Skip to content

Commit fa4d805

Browse files
author
Till Brehm
committed
Merge branch '6579-http2-directive-deprecated' into 'develop'
Use new http2 directive for Nginx versions > 1.25.0 See merge request ispconfig/ispconfig3!1891
2 parents 8a5eae0 + f71eaab commit fa4d805

File tree

2 files changed

+112
-96
lines changed

2 files changed

+112
-96
lines changed

‎server/conf/nginx_vhost.conf.master‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ server {
1717
listen [::]:<tmpl_var name='http_port'>;
1818
</tmpl_if>
1919
<tmpl_if name='ssl_enabled'>
20-
listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl http2;
20+
listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
2121
<tmpl_if name='use_proxy_protocol' op='==' value='y'>
2222
<tmpl_if name='proxy_protocol_https' op='>' value='0'>
23-
listen <tmpl_var name='ip_address'>:<tmpl_var name='proxy_protocol_https'> ssl http2 proxy_protocol;
23+
listen <tmpl_var name='ip_address'>:<tmpl_var name='proxy_protocol_https'> ssl<tmpl_var name='http2_directive_compat_quirk'> proxy_protocol;
2424
</tmpl_if>
2525
</tmpl_if>
2626

@@ -32,18 +32,22 @@ server {
3232
# ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
3333
# ssl_prefer_server_ciphers on;
3434
<tmpl_if name='ipv6_enabled'>
35-
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='https_port'> ssl http2;
35+
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
3636
<tmpl_if name='use_proxy_protocol_ipv6' op='==' value='y'>
3737
<tmpl_if name='proxy_protocol_https' op='>' value='0'>
38-
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='proxy_protocol_https'> ssl http2 proxy_protocol;
38+
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='proxy_protocol_https'> ssl<tmpl_var name='http2_directive_compat_quirk'> proxy_protocol;
3939
</tmpl_if>
4040
</tmpl_if>
4141
</tmpl_if>
4242
<tmpl_if name='ipv6_wildcard'>
43-
listen [::]:<tmpl_var name='https_port'> ssl http2;
43+
listen [::]:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
4444
</tmpl_if>
4545
ssl_certificate <tmpl_var name='ssl_crt_file'>;
4646
ssl_certificate_key <tmpl_var name='ssl_key_file'>;
47+
<tmpl_if name='nginx_full_version' op='>' value='1.25.0' format='version'>
48+
49+
http2 on;
50+
</tmpl_if>
4751
</tmpl_if>
4852

4953
server_name <tmpl_var name='domain'> <tmpl_var name='alias'>;
@@ -383,17 +387,22 @@ server {
383387

384388

385389
<tmpl_if name='ssl_enabled'>
386-
listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl http2;
390+
listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
387391
<tmpl_if name='ipv6_enabled'>
388-
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='https_port'> ssl http2;
392+
listen [<tmpl_var name='ipv6_address'>]:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
389393
</tmpl_if>
390394
<tmpl_if name='ipv6_wildcard'>
391-
listen [::]:<tmpl_var name='https_port'> ssl http2;
395+
listen [::]:<tmpl_var name='https_port'> ssl<tmpl_var name='http2_directive_compat_quirk'>;
392396
</tmpl_if>
393397
ssl_certificate <tmpl_var name='ssl_crt_file'>;
394398
ssl_certificate_key <tmpl_var name='ssl_key_file'>;
395399
</tmpl_if>
396400

401+
<tmpl_if name='nginx_full_version' op='>' value='1.25.0' format='version'>
402+
403+
http2 on;
404+
</tmpl_if>
405+
397406
server_name <tmpl_var name='rewrite_domain'>;
398407

399408
<tmpl_if name='alias_seo_redirects2'>

‎server/plugins-available/nginx_plugin.inc.php‎

Lines changed: 95 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -1338,7 +1338,7 @@ function update($event_name, $data) {
13381338
$trans = array(
13391339
'{DOCROOT}' => $vhost_data['web_document_root_www'],
13401340
'{DOCROOT_CLIENT}' => $vhost_data['web_document_root'],
1341-
'{DOMAIN}' => $vhost_data['domain'],
1341+
'{DOMAIN}' => $vhost_data['domain'],
13421342
'{FASTCGIPASS}' => 'fastcgi_pass '.($data['new']['php_fpm_use_socket'] == 'y'? 'unix:'.$fpm_socket : '127.0.0.1:'.$vhost_data['fpm_port']).';'
13431343
);
13441344
foreach($nginx_directive_lines as $nginx_directive_line){
@@ -1614,17 +1614,28 @@ function update($event_name, $data) {
16141614
$vhost_data['logging'] = $web_config['logging'];
16151615

16161616
// Provide TLS 1.3 support if Nginx version is >= 1.13.0 and when it was linked against OpenSSL(>=1.1.1) at build time and when it was linked against OpenSSL(>=1.1.1) at runtime.
1617-
$nginx_openssl_build_ver = $app->system->exec_safe('nginx -V 2>&1 | grep \'built with OpenSSL\' | sed \'s/.*built\([a-zA-Z ]*\)OpenSSL \([0-9.]*\).*/\2/\'');
1618-
$nginx_openssl_running_ver = $app->system->exec_safe('nginx -V 2>&1 | grep \'running with OpenSSL\' | sed \'s/.*running\([a-zA-Z ]*\)OpenSSL \([0-9.]*\).*/\2/\'');
1619-
if(version_compare($app->system->getnginxversion(true), '1.13.0', '>=')
1620-
&& version_compare($nginx_openssl_build_ver, '1.1.1', '>=')
1621-
&& (empty($nginx_openssl_running_ver) || version_compare($nginx_openssl_running_ver, '1.1.1', '>='))) {
1622-
$app->log('Enable TLS 1.3 for: '.$domain, LOGLEVEL_DEBUG);
1623-
$vhost_data['tls13_supported'] = "y";
1617+
if($data['new']['ssl'] == 'y') {
1618+
$nginx_openssl_build_ver = $app->system->exec_safe('nginx -V 2>&1 | grep \'built with OpenSSL\' | sed \'s/.*built\([a-zA-Z ]*\)OpenSSL \([0-9.]*\).*/\2/\'');
1619+
$nginx_openssl_running_ver = $app->system->exec_safe('nginx -V 2>&1 | grep \'running with OpenSSL\' | sed \'s/.*running\([a-zA-Z ]*\)OpenSSL \([0-9.]*\).*/\2/\'');
1620+
if(version_compare($app->system->getnginxversion(true), '1.13.0', '>=')
1621+
&& version_compare($nginx_openssl_build_ver, '1.1.1', '>=')
1622+
&& (empty($nginx_openssl_running_ver) || version_compare($nginx_openssl_running_ver, '1.1.1', '>='))) {
1623+
$app->log('Enable TLS 1.3 for: '.$domain, LOGLEVEL_DEBUG);
1624+
$vhost_data['tls13_supported'] = "y";
1625+
}
1626+
}
1627+
1628+
// Nginx >= 1.25.1 uses a dedicated directive to enable HTTP/2 support
1629+
// This is a quirk for Nginx legacy versions (or simply Nginx < 1.25.1) and restores the required http2 parameter in the listen directive
1630+
if(version_compare($app->system->getnginxversion(true), '1.25.1', '<')) {
1631+
$vhost_data['http2_directive_compat_quirk'] = " http2";
16241632
}
16251633

16261634
$tpl->setVar($vhost_data);
16271635

1636+
$tpl->setVar('nginx_version', $app->system->getnginxversion());
1637+
$tpl->setVar('nginx_full_version', $app->system->getnginxversion(true));
1638+
16281639
$server_alias = array();
16291640

16301641
// get autoalias
@@ -1982,25 +1993,25 @@ function update($event_name, $data) {
19821993
$this->awstats_update($data, $web_config);
19831994
}
19841995

1985-
//* Create GoAccess configuration
1986-
if($data['new']['stats_type'] == 'goaccess' && ($data['new']['type'] == 'vhost' || $data['new']['type'] == 'vhostsubdomain' || $data['new']['type'] == 'vhostalias')) {
1987-
$this->goaccess_update($data, $web_config);
1988-
}
1996+
//* Create GoAccess configuration
1997+
if($data['new']['stats_type'] == 'goaccess' && ($data['new']['type'] == 'vhost' || $data['new']['type'] == 'vhostsubdomain' || $data['new']['type'] == 'vhostalias')) {
1998+
$this->goaccess_update($data, $web_config);
1999+
}
19892000

1990-
//* Remove the AWstats configuration file
2001+
//* Remove the AWstats configuration file
19912002
if($data['old']['stats_type'] == 'awstats' && $data['new']['stats_type'] != 'awstats') {
19922003
$this->awstats_delete($data, $web_config);
1993-
}
2004+
}
19942005

19952006
//* Remove the GoAccess configuration file
19962007
if($data['old']['stats_type'] == 'goaccess' && $data['new']['stats_type'] != 'goaccess') {
19972008
$this->goaccess_delete($data, $web_config);
19982009
}
19992010

2000-
//* Remove the Webalizer configuration file
2011+
//* Remove the Webalizer configuration file
20012012
if($data['old']['stats_type'] == 'webalizer' && $data['new']['stats_type'] != 'webalizer') {
20022013
$this->webalizer_delete($data, $web_config);
2003-
}
2014+
}
20042015

20052016
//* Remove Stats-Folder when Statistics set to none
20062017
if($data['new']['stats_type'] == '' && ($data['new']['type'] == 'vhost' || $data['new']['type'] == 'vhostsubdomain' || $data['new']['type'] == 'vhostalias')) {
@@ -2625,96 +2636,92 @@ function _create_web_folder_auth_configuration($website){
26252636

26262637
//* Update the GoAccess configuration file
26272638
private function goaccess_update ($data, $web_config) {
2628-
global $app;
2629-
2630-
$web_folder = $data['new']['web_folder'];
2631-
if($data['new']['type'] == 'vhost') $web_folder = 'web';
2632-
2633-
$goaccess_conf_locs = array('/etc/goaccess.conf', '/etc/goaccess/goaccess.conf');
2634-
$count = 0;
2635-
2636-
foreach($goaccess_conf_locs as $goa_loc) {
2637-
if(is_file($goa_loc) && (filesize($goa_loc) > 0)) {
2638-
$goaccess_conf_main = $goa_loc;
2639-
break;
2640-
} else {
2641-
$count++;
2642-
if($count == 2) {
2643-
$app->log("No GoAccess base config found. Make sure that GoAccess is installed and that the goaccess.conf does exist in /etc or /etc/goaccess", LOGLEVEL_WARN);
2644-
}
2645-
}
2646-
}
2647-
2648-
if(!is_dir($data['new']['document_root'] . "/log/goaccess_db")) $app->system->mkdirpath($data['new']['document_root'] . "/log/goaccess_db");
2649-
$goaccess_conf = $data['new']['document_root'].'/log/goaccess.conf';
2639+
global $app;
26502640

2651-
/*
2652-
In case that you use a different log format, you should use a custom goaccess.conf which you'll have to put into /usr/local/ispconfig/server/conf-custom/.
2653-
By default the originaly with GoAccess shipped goaccess.conf from /etc/ will be used along with the log-format value COMBINED.
2654-
*/
2641+
$web_folder = $data['new']['web_folder'];
2642+
if($data['new']['type'] == 'vhost') $web_folder = 'web';
26552643

2656-
if(file_exists("/usr/local/ispconfig/server/conf-custom/goaccess.conf.master")) {
2657-
$app->system->copy("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master", $goaccess_conf);
2644+
$goaccess_conf_locs = array('/etc/goaccess.conf', '/etc/goaccess/goaccess.conf');
2645+
$count = 0;
26582646

2659-
} elseif(!file_exists($goaccess_conf)) {
2647+
foreach($goaccess_conf_locs as $goa_loc) {
2648+
if(is_file($goa_loc) && (filesize($goa_loc) > 0)) {
2649+
$goaccess_conf_main = $goa_loc;
2650+
break;
2651+
} else {
2652+
$count++;
2653+
if($count == 2) {
2654+
$app->log("No GoAccess base config found. Make sure that GoAccess is installed and that the goaccess.conf does exist in /etc or /etc/goaccess", LOGLEVEL_WARN);
2655+
}
2656+
}
2657+
}
26602658

2661-
/*
2662-
By default the goaccess.conf should get copied by the webserver plugin but in case it wasn't, or it got deleted by accident we gonna copy it again to the destination dir.
2663-
Also there was no /usr/local/ispconfig/server/conf-custom/goaccess.conf.master, so we gonna use /etc/goaccess.conf as the base conf.
2664-
*/
2659+
if(!is_dir($data['new']['document_root'] . "/log/goaccess_db")) $app->system->mkdirpath($data['new']['document_root'] . "/log/goaccess_db");
2660+
$goaccess_conf = $data['new']['document_root'].'/log/goaccess.conf';
26652661

2666-
$app->system->copy($goaccess_conf_main, $goaccess_conf);
2667-
$content = $app->system->file_get_contents($goaccess_conf, true);
2668-
$content = preg_replace('/^(#)?log-format COMBINED/m', "log-format COMBINED", $content);
2669-
$app->system->file_put_contents($goaccess_conf, $content, true);
2670-
unset($content);
2662+
/*
2663+
In case that you use a different log format, you should use a custom goaccess.conf which you'll have to put into /usr/local/ispconfig/server/conf-custom/.
2664+
By default the originaly with GoAccess shipped goaccess.conf from /etc/ will be used along with the log-format value COMBINED.
2665+
*/
26712666

2672-
}
2667+
if(file_exists("/usr/local/ispconfig/server/conf-custom/goaccess.conf.master")) {
2668+
$app->system->copy("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master", $goaccess_conf);
2669+
} elseif(!file_exists($goaccess_conf)) {
2670+
/*
2671+
By default the goaccess.conf should get copied by the webserver plugin but in case it wasn't, or it got deleted by accident we gonna copy it again to the destination dir.
2672+
Also there was no /usr/local/ispconfig/server/conf-custom/goaccess.conf.master, so we gonna use /etc/goaccess.conf as the base conf.
2673+
*/
26732674

2674-
if(file_exists($goaccess_conf)) {
2675-
$domain = $data['new']['domain'];
2676-
$content = $app->system->file_get_contents($goaccess_conf, true);
2677-
$content = preg_replace('/^(#)?html-report-title(.*)/m', "html-report-title $domain", $content);
2678-
$app->system->file_put_contents($goaccess_conf, $content, true);
2679-
unset($content);
2675+
$app->system->copy($goaccess_conf_main, $goaccess_conf);
2676+
$content = $app->system->file_get_contents($goaccess_conf, true);
2677+
$content = preg_replace('/^(#)?log-format COMBINED/m', "log-format COMBINED", $content);
2678+
$app->system->file_put_contents($goaccess_conf, $content, true);
2679+
unset($content);
2680+
}
26802681

2681-
}
2682+
if(file_exists($goaccess_conf)) {
2683+
$domain = $data['new']['domain'];
2684+
$content = $app->system->file_get_contents($goaccess_conf, true);
2685+
$content = preg_replace('/^(#)?html-report-title(.*)/m', "html-report-title $domain", $content);
2686+
$app->system->file_put_contents($goaccess_conf, $content, true);
2687+
unset($content);
2688+
}
26822689

2683-
if(is_file($goaccess_conf) && (filesize($goaccess_conf) > 0)) {
2684-
$app->log('Created GoAccess config file: '.$goaccess_conf, LOGLEVEL_DEBUG);
2685-
}
2690+
if(is_file($goaccess_conf) && (filesize($goaccess_conf) > 0)) {
2691+
$app->log('Created GoAccess config file: '.$goaccess_conf, LOGLEVEL_DEBUG);
2692+
}
26862693

2687-
if(is_file($data['new']['document_root']."/" . $web_folder . "/stats/index.html")) $app->system->unlink($data['new']['document_root']."/" . $web_folder . "/stats/index.html");
2688-
if(file_exists("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master")) {
2689-
$app->system->copy("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master", $data['new']['document_root']."/" . $web_folder . "/stats/index.php");
2690-
} else {
2691-
$app->system->copy("/usr/local/ispconfig/server/conf/goaccess_index.php.master", $data['new']['document_root']."/" . $web_folder . "/stats/index.php");
2694+
if(is_file($data['new']['document_root']."/" . $web_folder . "/stats/index.html")) $app->system->unlink($data['new']['document_root']."/" . $web_folder . "/stats/index.html");
2695+
if(file_exists("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master")) {
2696+
$app->system->copy("/usr/local/ispconfig/server/conf-custom/goaccess_index.php.master", $data['new']['document_root']."/" . $web_folder . "/stats/index.php");
2697+
} else {
2698+
$app->system->copy("/usr/local/ispconfig/server/conf/goaccess_index.php.master", $data['new']['document_root']."/" . $web_folder . "/stats/index.php");
26922699
}
26932700
}
26942701

2695-
//* Delete the GoAccess configuration file
2696-
private function goaccess_delete ($data, $web_config) {
2697-
global $app;
2702+
//* Delete the GoAccess configuration file
2703+
private function goaccess_delete ($data, $web_config) {
2704+
global $app;
26982705

2699-
$goaccess_conf = $data['old']['document_root'] . "/log/goaccess.conf";
2706+
$goaccess_conf = $data['old']['document_root'] . "/log/goaccess.conf";
27002707

2701-
if ( @is_file($goaccess_conf) ) {
2702-
$app->system->unlink($goaccess_conf);
2703-
$app->log('Removed GoAccess config file: '.$goaccess_conf, LOGLEVEL_DEBUG);
2704-
}
2705-
}
2708+
if ( @is_file($goaccess_conf) ) {
2709+
$app->system->unlink($goaccess_conf);
2710+
$app->log('Removed GoAccess config file: '.$goaccess_conf, LOGLEVEL_DEBUG);
2711+
}
2712+
}
27062713

2707-
//* Delete the Webalizer configuration file
2708-
private function webalizer_delete ($data, $web_config) {
2709-
global $app;
2714+
//* Delete the Webalizer configuration file
2715+
private function webalizer_delete ($data, $web_config) {
2716+
global $app;
27102717

2711-
$webalizer_conf = $data['old']['document_root'] . "/log/webalizer.conf";
2718+
$webalizer_conf = $data['old']['document_root'] . "/log/webalizer.conf";
27122719

2713-
if ( @is_file($webalizer_conf) ) {
2714-
$app->system->unlink($webalizer_conf);
2715-
$app->log('Removed Webalizer config file: '.$webalizer_conf, LOGLEVEL_DEBUG);
2716-
}
2717-
}
2720+
if ( @is_file($webalizer_conf) ) {
2721+
$app->system->unlink($webalizer_conf);
2722+
$app->log('Removed Webalizer config file: '.$webalizer_conf, LOGLEVEL_DEBUG);
2723+
}
2724+
}
27182725

27192726
//* Update the awstats configuration file
27202727
private function awstats_update ($data, $web_config) {

0 commit comments

Comments
 (0)