nginx: update to 1.17.6 and use custom /etc/nginx/nginx.conf [RFC]

[peter-stadler]

Maintainer: Thomas Heil heil@terminal-consulting.de and Ansuel Smith ansuelsmth@gmail.com
Compile tested: MIPS 74K, Asus RT-N16, master snapshot
Run tested: MIPS 74K, Asus RT-N16, master snapshot, let it serve luci-ssl-nginx

Description:
Replace the standard config file containing commented examples with a minimal /etc/nginx/nginx.conf file that will load all /etc/nginx/conf.d/*.conf files. So other packages can install their server { … } parts for nginx in that directory instead of replacing or modifying the main nginx.conf file.

This PR includes also the corresponding changes for luci on nginx (nginx-mod-luci and nginx-mod-luci-ssl). I made also another PR for nginx-luci and nginx-ssl-luci that collect their files from packages …

In the official packages there is just one other app that uses nginx at this time: ariang. See my other PR for changing its nginx part accordingly.

Edit: I did update this PR to follow the changes in the meantime. I would update the other PR for nginx-luci and nginx-ssl-luci later if you think it is a good idea to extract the luci files from the nginx and uwsgi-cgi packages.

Edit2: Changed the documentation and included files/README.sh in the package for creating the documentations’s configuration part with the variables from the sources.
Furthermore, changed the default logging behavior: access_log off; error_log stderr; that is forwarded by the init to logd.

[peter-stadler]

I did update this PR to follow the changes in the meantime. The luci PR still refers to the old version, I could update it afterwards.

[feckert]

@Ansuel looks ok now ready to merge?

[peter-stadler]

We are discussing, how other sites should be included on behalf of the example of ariang: #9860 Would wait for that …

[peter-stadler]

This is one proposal:

The file /var/nginx_lan.listen keeps the IP addresses of the LAN and is used in the server parts of nginx in /etc/nginx/conf.d/*.conf.

The server part /etc/nginx/conf.d/lan.conf pulls in this file and all location parts in /etc/nginx/conf.d/*.locations. So, different sites can install their location parts there and they will be available on LAN.

The locations can also be used in other /etc/nginx/conf.d/*.conf. server parts for making selected sites available on WAN under different domains, i.e. server_name.

The /var/nginx_listen_lan.conf file is (re-)created if nginx starts or the LAN interface changes.

[Ansuel]

Looks good... last thing, a readme in the etc nginx config would be good

Last thing how to handle service that should run on https and should be redirected from http to https ?

[peter-stadler]

Thank you. You are right I will write a config for https and then a readme ...

[peter-stadler]

Took me some time for adding ssl to the init, now it should work quite automagically:

1. Everytime nginx-ssl starts, we check if the LAN has already a valid ssl certificate in
   /etc/nginx/conf.d/_lan.{crt,key}
2. If there is no valid certificate, we try to create a self-signed one (that needs px5g or openssl-util to be installed, too)
3. When there exists a certificate, we add corresponding ssl_certificate* directives to the configuration file
   /etc/nginx/conf.d/_lan.conf
   if needed and if it looks “normal”, i.e., it has a server_name _; part.
4. When there is a valid certificate for the LAN, we activate ssl by listen $IP:443 ssl; directives in
   /var/nginx_lan.listen
   and it becomes available by the default redirect from listen *:80; in
   /etc/nginx/conf.d/_redirect2ssl.conf
5. If cron is available (not inactive), we use it to check the certificate for validity once a year and renew it if there are only 13 months of the more than 3 years life time left.

The prime points 2, 3 and 5 can be used for other domains, too: Create a
/etc/nginx/conf.d/www.example.com.conf
with a corresponding server_name www.example.com; part and call
service nginx create_selfsigned_certificate_if_needed www.example.com
I did not test it for other domains, though.

I am glad if you can run it and I am open for any comments. Meanwhile, I would do some more tests and then write a documentation ...

[peter-stadler]

Did some tests and cleaned it up.

[peter-stadler]

Made some minor improvements and fixes. The docu is WIP.

[peter-stadler]

The documentation should be quite ready, made some changes for logging errors to syslog and set access_log off by default. What do you think?
Edit: Made some little changes/fixes and adapted nginx-mod-luci*.

[hnyman]

Is this PR still relevant?

[peter-stadler]

I created a tool (now) that does the main work, see #10960. When that is aproved, I will create another PR that superseeds this one here.

[neheb]

This must be rebased. Or closed.

[peter-stadler]

As the nginx-util is merged, I will make a new PR on Monday.

[peter-stadler]

(Draft PR at #11081)