- [Configuration](#configuration)
  - [Redirect HTTP to HTTPS via 301](#redirect-http-to-https-via-301)
  - [Including SSL Certificate for HTTPS](#including-ssl-certificate-for-https)
  - [WebSocket Connections](#websocket-connections)
  - [Load Balancing](#load-balancing)
  - [Basic Full Example](#basic-full-example)
  - [Adding Custom Stream Configs](#adding-custom-stream-configs)
- [Commands](#commands)
- [PID Issue on Some Alpine Linux Docker Images](#pid-issue-on-some-alpine-linux-docker-images)
- [References](#references)

----

## Configuration

### Redirect HTTP to HTTPS via 301
```nginx
server {
  listen *:80;

  server_name k3s.functionalbytes.com;
  server_tokens off; ## Don't show the nginx version number

  location / {
    return 301 https://k3s.functionalbytes.com:443$request_uri;
  }
}
```

### Including SSL Certificate for HTTPS
```nginx
ssl_certificate /secret/keys/proxy.functionalbytes.com.fullchain;
ssl_certificate_key /secret/keys/proxy.functionalbytes.com.key;
```

### WebSocket Connections
See: [[nginx Documentation] WebSocket proxying](http://nginx.org/en/docs/http/websocket.html)
```nginx
location /web_socket_path/ {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}
```

### Load Balancing
See: [[nginx Documentation] HTTP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/)
```nginx
upstream k3s_servers {
  # Round Robin by default - can add "weight=#" after each server for weighting, e.g.:
  # server k3s-s1.functionalbytes.com:80 weight=3;
  # With this set and nothing on k3s-s2 (default = 1), 3 out of 4 requests will be sent to k3s-s1

  # Alternatively one of the following can be uncommented for other load balancing options

  # Uncomment the line below to use the one with the fewest connections
  # least_conn;

  # Uncomment to send requests to the server based on a hash of the first 3 octets of their IP (guaranteeing requests go to the same server unless it is unavailable)
  # ip_hash;
  server k3s-s1.functionalbytes.com:80;
  server k3s-s2.functionalbytes.com:80;
}
```

### Basic Full Example
```nginx
upstream k3s_servers {
  server k3s-s1.functionalbytes.com:80;
  server k3s-s2.functionalbytes.com:80;
}

server {
  listen *:80;

  server_name k3s.functionalbytes.com;
  server_tokens off; ## Don't show the nginx version number, a security best practice

  location / {
    return 301 https://k3s.functionalbytes.com:443$request_uri;
  }
}

server {
  listen 443 ssl http2;

  server_name k3s.functionalbytes.com;
  server_tokens off; ## Don't show the nginx version number, a security best practice

  ssl_certificate /secret/keys/proxy.functionalbytes.com.fullchain;
  ssl_certificate_key /secret/keys/proxy.functionalbytes.com.key;

  # Allow large attachments
  client_max_body_size 128M;

  location / {
    proxy_pass http://k3s_servers;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}
```

### Adding Custom Stream Configs
1. Add an include directive to `/config/nginx/nginx.conf`
    > File: `/config/nginx/nginx.conf`
    ```nginx
    stream {
        include /config/nginx/stream-confs/*;
    }
    ```
2. Add the stream configs in `/config/nginx/stream-confs/`, e.g.:
    > File: `/config/nginx/stream-confs/k3s.conf`
    ```nginx
    upstream k3s_servers {
      server k3s-s1.functionalbytes.com:6443;
      server k3s-s2.functionalbytes.com:6443;
    }

    server {
      listen *:6443;

      ssl_certificate /secret/keys/proxy.functionalbytes.com.fullchain;
      ssl_certificate_key /secret/keys/proxy.functionalbytes.com.key;

      proxy_pass k3s_servers;
    }
    ```

## Commands
Reload the nginx config without any downtime (sends `SIGHUP` signal):
```bash
nginx -s reload
```

Verify configuration is valid:
```bash
nginx -t
```

## PID Issue on Some Alpine Linux Docker Images
**Note:** I am currently using `nginx:1.21-alpine` (official) which does not have this issue, but do still see the issue with `linuxserver/nginx:1.20.2` ([linuxserver.io](https://www.linuxserver.io/) image that I was using this on [Unraid](https://unraid.net/))

There is an issue where the PID file isn't created in the alpine linux version of nginx docker image. Running the reload command will result in the following error:
```bash
> nginx -s reload
nginx: [error] open() "/run/nginx/nginx.pid" failed (2: No such file or directory)
```

Two options for fixing this:

1. Create the required directory
    > File: `Dockerfile`
    ```Dockerfile
    ...
    RUN mkdir -p /run/nginx
    ...
    ```
1. Override the PID location
    ```sh
    nginx -g 'pid /tmp/nginx.pid; daemon off;'
    ```

## References
- [[Ubuntu Manpage] nginx](https://manpages.ubuntu.com/manpages/jammy/man8/nginx.8.html)
- [[nginx Documentation] WebSocket proxying](http://nginx.org/en/docs/http/websocket.html)
- [[nginx Documentation] HTTP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/)
- [[GitHub Issue #185] latest image run nginx problems](https://github.com/gliderlabs/docker-alpine/issues/185)



Configuring Nginx


- [Rough Notes](#rough-notes)
  - [Commands](#commands)
  - [Init Systems](#init-systems)
  - [Service Managers](#service-managers)
- [Important Reading](#important-reading)
- [References](#references)

----

## Rough Notes

- [systemd](https://en.wikipedia.org/wiki/Systemd) is for both system init and service management
- [supervisord](http://supervisord.org/) is only for service managment

### Commands
- The [`service`](https://manpages.ubuntu.com/manpages/jammy/en/man8/service.8.html) command is a "wrapper"/"high-level" command that will call the respective "low-level" manager such as [`systemctl`](https://manpages.ubuntu.com/manpages/jammy/man1/systemctl.1.html)
- The [`service`](https://manpages.ubuntu.com/manpages/jammy/en/man8/service.8.html) command allows for basic interatctions such as `status`, `start`, `reload`, etc.
- The [`systemctl`](https://manpages.ubuntu.com/manpages/jammy/man1/systemctl.1.html) command allows for advanced commands such as checking if a service is enabled (activated when booting): `systemctl is-enabled sshd.service`

**Quick Reference**
- Enable service to run at startup
    ```bash
    sudo systemctl enable sshd.service
    ```
- Disable service from running at startup
    ```bash
    sudo systemctl disable sshd.service
    ```

### Init Systems
- Init systems are those that run in process #1 - responsible for bootstrapping the system
- May also be responsible for starting and managing services (long running, background process)
- Ubuntu used to use [upstart](https://upstart.ubuntu.com/) but switched to [systemd](https://en.wikipedia.org/wiki/Systemd) in version 15.04 (2015)
- Alpine linux uses [OpenRC](https://wiki.alpinelinux.org/wiki/OpenRC)
- `systemd` is linux specific - (BSD distros such as FreeBSD have their own ["BSD-style init"](https://docs.freebsd.org/en/articles/linux-users/#startup))
- Although highly adopted, there is a lot of contreversy around `systemd` (see: [[Reddit] ELI5: The SystemD vs. init/upstart controversy](https://www.reddit.com/r/linux/comments/132gle/comment/c709592/?utm_source=share&utm_medium=web2x&context=3))

### Service Managers
Outside of init systems, there are also dedicated service managers such as [Supervisor (supervisord)](http://supervisord.org/)
> It shares some of the same goals of programs like launchd, daemontools, and runit. Unlike some of these programs, it is not meant to be run as a substitute for init as “process id 1”. Instead it is meant to be used to control processes related to a project or a customer, and is meant to start like any other program at boot time.

*[[supervisord.org] Supervisor: A Process Control System](http://supervisord.org/#supervisor-a-process-control-system)*

- Advantages of using something like `supervisord` are that it is OS agnostic and since it is outside of process #1, processes can be managed by users other than root/sudo

## Important Reading
- [[StackExchange] What is the difference between "init" and "service manager"?](https://unix.stackexchange.com/a/489949)
- [[gentoo wiki] Comparison of init systems](https://wiki.gentoo.org/wiki/Comparison_of_init_systems)

## References
- [[Stack Overflow] Difference between Systemctl and service command](https://stackoverflow.com/a/43539946)
- [[Ask Ubuntu] Difference between systemctl and service commands](https://askubuntu.com/questions/903354/difference-between-systemctl-and-service-commands)

Posts tagged "services"

Configuring Nginx

Linux Service Managers and Init Systems