Skip to content

Commit de6a88c

Browse files
committed
* Support HTTP/2 directive for Nginx > 1.25.0
* Fix intentions * Only set TLS 1.3 template var and print the debug message if SSL is activated
1 parent e939ff2 commit de6a88c

File tree

2 files changed

+89
-89
lines changed

2 files changed

+89
-89
lines changed

server/conf/nginx_vhost.conf.master

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,10 @@ server {
1717
listen [::]:<tmpl_var name='http_port'>;
1818
</tmpl_if>
1919
<tmpl_if name='ssl_enabled'>
20-
<tmpl_if name='http2_directive_compat_quirk' op='==' value='y'>
21-
listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl;
22-
http2 on;
23-
<tmpl_else>
24-
listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl http2;
25-
</tmpl_if>
20+
listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
2621
<tmpl_if name='use_proxy_protocol' op='==' value='y'>
2722
<tmpl_if name='proxy_protocol_https' op='>' value='0'>
28-
listen <tmpl_var name='ip_address'>:<tmpl_var name='proxy_protocol_https'> ssl http2 proxy_protocol;
23+
listen <tmpl_var name='ip_address'>:<tmpl_var name='proxy_protocol_https'> ssl<tmpl_var name='http2_directive_compat_quirk'> proxy_protocol;
2924
</tmpl_if>
3025
</tmpl_if>
3126

@@ -37,18 +32,22 @@ server {
3732
# ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
3833
# ssl_prefer_server_ciphers on;
3934
<tmpl_if name='ipv6_enabled'>
40-
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='https_port'> ssl http2;
35+
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
4136
<tmpl_if name='use_proxy_protocol_ipv6' op='==' value='y'>
4237
<tmpl_if name='proxy_protocol_https' op='>' value='0'>
43-
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='proxy_protocol_https'> ssl http2 proxy_protocol;
38+
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='proxy_protocol_https'> ssl<tmpl_var name='http2_directive_compat_quirk'> proxy_protocol;
4439
</tmpl_if>
4540
</tmpl_if>
4641
</tmpl_if>
4742
<tmpl_if name='ipv6_wildcard'>
48-
listen [::]:<tmpl_var name='https_port'> ssl http2;
43+
listen [::]:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
4944
</tmpl_if>
5045
ssl_certificate <tmpl_var name='ssl_crt_file'>;
5146
ssl_certificate_key <tmpl_var name='ssl_key_file'>;
47+
<tmpl_if name='nginx_full_version' op='>' value='1.25.0' format='version'>
48+
49+
http2 on;
50+
</tmpl_if>
5251
</tmpl_if>
5352

5453
server_name <tmpl_var name='domain'> <tmpl_var name='alias'>;
@@ -386,12 +385,12 @@ server {
386385

387386

388387
<tmpl_if name='ssl_enabled'>
389-
listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl http2;
388+
listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
390389
<tmpl_if name='ipv6_enabled'>
391-
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='https_port'> ssl http2;
390+
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
392391
</tmpl_if>
393392
<tmpl_if name='ipv6_wildcard'>
394-
listen [::]:<tmpl_var name='https_port'> ssl http2;
393+
listen [::]:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
395394
</tmpl_if>
396395
ssl_certificate <tmpl_var name='ssl_crt_file'>;
397396
ssl_certificate_key <tmpl_var name='ssl_key_file'>;

server/plugins-available/nginx_plugin.inc.php

Lines changed: 77 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1617,19 +1617,24 @@ function update($event_name, $data) {
16171617
$nginx_openssl_running_ver = $app->system->exec_safe('nginx -V 2>&1 | grep \'running with OpenSSL\' | sed \'s/.*running\([a-zA-Z ]*\)OpenSSL \([0-9.]*\).*/\2/\'');
16181618
if(version_compare($app->system->getnginxversion(true), '1.13.0', '>=')
16191619
&& version_compare($nginx_openssl_build_ver, '1.1.1', '>=')
1620-
&& (empty($nginx_openssl_running_ver) || version_compare($nginx_openssl_running_ver, '1.1.1', '>='))) {
1620+
&& (empty($nginx_openssl_running_ver) || version_compare($nginx_openssl_running_ver, '1.1.1', '>='))
1621+
&& $data['new']['ssl'] == 'y') {
16211622
$app->log('Enable TLS 1.3 for: '.$domain, LOGLEVEL_DEBUG);
16221623
$vhost_data['tls13_supported'] = "y";
16231624
}
16241625

1625-
// Nginx >= 1.25.0 uses a dedicated directive to enable HTTP/2 support
1626-
if(version_compare($app->system->getnginxversion(true), '1.25.0', '>=')) {
1627-
$vhost_data['http2_directive_compat_quirk'] = "y";
16281626

1627+
1628+
// Nginx >= 1.25.1 uses a dedicated directive to enable HTTP/2 support
1629+
if(version_compare($app->system->getnginxversion(true), '1.25.1', '<')) {
1630+
$vhost_data['http2_directive_compat_quirk'] = " http2";
16291631
}
16301632

16311633
$tpl->setVar($vhost_data);
16321634

1635+
$tpl->setVar('nginx_version', $app->system->getnginxversion());
1636+
$tpl->setVar('nginx_full_version', $app->system->getnginxversion(true));
1637+
16331638
$server_alias = array();
16341639

16351640
// get autoalias
@@ -2630,96 +2635,92 @@ function _create_web_folder_auth_configuration($website){
26302635

26312636
//* Update the GoAccess configuration file
26322637
private function goaccess_update ($data, $web_config) {
2633-
global $app;
2634-
2635-
$web_folder = $data['new']['web_folder'];
2636-
if($data['new']['type'] == 'vhost') $web_folder = 'web';
2637-
2638-
$goaccess_conf_locs = array('/etc/goaccess.conf', '/etc/goaccess/goaccess.conf');
2639-
$count = 0;
2640-
2641-
foreach($goaccess_conf_locs as $goa_loc) {
2642-
if(is_file($goa_loc) && (filesize($goa_loc) > 0)) {
2643-
$goaccess_conf_main = $goa_loc;
2644-
break;
2645-
} else {
2646-
$count++;
2647-
if($count == 2) {
2648-
$app->log("No GoAccess base config found. Make sure that GoAccess is installed and that the goaccess.conf does exist in /etc or /etc/goaccess", LOGLEVEL_WARN);
2649-
}
2650-
}
2651-
}
2652-
2653-
if(!is_dir($data['new']['document_root'] . "/log/goaccess_db")) $app->system->mkdirpath($data['new']['document_root'] . "/log/goaccess_db");
2654-
$goaccess_conf = $data['new']['document_root'].'/log/goaccess.conf';
2638+
global $app;
26552639

2656-
/*
2657-
In case that you use a different log format, you should use a custom goaccess.conf which you'll have to put into /usr/local/ispconfig/server/conf-custom/.
2658-
By default the originaly with GoAccess shipped goaccess.conf from /etc/ will be used along with the log-format value COMBINED.
2659-
*/
2640+
$web_folder = $data['new']['web_folder'];
2641+
if($data['new']['type'] == 'vhost') $web_folder = 'web';
26602642

2661-
if(file_exists("/usr/local/ispconfig/server/conf-custom/goaccess.conf.master")) {
2662-
$app->system->copy("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master", $goaccess_conf);
2643+
$goaccess_conf_locs = array('/etc/goaccess.conf', '/etc/goaccess/goaccess.conf');
2644+
$count = 0;
26632645

2664-
} elseif(!file_exists($goaccess_conf)) {
2646+
foreach($goaccess_conf_locs as $goa_loc) {
2647+
if(is_file($goa_loc) && (filesize($goa_loc) > 0)) {
2648+
$goaccess_conf_main = $goa_loc;
2649+
break;
2650+
} else {
2651+
$count++;
2652+
if($count == 2) {
2653+
$app->log("No GoAccess base config found. Make sure that GoAccess is installed and that the goaccess.conf does exist in /etc or /etc/goaccess", LOGLEVEL_WARN);
2654+
}
2655+
}
2656+
}
26652657

2666-
/*
2667-
By default the goaccess.conf should get copied by the webserver plugin but in case it wasn't, or it got deleted by accident we gonna copy it again to the destination dir.
2668-
Also there was no /usr/local/ispconfig/server/conf-custom/goaccess.conf.master, so we gonna use /etc/goaccess.conf as the base conf.
2669-
*/
2658+
if(!is_dir($data['new']['document_root'] . "/log/goaccess_db")) $app->system->mkdirpath($data['new']['document_root'] . "/log/goaccess_db");
2659+
$goaccess_conf = $data['new']['document_root'].'/log/goaccess.conf';
26702660

2671-
$app->system->copy($goaccess_conf_main, $goaccess_conf);
2672-
$content = $app->system->file_get_contents($goaccess_conf, true);
2673-
$content = preg_replace('/^(#)?log-format COMBINED/m', "log-format COMBINED", $content);
2674-
$app->system->file_put_contents($goaccess_conf, $content, true);
2675-
unset($content);
2661+
/*
2662+
In case that you use a different log format, you should use a custom goaccess.conf which you'll have to put into /usr/local/ispconfig/server/conf-custom/.
2663+
By default the originaly with GoAccess shipped goaccess.conf from /etc/ will be used along with the log-format value COMBINED.
2664+
*/
26762665

2677-
}
2666+
if(file_exists("/usr/local/ispconfig/server/conf-custom/goaccess.conf.master")) {
2667+
$app->system->copy("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master", $goaccess_conf);
2668+
} elseif(!file_exists($goaccess_conf)) {
2669+
/*
2670+
By default the goaccess.conf should get copied by the webserver plugin but in case it wasn't, or it got deleted by accident we gonna copy it again to the destination dir.
2671+
Also there was no /usr/local/ispconfig/server/conf-custom/goaccess.conf.master, so we gonna use /etc/goaccess.conf as the base conf.
2672+
*/
26782673

2679-
if(file_exists($goaccess_conf)) {
2680-
$domain = $data['new']['domain'];
2681-
$content = $app->system->file_get_contents($goaccess_conf, true);
2682-
$content = preg_replace('/^(#)?html-report-title(.*)/m', "html-report-title $domain", $content);
2683-
$app->system->file_put_contents($goaccess_conf, $content, true);
2684-
unset($content);
2674+
$app->system->copy($goaccess_conf_main, $goaccess_conf);
2675+
$content = $app->system->file_get_contents($goaccess_conf, true);
2676+
$content = preg_replace('/^(#)?log-format COMBINED/m', "log-format COMBINED", $content);
2677+
$app->system->file_put_contents($goaccess_conf, $content, true);
2678+
unset($content);
2679+
}
26852680

2686-
}
2681+
if(file_exists($goaccess_conf)) {
2682+
$domain = $data['new']['domain'];
2683+
$content = $app->system->file_get_contents($goaccess_conf, true);
2684+
$content = preg_replace('/^(#)?html-report-title(.*)/m', "html-report-title $domain", $content);
2685+
$app->system->file_put_contents($goaccess_conf, $content, true);
2686+
unset($content);
2687+
}
26872688

2688-
if(is_file($goaccess_conf) && (filesize($goaccess_conf) > 0)) {
2689-
$app->log('Created GoAccess config file: '.$goaccess_conf, LOGLEVEL_DEBUG);
2690-
}
2689+
if(is_file($goaccess_conf) && (filesize($goaccess_conf) > 0)) {
2690+
$app->log('Created GoAccess config file: '.$goaccess_conf, LOGLEVEL_DEBUG);
2691+
}
26912692

2692-
if(is_file($data['new']['document_root']."/" . $web_folder . "/stats/index.html")) $app->system->unlink($data['new']['document_root']."/" . $web_folder . "/stats/index.html");
2693-
if(file_exists("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master")) {
2694-
$app->system->copy("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master", $data['new']['document_root']."/" . $web_folder . "/stats/index.php");
2695-
} else {
2696-
$app->system->copy("/usr/local/ispconfig/server/conf/goaccess_index.php.master", $data['new']['document_root']."/" . $web_folder . "/stats/index.php");
2693+
if(is_file($data['new']['document_root']."/" . $web_folder . "/stats/index.html")) $app->system->unlink($data['new']['document_root']."/" . $web_folder . "/stats/index.html");
2694+
if(file_exists("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master")) {
2695+
$app->system->copy("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master", $data['new']['document_root']."/" . $web_folder . "/stats/index.php");
2696+
} else {
2697+
$app->system->copy("/usr/local/ispconfig/server/conf/goaccess_index.php.master", $data['new']['document_root']."/" . $web_folder . "/stats/index.php");
26972698
}
26982699
}
26992700

2700-
//* Delete the GoAccess configuration file
2701-
private function goaccess_delete ($data, $web_config) {
2702-
global $app;
2701+
//* Delete the GoAccess configuration file
2702+
private function goaccess_delete ($data, $web_config) {
2703+
global $app;
27032704

2704-
$goaccess_conf = $data['old']['document_root'] . "/log/goaccess.conf";
2705+
$goaccess_conf = $data['old']['document_root'] . "/log/goaccess.conf";
27052706

2706-
if ( @is_file($goaccess_conf) ) {
2707-
$app->system->unlink($goaccess_conf);
2708-
$app->log('Removed GoAccess config file: '.$goaccess_conf, LOGLEVEL_DEBUG);
2709-
}
2710-
}
2707+
if ( @is_file($goaccess_conf) ) {
2708+
$app->system->unlink($goaccess_conf);
2709+
$app->log('Removed GoAccess config file: '.$goaccess_conf, LOGLEVEL_DEBUG);
2710+
}
2711+
}
27112712

2712-
//* Delete the Webalizer configuration file
2713-
private function webalizer_delete ($data, $web_config) {
2714-
global $app;
2713+
//* Delete the Webalizer configuration file
2714+
private function webalizer_delete ($data, $web_config) {
2715+
global $app;
27152716

2716-
$webalizer_conf = $data['old']['document_root'] . "/log/webalizer.conf";
2717+
$webalizer_conf = $data['old']['document_root'] . "/log/webalizer.conf";
27172718

2718-
if ( @is_file($webalizer_conf) ) {
2719-
$app->system->unlink($webalizer_conf);
2720-
$app->log('Removed Webalizer config file: '.$webalizer_conf, LOGLEVEL_DEBUG);
2721-
}
2722-
}
2719+
if ( @is_file($webalizer_conf) ) {
2720+
$app->system->unlink($webalizer_conf);
2721+
$app->log('Removed Webalizer config file: '.$webalizer_conf, LOGLEVEL_DEBUG);
2722+
}
2723+
}
27232724

27242725
//* Update the awstats configuration file
27252726
private function awstats_update ($data, $web_config) {

0 commit comments

Comments
 (0)