default<\/code>) tak, aby byl ka\u017ed\u00fd nezabezpe\u010den\u00fd request p\u0159es protokol HTTP na port 80<\/code> p\u0159esm\u011brovan\u00fd na zabezpe\u010den\u00fd protokol HTTPS a port 443<\/code> jednoduch\u00fdm redirectem a n\u00e1sledn\u011b obslou\u017een\u00fd backend serverem Apache:<\/p>\n\n\n\n
server {\n        listen 80 default_server;\n        server_name example.com www.example.com;\n        return 301 https:\/\/$server_name;\n}\n\nserver {\n        listen 443 default_server;\n        ssl on;\n        ssl_certificate \/etc\/ssl\/example.com\/certificate.crt;\n        ssl_certificate_key \/etc\/ssl\/example.com\/private.key;\n        ssl_protocols SSLv3 TLSv1.1 TLSv1.2;\n        location \/ {\n            proxy_pass http:\/\/localhost:8080;\n            include \/etc\/nginx\/proxy_params;\n        }\n}<\/pre>\n\n\n\n
Abychom op\u011bt aplikovali vykonan\u00e9 zm\u011bny, je pot\u0159eba server Nginx restartovat:<\/p>\n\n\n\n
\/etc\/init.d\/nginx restart<\/pre>\n\n\n\n
Po zadan\u00ed dom\u00e9ny do URL n\u00e1s aktu\u00e1ln\u011b p\u0159esm\u011bruje Nginx server na HTTPS protokol a obslou\u017e\u00ed n\u00e1\u0161 request certifik\u00e1tem navzdory tomu, \u017ee po\u017eadavek p\u0159epo\u0161le na backend serveru Apache.<\/p>\n\n\n\n
b) Proxov\u00e1n\u00ed po\u017eadavk\u016f pouze pro vybran\u00e9 soubory<\/h3>\n\n\n\n
Proto\u017ee je Nginx zn\u00e1m\u00fd zejm\u00e9na svoj\u00ed rychlost\u00ed, vyplat\u00ed se mnoho soubor\u016f obslou\u017eit u\u017e na t\u00e9to slu\u017eb\u011b a nepos\u00edlat je na backendov\u00fd server Apache. Zvolit tedy m\u016f\u017eeme pouze proxov\u00e1n\u00ed .php<\/code> soubor\u016f, zat\u00edm co ostatn\u00ed obslou\u017e\u00edme p\u0159\u00edmo. Na otestov\u00e1n\u00ed si vytvo\u0159\u00edme soubor s funkc\u00ed phpinfo<\/code>()<\/code> ve slo\u017ece s webem \/var\/www\/html\/info.php<\/code><\/p>\n\n\n\n
Po vytvo\u0159en\u00ed sta\u010d\u00ed upravit direktivy location<\/code>. P\u0159id\u00e1me tak\u00e9 direktivu index<\/code>, kterou definujeme, aby Nginx hledal z\u00e1kladn\u00ed str\u00e1nku pro zobrazen\u00ed pr\u00e1v\u011b pod souborem index.nginx-debian.html<\/code>, co\u017e n\u00e1m poslou\u017e\u00ed na jednodu\u0161\u0161\u00ed vyobrazen\u00ed rozd\u00edlu mezi soubory, kter\u00e9 obsluhuje Nginx a kter\u00e9 Apache server:<\/p>\n\n\n\n
server {\n        listen 80 default_server;\n        server_name example.com www.example.com;\n        return 301 https:\/\/$server_name;\n}\n\nserver {\n        listen 443 default_server;\n        root \/var\/www\/html;\n        ssl on;\n        ssl_certificate \/etc\/ssl\/example.com\/certificate.crt;\n        ssl_certificate_key \/etc\/ssl\/example.com\/private.key;\n        ssl_protocols SSLv3 TLSv1.1 TLSv1.2;\n        location \/ {\n            index index.nginx-debian.html;\n        }\n        location ~ \\.php {\n            proxy_pass http:\/\/localhost:8080;\n            include \/etc\/nginx\/proxy_params;\n        }\n}<\/pre>\n\n\n\n
Aktu\u00e1ln\u011b je tedy na\u0161e dom\u00e9na example.com<\/code> p\u0159esm\u011brovan\u00e1 na HTTPS protokol a zobraz\u00ed n\u00e1m z\u00e1kladn\u00ed str\u00e1nku Nginx. Po zadan\u00ed example.com\/info.php<\/code> jsme u\u017e proxovan\u00ed na Apache server, kter\u00fd zpracuje PHP soubor.<\/p>\n\n\n\n
Proxov\u00e1n\u00ed pouze vybran\u00fdch soubor\u016f m\u00e1 velmi velk\u00e9 vyu\u017eit\u00ed p\u0159i zrychlov\u00e1n\u00ed str\u00e1nek. V praxi je to nap\u0159\u00edklad definov\u00e1n\u00ed statick\u00fdch soubor\u016f podle koncovky, kter\u00e9 mohou z\u016fstat v pam\u011bti cache a\u017e 3 m\u011bs\u00edce a budou pod\u00e1van\u00e9 u\u017e komprimovan\u00e9 pomoc\u00ed gzip<\/code>. Nepot\u0159ebujeme, aby se zapisovaly do access logu a budeme jim p\u0159id\u00e1vat vlastn\u00ed hlavi\u010dku Cache-Control<\/code>. Takov\u00e1 konfigurace by vypadala n\u00e1sledovn\u011b:<\/p>\n\n\n\n
server {\n        listen 80 default_server;\n        server_name example.com www.example.com;\n        return 301 https:\/\/$server_name;\n}\n\nserver {\n        listen 443 default_server;\n        root \/var\/www\/html;\n        ssl on;\n        ssl_certificate \/etc\/ssl\/example.com\/certificate.crt;\n        ssl_certificate_key \/etc\/ssl\/example.com\/private.key;\n        ssl_protocols SSLv3 TLSv1.1 TLSv1.2;\n        location ~* .(ico|png|gif|jpg|jpeg|swf|woff|css|js|html)$ {\n            access_log off;\n            gzip_static on;\n            gzip_comp_level 5;\n            expires 3M;\n            add_header Cache-Control private;\n        }\n        location \/ {\n            index index.nginx-debian.html;\n        }\n        location ~ \\.php {\n            proxy_pass http:\/\/localhost:8080;\n            include \/etc\/nginx\/proxy_params;\n        }\n}<\/pre>\n\n\n\n
Pro nejb\u011b\u017en\u011bj\u0161\u00ed pou\u017eit\u00ed je ide\u00e1ln\u00ed je\u0161t\u011b definovat tzv. \u201efallback\u201c \u2013 tedy definovat na Nginx serveru cesty, kde m\u00e1 kter\u00e9 soubory hledat a a\u017e kdy\u017e se soubory nenajdou, zkusit je proxovat na Apache server. Toto nastaven\u00ed se nej\u010dast\u011bji pou\u017e\u00edv\u00e1 p\u0159i CMS WordPress nebo jin\u00fdch aplikac\u00edch, kter\u00e9 pou\u017e\u00edvaj\u00ed v Apache mod_rewrite<\/code>. Aktivujeme tedy mod_rewrite<\/code>:<\/p>\n\n\n\n
a2enmod rewrite\nsystemctl restart apache2<\/pre>\n\n\n\n
Obohat\u00edme posledn\u00ed konfiguraci o fallback na Apache server (t\u00edmto krokem tak\u00e9 zfunk\u010dn\u00edme logo na z\u00e1kladn\u00ed str\u00e1nce Apache \u2013 example.com\/index.html<\/code>), a zak\u00e1\u017eeme p\u0159\u00edm\u00fd p\u0159\u00edstup k soubor\u016fm s te\u010dkou (jako nap\u0159\u00edklad .htaccess<\/code>, .htpasswd<\/code>:<\/p>\n\n\n\n
server {\n        listen 80 default_server;\n        server_name proxyngap.docolomansky.sk www.proxyngap.docolomansky.sk;\n        return 301 https:\/\/$server_name;\n}\n\nserver {\n        listen 443 default_server;\n        root \/var\/www\/html;\n        ssl on;\n        ssl_certificate \/etc\/ssl\/example.com\/certificate.crt;\n        ssl_certificate_key \/etc\/ssl\/example.com\/private.key;\n        ssl_protocols SSLv3 TLSv1.1 TLSv1.2;\n        location ~* .(ico|jpg|png|gif|jpeg|css|swf|js|woff|html)$ {\n            access_log off;\n            gzip_static on;\n            gzip_comp_level 5;\n            expires 3M;\n            add_header Cache-Control private;\n            try_files $uri @proxy;\n        }\n        location @proxy {\n            proxy_pass http:\/\/localhost:8080;\n        }\n        location \/ {\n            index index.nginx-debian.html;\n        }\n        location ~ \\.php {\n            proxy_pass http:\/\/localhost:8080;\n            include \/etc\/nginx\/proxy_params;\n        }\n        location ~ \/\\. {\n            deny all;\n        }\n}<\/pre>\n\n\n\n
Po zm\u011bn\u011b konfigurac\u00ed je op\u011bt pot\u0159eba restartovat slu\u017ebu nginx<\/code>:<\/p>\n\n\n\n
\/etc\/init.d\/nginx restart<\/pre>\n\n\n\n
Dal\u0161\u00ed zdroje<\/h2>\n\n\n\n