content/blog/2022-02-16-debian-and-nginx.org

  1#+date:        <2022-02-16 Wed 00:00:00>
  2#+title:       Web Server Migration Procedure to Debian with Nginx and Agate Components
  3#+description: Step-by-step protocol for transitioning web server infrastructure to Debian operating system, including installation, configuration, and security hardening of Nginx and Agate services.
  4#+slug:        debian-and-nginx
  5#+filetags:    :debian:nginx:webserver:
  6
  7* Server OS: Debian
  8
  9I've used various Linux distributions throughout the years, but I've
 10never used anything except Ubuntu for my servers. Why? I really have no
 11idea, mostly just comfort around the commands and software availability.
 12
 13However, I have always wanted to try Debian as a server OS after testing
 14it out in a VM a few years ago (side-note: I'd love to try Alpine too,
 15but I always struggle with compatibility). So, I decided to launch a new
 16VPS and use [[https://www.debian.org][Debian]] 11 as the OS. Spoiler
 17alert: it feels identical to Ubuntu for my purposes.
 18
 19I did the normal things when first launching the VPS, such as adding a
 20new user, locking down SSH, etc. If you want to see that level of
 21detail, read my other post about
 22[[https://cleberg.net/blog/how-to-set-up-a-vps-web-server/][How to Set
 23Up a VPS Web Server]].
 24
 25All of this has been similar, apart from small things such as the
 26location of users' home folders. No complaints at all from me - Debian
 27seems great.
 28
 29* Web Server: Nginx
 30
 31Once I had the baseline server configuration set-up for Debian, I moved
 32on to trying out [[https://nginx.org][Nginx]] as my web server software.
 33This required me to install the =nginx= and =ufw= packages, as well as
 34setting up the initial UFW config:
 35
 36#+begin_src sh
 37sudo apt install nginx ufw
 38sudo ufw allow 'Nginx Full'
 39sudo ufw allow SSH
 40sudo ufw enable
 41sudo ufw status
 42sudo systemctl status nginx
 43#+end_src
 44
 45Once I had the firewall set, I moved on to creating the directories and
 46files for my website. This is very easy and is basically the same as
 47setting up an Apache server, so no struggles here.
 48
 49#+begin_src sh
 50sudo mkdir -p /var/www/your_domain/html
 51sudo chown -R $USER:$USER /var/www/your_domain/html
 52sudo chmod -R 755 /var/www/your_domain
 53nano /var/www/your_domain/html/index.html
 54#+end_src
 55
 56The next part, creating the Nginx configuration files, is quite a bit
 57different from Apache. First, you need to create the files in the
 58=sites-available= folder and symlink it the =sites-enabled= folder.
 59
 60Creating the config file for your domain:
 61
 62#+begin_src sh
 63sudo nano /etc/nginx/sites-available/your_domain
 64#+end_src
 65
 66Default content for an Nginx config file:
 67
 68#+begin_src sh
 69server {
 70        listen 80;
 71        listen [::]:80;
 72
 73        root /var/www/your_domain/html;
 74        index index.html index.htm index.nginx-debian.html;
 75
 76        server_name your_domain www.your_domain;
 77
 78        location / {
 79                try_files $uri $uri/ =404;
 80        }
 81}
 82#+end_src
 83
 84Finally, symlink it together:
 85
 86#+begin_src sh
 87sudo ln -s /etc/nginx/sites-available/your_domain /etc/nginx/sites-enabled/
 88#+end_src
 89
 90This will make your site available to the public (as long as you have
 91=your_domain= DNS records pointed at the server's IP address)!
 92
 93Next, I used [[https://certbot.eff.org/][certbot]] to issue an HTTPS
 94certificate for my domains using the following commands:
 95
 96#+begin_src sh
 97sudo apt install snapd; sudo snap install core; sudo snap refresh core
 98sudo snap install --classic certbot
 99sudo ln -s /snap/bin/certbot /usr/bin/certbot
100sudo certbot --nginx
101#+end_src
102
103Now that certbot ran successfully and updated my Nginx config files to
104include a =443= server block of code, I went back in and edited the
105config file to include security HTTP headers. This part is optional, but
106is recommended for security purposes; you can even test a website's HTTP
107header security at [[https://securityheaders.com/][Security Headers]].
108
109The configuration below shows a set-up where you only want your website
110to serve content from its own domain, except for images and scripts,
111which may come from =nullitics.com=. All other content would be blocked
112from loading in a browser.
113
114#+begin_src sh
115sudo nano /etc/nginx/sites-available/your_domain
116#+end_src
117
118#+begin_src sh
119server {
120    ...
121        add_header Content-Security-Policy "default-src 'none'; img-src 'self' https://nullitics.com; script-src 'self' https://nullitics.com; style-src 'self'; font-src 'self'";
122        add_header X-Content-Type-Options "nosniff";
123        add_header X-XSS-Protection "1; mode=block";
124        add_header X-Frame-Options "DENY";
125        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
126        add_header Referrer-Policy "no-referrer";
127    ...
128}
129#+end_src
130
131#+begin_src sh
132sudo systemctl restart nginx
133#+end_src
134
135** Nginx vs. Apache
136
137As I stated at the beginning, my historical hesitation with trying Nginx
138was that the differences in configuration formats scared me away from
139leaving Apache. However, I prefer Nginx to Apache for a few reasons:
140
1411. Nginx uses only one config file (=your_domain=) vs. Apache's two-file
142   approach for HTTP vs. HTTPS (=your_domain.conf= and
143   =your_domain-le-ssl.conf=).
1442. Symlinking new configurations files and reloading Nginx are way
145   easier than Apache's process of having to enable headers with
146   =a2enmod mod_headers=, enable PHP with =a2enmod php= (plus any other
147   mods you need), and then enabling sites with =a2ensite=, and THEN
148   reloading Apache.
1493. The contents of the Nginx config files seem more organized and
150   logical with the curly-bracket approach. This is a minor reason, but
151   everything just felt cleaner while I was installing my sites and that
152   had a big quality of life impact on the installation for me.
153
154They're both great software packages, but Nginx just seems more
155organized and easier to use these days. I will certainly be exploring
156the Nginx docs to see what other fun things I can do with all of this.
157
158* Gemini Server: Agate
159
160Finally, I set up the Agate software on this server again to host my
161Gemini server content, using Rust as I have before. You can read my
162other post for more information on installing Agate:
163[[https://cleberg.net/blog/hosting-a-gemini-server/][Hosting a Gemini
164Server]].
165
166All in all, Debian + Nginx is very slick and I prefer it over my old
167combination of Ubuntu + Apache (although it's really just Nginx > Apache
168for me, since Debian seems mostly the same as Ubuntu is so far).