peter-stadler
commented
4 years ago I am working on a new version.
I see that the message init_lan notice: no server named _lan is misleading, I removed it in the new version. Beside that message, the root@OpenWrt:~# /etc/init.d/nginx start should not fail, this is just an information. Isn't Nginx running?
To be clear: You can remove _lan.conf and it should work (showing the notice message). But, be aware that it could be reinstalled on upgrades (opkg does not track user deleted files). So, for now it is better to comment or remove its content (leaving an empty file). In the new version this should be better, too.
For dropping request without Host header: Is server_name ""; not working? Please be aware that the server must also listen on LAN explicitly (if using _lan.conf):
server {
server_name "";
listen [::]:80; # or: listen [::]:443;
listen 80; # or: listen 443;
include /var/lib/nginx/lan.listen; # or: /var/lib/nginx/lan_ssl.listen;
return 444;
}The configuration should work with a custom /etc/nginx/nginx.conf. Beside nginx-util init_lan searches for _lan.conf in /etc/nginx/conf.d/ you do not have to use that directory.
You are right that the hard coded procd_set_param file /etc/nginx/conf.d/... is inflexible. But, it is tracking more than before. If you are not using the conf.d directory it should not behave differently than before. (This variable influences the service nginx reload behaviour. procd keeps track of the stated files and invokes reloading only if some of them changed its md5 value.)
P.S.: I am not sure that the procd_set_param file … does this, when we use a custom reload function. So, I am thinking about removing these lines. But, this is not my priority now. Do you like to investigate it?
Note: Theoretically it would be possible to split off nginx-util with the default server respectively the uci configuration from the nginx packages. Then, it would be depended from other packages (like luci-ssl-nginx, luci-nginx or ariang-nginx). But, the problems will be introduced, when a user installs the first of these packages and it will become hard to track. Although, I do not think it would be a good idea, I would implement it if the maintainers want it.
Thank you very much for the feedback.
PussAzuki
jkcapoeira
richard-gravy
FlexMcMurphy
@heil @Ansuel @peter-stadler
Commit 2401fd6db5e582d1b1442e4832222a3fee50937a introduced sweeping changes to /etc/init.d/nginx and to the way Nginx configuration files have to be written.
/etc/init.d/nginx now forces users to put Nginx configuration files into /etc/nginx/conf.d/. If you have a customized version of /etc/nginx/nginx.conf that uses the "include" directive to read configuration files from some other location, like the commonly-used /etc/nginx/sites or /etc/nginx/sites-enabled, you are out of luck. The new version of /etc/init.d/nginx hardcodes the location of the configuration files /etc/nginx/conf.d/ by way of using nginx-util.
/etc/init.d/nginx now uses nginx-util to automatically create a default configuration for Nginx in /etc/nginx/conf.d/_lan.conf which loads "listen" and "default_server" directives from /var/lib/nginx/lan_ssl.listen and /var/lib/nginx/lan_ssl.listen.default. This default configuration makes Nginx listen on ports 80 and 443 (in case of nginx-ssl) on all IP addresses associated with the LAN adapter. Now if someone wants to change Nginx configuration so that there is no default server and there are only named virtual servers responding to specific domain names, one has to disable the "_lan" server. The updated OpenWrt Nginx Wiki page now says that "We can disable single configuration parts by giving them another extension, e.g., by adding .disabled." Renaming _lan.conf to _lan.conf.disabled and adding domain-specific configuration files into /etc/nginx/conf.d/ causes Nginx failure to start:
To be clear, by mandating "_lan" server which uses directives from /var/lib/nginx/lan_ssl.listen and /var/lib/nginx/lan_ssl.listen.default it is no longer possible to configure Nginx in OpenWrt to drop requests without the "Host" header field, which is precisely the case when Nginx receives a "rogue" https request with no SNI specified.
Since /etc/init.d/nginx now relies on nginx-util to create a default configuration, nginx package now has an additional dependency: nginx-util. For users like me who already have a well-working Nginx configuration, nginx-util provides zero benefit while consuming ~130KB of space on an OpenWrt device.
While an attempt to provide a reasonable default configuration for a package in OpenWrt is laudable, in this particular case it has created more problems than it has solved. First, Nginx already comes with reasonably good default configuration. Second, it is completely unacceptable to force a particular configuration on users where it is not necessary. Mandating the "_lan" server and mandating the default servers listening on all IP addresses associated with the LAN interface are all unacceptable.
As a minimum:
As a maximum: