openwrt nginx 配置教程

OpenWRT 是一个开源的路由器固件，支持 Nginx 服务器。首先，我们需要安装 Nginx，具体步骤可以参考安装 Nginx 的教程。

Nginx 的配置文件位于 /etc/nginx/nginx.conf，我们需要修改这个文件来配置 Nginx。

使用 OpenWRT 的 Nginx 配置非常简单，主要需要修改的就是虚拟主机的配置。

To configure Nginx on OpenWRT, you need to regenerate the index file and install the nginx-tls feed. This will enable you to compile Nginx with TLS support.

To compile Nginx with TLS, you'll need to press space to select nginx, press enter to enter configuration, choose Configuration, press space to select “Enable SSL Module”, and exit five times and save. Once the build is finished, the built packages will be in bin/packages.

You can then configure Nginx by creating configuration files in the /etc/nginx/conf.d/ directory. For example, you can create a file called http_head.conf and another called https.conf to set up two different servers, one for the local network and one for the public internet.

On a similar theme: Openwrt One Router

Nginx 的配置文件通常存放在 /etc/nginx 目录下。这个目录下有多个文件和子目录，每个文件或子目录都有特定的用途。

Nginx 的配置文件使用 INI 格式编写，包含多个块和指令。每个块代表一个配置区域，例如 http 或 server 块。

Nginx 的配置文件可以包含多个 include 指令，用于包含外部文件或目录的配置。这个特性可以帮助我们组织和维护配置文件。

To compile Nginx with TLS support, you'll need to regenerate the index file and install the nginx-tls feed.

Regenerating the index file is a crucial step, and it's done by running the necessary commands.

Once the feed is installed, you can drill down to Network > Web Servers/Proxies and select the nginx option.

Press space to select nginx, then press enter to enter configuration.

After entering configuration, choose the Configuration option and select the "Enable SSL Module" option by pressing space.

Exit five times and save your changes to complete the process.

The built packages will be in bin/packages once the build is finished.

Detailed configuration through /etc/nginx/conf.d/* is a powerful way to customize your Nginx setup. You can create separate configuration files for different services, such as HTTP and HTTPS.

To get started, you'll need to create new configuration files in the /etc/nginx/conf.d/ directory. For example, you can create a file called http_head.conf for HTTP configuration.

You can also create separate configuration files for different services, such as webdav.conf for WebDAV. This is because Windows only supports HTTPS for WebDAV, so you'll need to use HTTPS for both internal and external networks.

Intriguing read: Setup Openwrt Luci Https through Command Line

To set up multiple mounting points with different permissions, you can create separate configuration files for each one. For instance, you can create a file called webdav_location_set to reuse configuration settings.

To set up webdav users and passwords, you can add user credentials to the configuration file. For example, you can add the user "user" with the password "123456". However, keep in mind that Windows can only remember one set of credentials per domain, so it's recommended to use a common username and strong password for multiple mounting points.

Here are some configuration files that you can create for detailed configuration through /etc/nginx/conf.d/*:

To configure OpenWrt, start by updating the package list with `opkg update`. Then, install the necessary packages for PHP, including `php5` and its dependencies, using `opkg install`. You'll also need to install `mysql-server` and `nginx` along with `spawn-fcgi` and `zoneinfo-core`.

The `opkg install` command will install a long list of packages, including `php5-mod-gd`, `php5-mod-session`, and `php5-mod-mysql`. This will provide the necessary components for PHP to function properly. You'll also need to create a new group called `www` and add a user to that group using `groupadd` and `useradd`.

To start the MySQL service, use the command `/etc/init.d/mysqld start`. Then, log in to the database using `mysql -u root -p` and create a new database, such as `abcd`, using the `create database` command.

Here is a list of the packages installed with `opkg install`:

To start, you need to update the package list with `opkg update`. This ensures you have the latest package information.

Next, install the necessary packages using `opkg install`. You'll need to install a long list of packages, including `php5`, `php5-mod-gd`, `mysql-server`, and `nginx`. Don't worry, it's a one-time task.

You can use the following command to install the packages: `opkg install php5 php5-mod-gd php5-mod-session php5-mod-pdo php5-mod-pdo-mysql php5-mod-mysql php5-mod-mcrypt php5-mod-mbstring php5-fastcgi php5-cgi php5-mod-xml php5-mod-ctype php5-mod-curl php5-mod-exif php5-mod-ftp php5-mod-iconv php5-mod-json php5-mod-sockets php5-mod-sqlite3 php5-mod-tokenizer php5-mod-zip mysql-server nginx spawn-fcgi zoneinfo-core zoneinfo-asia`.

After installing the packages, create a new group and user for the web server using `groupadd` and `useradd`. You'll need to create a new group called `www` and add a new user called `www` to it.

Here's a list of the commands you can use to create the group and user:

These commands will create a new group and user, and set the ownership of the web directory to the new user.

Once you've created the group and user, start the MySQL service using `/etc/init.d/mysqld start`. This will start the MySQL service, allowing you to connect to the database.

To connect to the MySQL database, use the command `mysql -u root -p`. This will prompt you to enter the root password, allowing you to connect to the database.

After connecting to the database, create a new database using the `create database` command. You can choose any name you like, but for this example, we'll use `abcd`.

Here's an example of how to create the database:

These commands will create a new database called `abcd`.

That's it for the installation process! With these steps, you should have OpenWrt installed and configured with PHP, MySQL, and Nginx.

Configuring Nginx via UCI is a straightforward process that allows you to easily manage your web server's configuration.

You can use the `uci` command to edit the Nginx configuration file, specifically the `nginx` section, which can be accessed by running `uci edit nginx`.

See what others are reading: Openwrt Uci

The configuration file is divided into sections, each containing a set of configuration options, such as `http` and `server`.

To add a new configuration option, you can use the `add` command, for example, `uci add nginx http`.

The `uci` command also allows you to delete configuration options using the `delete` command, for example, `uci delete nginx http`.

You can also use the `set` command to modify existing configuration options, for example, `uci set nginx.http.server = 1`.

Changes made to the configuration file will take effect immediately after saving, which can be done using the `commit` command, for example, `uci commit nginx`.

Additional reading: Upgrade Openwrt from Command Line

To start Nginx, simply type "Start nginx" in your terminal. This will initiate the Nginx instance.

If your configuration is valid, the port 443 should be bound to Nginx, allowing it to function properly.

If Nginx doesn't start, you can use the logread command to get some details about the issue.

If logread doesn't provide any useful information, try starting Nginx manually from your workstation.

Let's dive into the further configuration of our OpenWrt setup. We've already installed the necessary packages, but now it's time to fine-tune our setup.

To add another virtual host, just add a new server block after the default one. This allows us to serve different content for different hostnames.

We can also configure our nginx instance to use a different port by modifying the server block. For example, we can use port 8080 for our new virtual host.

To enable the spawn-fcgi service to start automatically, we can add the command to the /etc/rc.local file. This ensures that our PHP-FPM service starts automatically when the system boots up.

We can also configure our nginx instance to use a different document root by modifying the server block. For example, we can use the /mnt/sda1/web directory as our document root.

Here's a summary of the configuration files we need to modify:

By following these steps, we can further configure our OpenWrt setup to suit our needs.

To optimize Nginx performance, it's essential to set the worker processes to match the number of CPU cores, which is recommended to be equal to the number of CPU cores.

You can do this by adding the line `worker_processes 4;` to the main configuration file, where 4 is the number of CPU cores. This will improve efficiency, especially when handling SSL connections.

Another crucial setting is `keepalive_timeout 900s 600s;`, which sets the keep-alive timeout to 900 seconds and sends the second parameter (600 seconds) to the browser. This will allow for longer connections and better performance.

Here's a summary of the key settings:

By implementing these settings, you'll be able to improve Nginx performance and ensure a smooth user experience.

To optimize Nginx settings, start by setting worker processes to match your CPU cores, which can improve efficiency when handling SSL traffic. This can be done by setting worker_processes to a value equal to the number of CPU cores, or by setting it to auto, which will automatically adjust to the number of cores.

Setting the keepalive timeout to a longer value can also improve connection stability, but be aware that this may impact connection usage efficiency. A recommended setting is keepalive_timeout 900s 600s.

When it comes to file transmission, setting sendfile_max_chunk to 10m can help prevent connection blocking by forcing sendfile to accumulate to 10M. This should be paired with tcp_nopush on and tcp_nodelay on.

To ensure proper buffering, set large_client_header_buffers to 4 32k, and consider setting client_header_buffer_size to 4k. Additionally, setting proxy_buffer_size to 8k can help improve buffering performance.

Here's a summary of recommended settings:

Keep in mind that these settings should be adjusted according to your specific application scenario, and may need to be fine-tuned for optimal performance.

In Nginx, memory and disk optimization is crucial for efficient performance. The client_max_body_size directive allows you to set the maximum size of a request body, and setting it to 0 disables this limit, which is recommended for webdav applications.

Setting client_body_in_single_buffer to "on" ensures that the HTTP request body is always written to the memory buffer. This is a good practice to follow.

The client_body_buffer_size directive sets the buffer size for the request body, with a default value of 16k. However, setting it to 4096M allows for larger file uploads, which is necessary for webdav applications.

The client_body_temp_path directive sets the temporary path for the request body, and it's recommended to place this on a memory-based storage, such as /tmp/nginxtemp. This is because large files will be stored on this path before being transferred to their final destination.

Using the sendfile directive can simplify the file sending process and improve efficiency. It's essential to keep this directive enabled.

The open_file_cache directive is used to cache file storage information, but it's recommended to keep this disabled to avoid slowing down webdav file refreshes.

Openwrt 启动后，将使用模板 /etc/nginx/uci.conf.template 在内存中自动生成配置文件，并生成该配置文件的软连接 /etc/nginx/uci.conf。

The generated configuration file is created by replacing the #UCI_HTTP_CONFIG in the template with the contents of /etc/config/nginx UCI配置文件。

UCI默认配置的"_lan" server 中加载 /etc/nginx/restrict_locally 限制只允许从局域网访问。

This ensures that only local traffic is allowed to access the server.

UCI默认配置的"_lan" server 中加载 /etc/nginx/conf.d/*.locations：加载到默认"_lan" server的{}内，建议存放各种自定义location。

This is where you can store custom location settings.

UCI默认配置的"_lan" server 中加载 /etc/nginx/conf.d/*.conf：加载到http的{}内，建议存放各种自定义server。

This is where you can store custom server settings.

Note: Don't recommend modifying uci.conf.template directly, as it will be updated during system upgrades.

Note: Settings in *.locations and *.conf files will override UCI settings if they conflict.

Note: If you want to use /etc/nginx/nginx.conf as the main configuration file, you can disable UCI configuration by setting uci_enable to false. However, this is not recommended.

我们可以通过以下方式来实现：在 Nginx 配置中添加 worker_processes 4;，其中 4 是 CPU 核心数的建议值。另外，我们需要设置 keepalive_timeout，建议设置为 900s 和 600s，这可以提高浏览器的响应速度。

我们还需要设置 ssl_session_cache 和 ssl_session_timeout。建议使用 shared 并设置大于等于 10M 的缓存大小，这可以提高 SSL 会话的效率。同时，我们也需要设置 ssl_session_timeout，建议设置为 15m，这可以提高 SSL 会话的有效期。

To get a public TLS certificate, you'll need to request one for your Raspberry PI's hostname.

You can use the DNS challenge method and a DNS provider like Gandi, replacing "raspberry-pi.example.test" with your actual hostname.

Recommended read: Openwrt Dynamic Dns

The certificates will be stored in /etc/nginx/tls/certificates/$hostname.{key,crt}.

Make sure to set up the certificates correctly to avoid any issues.

For HTTPS settings, you'll need three key components: listen port's SSL attribute, a certificate, and a key.

The default SSL protocols are TLSv1, TLSv1.1, and TLSv1.2, and the default ciphers are HIGH, excluding aNULL and MD5.

listen端口的ssl属性可以通过ssl_protocols设置来配置，例如，使用TLSv1、TLSv1.1和TLSv1.2协议。

证书和key是HTTPS设置的另一个重要方面。同一个listen端口，不同的server_name使用不同的证书会出现问题。

以下是HTTPS常规设置的基本配置：

首先，我们需要安装 nginx 包。根据我们之前的配置，nginx 包已经安装在 OpenWRT 系统中。

我们需要配置 nginx 的监听端口，根据我们的需求选择合适的端口。例如，我们可以配置 nginx 监听端口 80。

nginx 的配置文件通常存放在 /etc/nginx/nginx.conf 中。我们需要修改这个文件来配置 nginx 的服务。

我们可以使用 include 指令来包含其他配置文件。例如，我们可以在 nginx.conf 文件中包含其他配置文件来扩展 nginx 的功能。

nginx 的服务可以通过 systemctl 命令来管理。例如，我们可以使用 systemctl start nginx 来启动 nginx 服务。