Nginx questions - Edit default files and HTTP2

[Ade]

Hi everyone!
I was wondering if there’s a safe way to edit the default nginx.conf file without risking to get the changes overwritten during an Hestia upgrade.
I’m aware about the templates, but what I’d like to edit is the log_format which, from what I understand, is defined in /usr/local/hestia/nginx/conf/nginx.conf.

Also, I’ve just noticed that all the sites’ visits are recorded with HTTP1.1 but in the above file I see the http2 set to on I found a few threads about it but no real solutions

Regards,
Ade

[Ade]

Can I do an ‘up’ here?
If I edit the nginx configuration of a site and I manually add http2 to the listen directive, it works fine, access logs show http 2 being used, but the site will give an error when http:// is used instead of being redirected.
It seems so odd that http2 isn’t enabled by default

I would normally enable it within nginx.conf inside the http {} block, but can I edit that file without the risk of being overwritten?

[sahsanu]

@Ade

It seems so odd that http2 isn’t enabled by default

It is enabled by default.

❯ grep 'include.*\.d\/\*' /etc/nginx/nginx.conf
        include                         /etc/nginx/conf.d/*.conf;
❯ cat /etc/nginx/conf.d/http2-directive.conf
http2 on;

Keep in mind that http2 only works on https connections.

[Ade]

Hey!
See here there is something different, that line (http2 on;) it is commented in my installation and if I enable it I get a Nginx error:

nginx: [emerg] unknown directive "http2" in /etc/nginx/conf.d/http2-directive.conf:1

nginx: configuration file /etc/nginx/nginx.conf test failed

[sahsanu]

Show me the output of this command (it is to check your versions):

curl -sSL https://7j.gg/hcpver | bash -s --

[Ade]

Is anything missing?

column: invalid option -- 'R'

usage: column [-txne] [-c columns] [-s sep] [file ...]

[sahsanu]

Did you execute it on your server? What is the OS version?

[Ade]

I did:

Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.6 LTS
Release:	20.04
Codename:	focal

[sahsanu]

Ok, that is an old version and column command doesn’t support -R parameter.

Anyway, show the output of these commands:

cat /etc/apt/sources.list.d/nginx.list
apt policy nginx
nginx -V

[Ade]

deb [arch=arm64 signed-by=/usr/share/keyrings/nginx-keyring.gpg] https://nginx.org/packages/mainline/ubuntu/ focal nginx

nginx:
  Installed: (none)
  Candidate: 1.27.0-2~focal
  Version table:
     1.27.0-2~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.27.0-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.25.5-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
        100 /var/lib/dpkg/status
     1.25.4-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.25.3-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.25.2-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.25.1-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.25.0-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.23.4-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.23.3-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.23.2-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.23.1-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.23.0-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.21.6-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.21.5-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.21.4-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.21.3-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.21.2-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.21.1-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.21.0-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.10-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.9-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.8-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.7-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.6-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.5-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.4-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.3-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.2-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.1-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.19.0-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.18.0-0ubuntu1.4 500
        500 http://iad-ad-1.clouds.ports.ubuntu.com/ubuntu-ports focal-updates/main arm64 Packages
        500 http://ports.ubuntu.com/ubuntu-ports focal-security/main arm64 Packages
     1.17.10-1~focal 500
        500 https://nginx.org/packages/mainline/ubuntu focal/nginx arm64 Packages
     1.17.10-0ubuntu1 500
        500 http://iad-ad-1.clouds.ports.ubuntu.com/ubuntu-ports focal/main arm64 Packages

nginx version: nginx/1.18.0 (Ubuntu)

built with OpenSSL 1.1.1f 31 Mar 2020

TLS SNI support enabled

configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-qv2Nx5/nginx-1.18.0=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-compat --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_flv_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_secure_link_module --with-http_sub_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-headers-more-filter --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-auth-pam --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-cache-purge --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-dav-ext --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-ndk --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-echo --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-fancyindex --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/nchan --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-lua --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/rtmp --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-uploadprogress --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-upstream-fair --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-subs-filter --add-dynamic-module=/build/nginx-qv2Nx5/nginx-1.18.0/debian/modules/http-geoip2

[sahsanu]

So your server is ARM?

The mainline version for nginx is not installed, it is using an old ubuntu version 1.18.

Show me the output of this command:

dpkg -l | grep 'nginx'

[Ade]

Yes, I’m using an ARM machine

[sahsanu]

And what happened there?, why nginx is uninstalled and the rest of nginx packages are installed from Ubuntu repo instead of nginx repo?

[Ade]

I think this might have happened when I was working on adding Lua support. I was able to add that and the Nginx code I made is finally working but I’m afraid I might have broken something else

[sahsanu]

So you have a bit mess there

And what you did to install nginx? Did you compile it yourself? I’m asking because nginx package is not installed but nginx -V works.

systemctl status nginx
systemctl cat nginx
type nginx

[Ade]

So you have a bit mess there

Definitely

And what you did to install nginx? Did you compile it yourself?

Honestly, I don’t remember I did it on the very first day, it worked, I made a backup and swore myself that I would have not touched again

nginx is hashed (/usr/sbin/nginx)

[sahsanu]

Ok, you are using Ubuntu version. http_v2 module is enabled in your nginx version (I saw it in nginx -V command output).

Well, seens directive http2 was not supported in nginx 1.18 so to enable http2, edit your domain conf and add http2 to listen directive.

Let’s say your domain is example.net and your ip 203.0.113.1:

Edit file /etc/nginx/conf.d/domains/example.net.ssl.conf

and modify this:

listen      203.0.113.1:443 ssl;

by this:

listen      203.0.113.1:443 ssl http2;

Save the file, test nginx conf and restart or reload nginx.

[Ade]

This is exactly how I did it and it worked fine, however that causes the page to be prompt to download when visiting via http:// as the https redirect doesn’t happen

[sahsanu]

Did you enable https redirect for your site?
.
Show me the nginx.conf file for your domain

[Ade]

In the site conf folder for web I have the following files:

In the nginx.conf there’s an include for the nginx.forcessl.conf although from what I understand, the conf file that the site is actually loading is nginx.ssl.conf

Would you like to see the full file? If so, which one?