Ssh key gui issue & couple ? on default configurations choices

1

I have couple questions.

  1. is there a reason that apache is listening at the server IP for location /var/www/html?
    I notice apache as IP.conf for every IP. Just curious if its a reason that web root is active or if it can be removed?

2.Nginx had the same ip.conf but they only listen on http and proxy to apache as apaches listen on both http and https. I do know these files can’t just be removed, but what is there purpose? they basically have an empty webroot online.

Is it a IP address “catch-all” if so can i just change apaches ip.conf to redirect traffic to my domain instead?

  1. Is there a reason apache and nginx communicate in SSL? shouldn’t nginx be the end point? Nginx responds with http and http but talks to apache in http? i would think it would lover the overhead in their communication. I know SSL is not much of an “overhead” but every bit counts? I ask cause if there is a good reason for this i’ll keep it but if there isn’t id like to try to have nginx do ssl termination. I would think it would give better performance (thought maybe nothing exciting but some)?

  2. why is nginx and apache using public IP? I know why nginx is as it is the public facing, but can’t apache run as local host or 127.0.0.1? I would think it’s safer? or better yet can apache listed on a unix socket?

  3. Also when you compiled nginx does it have support for threading? and support for doing

upstream upstream_name {
server https://IP
server https://IP2
}
proxy_pass http://upstream_name

6.in the admin gui i can’t get ssh keys ed25519 to work but I did get an RSA one to. what types keys can that gui dead with?

  1. I have apache set with mod event but its set to start at bare minimum:
    StartServers 1
    MinSpareThreads 1
    MaxSpareThreads 50

i don’t need it to handle heavy traffic. One domain I added and mail. I have 20 apache processes and 500mb ram usage. I had 40mb with prefork… I’m confused at the mass increase in resources when event was support to use less. Is hestia CP showing the max ram the process can use or the actual ram usage… I’ve noticed in linux a lot of things like to show you the “max possible ram” not the actual usage.
Thank you for helping in advance.

2
  1. Also when you compiled nginx does it have support for threading? and support for doing

upstream upstream_name {
server https://IP
server https://IP2
}
proxy_pass http://upstream_name

The complied NGINX Version is used for the admin panel only not for the public website (Port 80)

6.in the admin gui i can’t get ssh keys ed25519 to work but I did get an RSA one to. what types keys can that gui dead with?

See https://github.com/hestiacp/hestiacp/blob/main/bin/v-add-user-ssh-key

and https://github.com/hestiacp/hestiacp/blob/main/web/add/key/index.php

If you have improvements for it feel free to contribute.

1 Like
3

i thought there was 2 separate nginx running, one admin one websites. are do they both support the same features?
dose the one servicing the site support the setting upstream nme as

upstream upstream_name {
server https://IP
server https://IP2
}

?

if the admin nginx is different where can
i find the list of flags it was compiled with?

4

See it is quite limited https://github.com/hestiacp/hestiacp/blob/main/src/hst_autocompile.sh

configure nginx

./configure --prefix=/usr/local/hestia/nginx
–with-http_ssl_module
–with-openssl=…/openssl-$OPENSSL_V
–with-openssl-opt=enable-ec_nistp_64_gcc_128
–with-openssl-opt=no-nextprotoneg
–with-openssl-opt=no-weak-ssl-ciphers
–with-openssl-opt=no-ssl3
–with-pcre=…/pcre-$PCRE_V
–with-pcre-jit
–with-zlib=…/zlib-$ZLIB_V

5

There are indeed 2 instances of nginx running as @eris mentioned, one compiled with minimal features serving the Hestia control panel on port 8083 and the other one serving user web domains on port 80 and 443 which isn’t compiled by us but installed as is from nginx official repo (http://nginx.org/en/linux_packages.html#Ubuntu)

1 Like
6

Thank you, what prebuild was it? i know there are 3?

also why does it talk to apache on public ports and not as local host? if there a reason? or just the way the team made it?
and what what the nginx and apache configs ip xxx.xxx.xxx.conf for each server ip that goto var/www/html? why is that running?

7

  • Mainline nginx.

  • Since hestia supports multiple ips, nginx and apache are listening on the ip address assigned to the user/web domain, but apache port 8080 is blocked by the firewall so it’s not really public.

  • Indeed nginx is forwading https requests to apache also trough https. Nginx could have terminated the ssl and pass down the request unencrypted as http to apache, this is the way it worked on Vesta and changing that could have unexpected results for existing users, still you can change this on your server by customising the nginx template

2 Likes
8

would ssl termination at nginx have any meaningful performance gain?

9

It does have a performance impact but I coudn’t say it is meaningful or not, best would be to test if you are looking for maximum performance

10