sudo yum install nginx
cd /etc && ls | grep nginx // check settings
sudo mkdir /etc/nginx/sites-available
sudo mkdir /etc/nginx/sites-enabled
2. Setting up config
1) nginx.conf 수정 : nginx 관련 설정을 블록 단위로 설정, sites-enable에 존재하는 파일 불러옴
sudo vi /etc/nginx/nginx.conf
include /etc/nginx/sites-enabled/*.conf;
# server {
# listen 80;
# listen [::]:80;
# server_name _;
# root /usr/share/nginx/html;
#
# # Load configuration files for the default server block.
# include /etc/nginx/default.d/*.conf;
#
# error_page 404 /404.html;
# location = /404.html {
# }
#
# error_page 500 502 503 504 /50x.html;
# location = /50x.html {
# }
# }
2) server 설정 : nginx 최신 버전을 따로 설치하지 않고 기본 설정된 repository에 있는 버전을 install nginx로 바로 설치한 경우에는 nginx 환경 설정 파일 위치가 /etc/nginx/sites-available/default로 설정됨, 최신 버전을 설치했을 경우 /etc/nginx/conf.d/default.conf [5]
sudo vi /etc/nginx/sites-available/default.conf
server {
listen 80;
location / {
root /project/nginx-project; // path to deploy
index index.html index.htm;
try-files $url $url/ /index.html;
}
}
3) symbolic link 설정 : sites-enabled directory에 default.conf 바로가기 생성 sites-available에 존재하는 설정 파일들 중, 사용하는 설정 파일만 link해서 사용할 수 있도록 하는 디렉터리
cd /etc/nginx/sites-enabled
sudo ln -s /etc/nginx/sites-available/default.conf
ls -l
total 0 lrwxrwxrwx. 1 root root 39 Jul 30 04:42 default.conf → /etc/nginx/sites-available/default.conf 4) 웹서버 html 설정
sudo vi /project/nginx-project/index.html
<!DOCTYPE html>
<html>
<head>
<title>Welcome to Nginx!</title>
</head>
<body>
<h1>Welcome to Nginx!</h1>
<p>If you see this page, the Nginx web server is successfully installed and working.</p>
<p>Further configuration is required.</p>
</body>
</html>
3. Run the server
sudo systemctl start nginx
오류 시 status : Failed to start nginx.service - The nginx HTTP and reverse proxy server
sudo systemctl start nginx
Job for nginx.service failed because the control process exited with error code. See "systemctl status nginx.service" and "journalctl -xeu nginx.service" for details.
: 80번 포트에 수신 대기중인 프로세스 삭제
fuser -k 80/tcp
4. Prepare SSL/TLS Certificate
- Generate a self-signed certificate or obtain a certificate from a Certificate Authority (CA) 1) Ensure that OpenSSL is installed on your operating system
openssl version
nginx가 ssl 적용이 가능한 모듈이 있는지 확인 (--with-http_ssl_module)
- -days 3650: 3650일짜리(10년) 인증서 - -in server.csr -signkey server.key: 개인 키와 서버 요청서를 가지고 인증서 server.crt 생성
5. Configure the Nginx configuration file
- Add the following HTTPS-related settings inside the server block: - Use the listen directive to specify port 443 - Use the ssl_certificate and ssl_certificate_key directives to specify the paths to the certificate files
→ The private key has a passphrase requirement but nginx is not configured to use a passphrase.
7. delete key passphrase
1) Rename the existing server.key filename to server_pass.key
mv server.key server_pass.key
2) Create a new key without a passphrase requirement. It is assumed that the RSA key in use, otherwise adjust the command accordingly. When prompted, type the passphrase and press enter
openssl rsa -in server_pass.key -out server.key
3) Stop, start nginx service and check that no error message are displayed
8. local test - www.example.com은 공인된 도메인이 아니라 사내에서 사용할 가상 도메인이므로 클라이언트 측 도메인에 대한 hosts 파일을 등록해야 함
9. (optional) Additional SSL/TLS-related Settings - Use the ssl_session_cache and ssl_session_timeout directives to configure the SSL session cache - Use the ssl_prefer_server_ciphers direcactive to prefer the server's cipher suites - Use the add_header directive to add security-related headers
10. Test Configuration and Restart Nginx - Use the nginx -t command to check the syntax of the configuration file - Use the systemctl restart nginx command to restart the Nginx service
