За човек работещ предимно с Apache борбата с различен WEB сървър беше предизвикателство. Сега ще се постарая да покажа с какво се сблъсках и какви решения открих. Да започнем със създаване на виртуални хостове. Имаме инсталиран Debian 12 и на него iRedMail. С всичко това се инсталира и Nginx. Към него ще създадем виртуалните хостове post.tachko.com и post.tlan.net. За начало да спрем виртуалния хост създаден по подразбиране.
rm /etc/nginx/sites-enabled/*
Създаваме първия виртуален хост за post.tachko.com.
nano /etc/nginx/sites-available/post.tachko.com.conf server { listen 80; listen [::]:80; root /var/www/post.tachko.com; index index.html index.htm; server_name post.tachko.com mail.tachko.com; error_log /var/log/nginx/post.tachko.com_error.log; access_log /var/log/nginx/post.tachko.com_access.log; location / { try_files $uri $uri/ =404; } } mkdir -p /var/www/post.tachko.com/ chown -R www-data:www-data /var/www/post.tachko.com/ ln -s /etc/nginx/sites-available/post.tachko.com.conf /etc/nginx/sites-enabled/ service nginx restart service nginx status echo "Post.Tachko.COM" > /var/www/post.tachko.com/index.html tail -f /var/log/nginx/post.tachko.com_access.log
Да пробваме като отворим: http://post.tachko.com. Работи. Сега да създадем втория виртуален хост post.tlan.net.
nano /etc/nginx/sites-available/post.tlan.net.conf server { listen 80; listen [::]:80; root /var/www/post.tlan.net; index index.html index.htm; server_name post.tlan.net mail.tlan.net; error_log /var/log/nginx/post.tlan.net_error.log; access_log /var/log/nginx/post.tlan.net_access.log; location / { try_files $uri $uri/ =404; } } mkdir -p /var/www/post.tlan.net/ chown -R www-data:www-data /var/www/post.tlan.net/ ln -s /etc/nginx/sites-available/post.tlan.net.conf /etc/nginx/sites-enabled/ service nginx restart service nginx status echo "Post.Tlan.NET" > /var/www/post.tlan.net/index.html tail -f /var/log/nginx/post.tlan.net_access.log
Забележет, нямаме секция за HTTPS. На по-късен етап с инсталацята на CertBOT ще оправим този проблем.
Идеята е post.tachko.com и post.tlan.net да имат удостоверени сертификати от Let's Encrypt, mail.tachko.com и mail.tlan.net да нямат такива. Започваме с инсталиране и конфигуриране на CertBOT. За повече подробности можете да погледнете на: https://tlan.net/menu/linux/debian/debian12/nginx/nginx12.php
apt update apt dist-upgrade apt install certbot -y apt install certbot python3-certbot-nginx -y DOMAIN1=$(hostname -f) DOMAIN2=$"post.tlan.net" ### Тест за създаване на сертификати certbot certonly --webroot --dry-run --email tachko@tachko.com -w /var/www/$DOMAIN1 -d $DOMAIN1 -w /var/www/$DOMAIN2 -d $DOMAIN2 Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf. You must agree in order to register with the ACME server. Do you agree? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: Y Account registered. Simulating a certificate request for post.tachko.com and post.tlan.net The dry run was successful. ### Създаване на сертификати certbot certonly --webroot --agree-tos --email tachko@tachko.com --webroot-path /var/www/$DOMAIN1 -d $DOMAIN1 -w /var/www/$DOMAIN2 -d $DOMAIN2 Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing, once your first certificate is successfully issued, to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: Y Account registered. Requesting a certificate for post.tachko.com and post.tlan.net Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/post.tachko.com/fullchain.pem Key is saved at: /etc/letsencrypt/live/post.tachko.com/privkey.pem This certificate expires on 2025-06-17. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-le - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Сертификатите са генерирани но за да са валидни в iRedMail трябва да се направи следното:
rm -f /etc/ssl/private/iRedMail.key rm -f /etc/ssl/certs/iRedMail.crt ln -s /etc/letsencrypt/live/$DOMAIN1/fullchain.pem /etc/ssl/certs/iRedMail.crt ln -s /etc/letsencrypt/live/$DOMAIN1/privkey.pem /etc/ssl/private/iRedMail.key
Заменихме сертификатите генерирани с инсталиране на iRedMail с тези генерирани от CertBOT.
Имаме генерирани сертификати, но те не са дефинирани в конфигурационните файлове на виртуалните хостове. Започваме с post.tachko.com.
nano /etc/nginx/sites-available/post.tachko.com.conf #HTTP server { listen 80; listen [::]:80; server_name post.tachko.com; # Allow ACME challenge to be served over HTTP (don't redirect to HTTPS). location ~* ^/.well-known/acme-challenge/ { root /opt/www/well_known; try_files $uri =404; allow all; } # Redirect all insecure http requests to https. location / { return 301 https://$host$request_uri; } } # HTTPS server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name post.tachko.com; root /var/www/post.tachko.com; index index.php index.html; error_log /var/log/nginx/post.tachko.com_error.log; access_log /var/log/nginx/post.tachko.com_access.log; location ~ /.well-known { root /usr/share/nginx/html; allow all; } include /etc/nginx/templates/misc.tmpl; include /etc/nginx/templates/ssl.tmpl; include /etc/nginx/templates/iredadmin.tmpl; include /etc/nginx/templates/roundcube.tmpl; include /etc/nginx/templates/sogo.tmpl; include /etc/nginx/templates/netdata.tmpl; include /etc/nginx/templates/php-catchall.tmpl; include /etc/nginx/templates/stub_status.tmpl; }
Копираме цялото съдържание от /var/www/html в /var/www/post.tachko.com
cp /var/www/html/* /var/www/post.tachko.com/ service nginx restart service postfix restart service dovecot restart service iredadmin restart service php8.2-fpm stop service php8.2-fpm start service nginx status
Тестваме iRedMail на https://post.tachko.com.
Да поправим виртуалния хост post.tlan.net. Позволяваме му да ползва HTTPS.
nano /etc/nginx/sites-available/post.tlan.net.conf server { listen 80; listen [::]:80; server_name post.tlan.net mail.tlan.net; # Redirect all insecure http requests to https. location / { return 301 https://$host$request_uri; } } server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name post.tlan.net mail.tlan.net; root /var/www/post.tlan.net; index index.html index.php; error_log /var/log/nginx/post.tlan.net_error.log; access_log /var/log/nginx/post.tlan.net_access.log; ssl_certificate /etc/letsencrypt/live/post.tachko.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/post.tachko.com/privkey.pem; ssl_stapling on; location / { try_files $uri $uri/ =404; } # pass PHP scripts to FastCGI server location ~ \.php$ { include snippets/fastcgi-php.conf; # With php-fpm (or other unix sockets): fastcgi_pass unix:/run/php/php8.2-fpm.sock; # With php-cgi (or other tcp sockets): # fastcgi_pass 127.0.0.1:9000; } }
Да тестваме.
echo "<html><head></head><h1>Post.TLan.NET</h1></html>" >> /var/www/post.tlan.net/index.html
Ако пробваме на http://post.tlan.net ще се отвори https://post.tlan.net и ще излезе един голям надпис Post.TLan.NET. С това приключваме. На по-късен етап ще покажа как да имплементираме PHP в Nginx.