cmc/cleberg.net

  1#+date:        [2022-02-16 Wed 00:00:00]
  2#+title:       Migrating from Ubuntu to Debian with Nginx
  3#+description: Moving my web server from Ubuntu to Debian and reconfiguring Nginx.
  4#+slug:        debian-and-nginx
  5#+filetags:    :linux:web:
  6
  7* Server Operating System (OS): Debian
  8
  9I've used various Linux distributions throughout the years, but I've never used
 10anything except Ubuntu for my servers. Why? I really have no idea, mostly just
 11comfort around the commands and software availability.
 12
 13However, I have always wanted to try Debian as a server OS after testing it out
 14in a VM a few years ago (side-note: I'd love to try Alpine too, but I always
 15struggle with compatibility). So, I decided to launch a new VPS and use [[https://www.debian.org][Debian]]
 1611 as the operating system (OS). Spoiler alert: it feels identical to Ubuntu for my purposes.
 17
 18I did the normal things when first launching the VPS (virtual private server),
 19such as adding a new user, locking down SSH (secure shell protocol), etc. If you
 20want to see that level of detail, read my other post about [[https://cleberg.net/blog/how-to-set-up-a-vps-web-server/][How to Set Up a VPS
 21Web Server]].
 22
 23All of this has been similar, apart from small things such as the location of
 24users' home folders. No complaints at all from me - Debian seems great.
 25
 26* Web Server: Nginx
 27
 28Once I had the baseline server configuration set-up for Debian, I moved on to
 29trying out [[https://nginx.org][Nginx]] as my web server software. This required me to install the
 30=nginx= and =ufw= packages, as well as setting up the initial UFW (Uncomplicated
 31Firewall) config:
 32
 33#+begin_src sh
 34sudo apt install nginx ufw
 35sudo ufw allow 'Nginx Full'
 36sudo ufw allow SSH
 37sudo ufw enable
 38sudo ufw status
 39sudo systemctl status nginx
 40#+end_src
 41
 42Once I had the firewall set, I moved on to creating the directories and files
 43for my website. This is very easy and is basically the same as setting up an
 44Apache server, so no struggles here.
 45
 46#+begin_src sh
 47sudo mkdir -p /var/www/your_domain/html
 48sudo chown -R $USER:$USER /var/www/your_domain/html
 49sudo chmod -R 755 /var/www/your_domain
 50nano /var/www/your_domain/html/index.html
 51#+end_src
 52
 53The next part, creating the Nginx configuration files, is quite a bit different
 54from Apache. First, you need to create the files in the =sites-available= folder
 55and symlink it the =sites-enabled= folder.
 56
 57Creating the configuration file for your domain:
 58
 59#+begin_src sh
 60sudo nano /etc/nginx/sites-available/your_domain
 61#+end_src
 62
 63Default content for an Nginx configuration file:
 64
 65#+begin_src sh
 66server {
 67        listen 80;
 68        listen [::]:80;
 69
 70        root /var/www/your_domain/html;
 71        index index.html index.htm index.nginx-debian.html;
 72
 73        server_name your_domain www.your_domain;
 74
 75        location / {
 76                try_files $uri $uri/ =404;
 77        }
 78}
 79#+end_src
 80
 81Finally, symlink it together:
 82
 83#+begin_src sh
 84sudo ln -s /etc/nginx/sites-available/your_domain /etc/nginx/sites-enabled/
 85#+end_src
 86
 87This will make your site available to the public (as long as you have
 88=your_domain= DNS (Domain Name System) records pointed at the server's IP address)!
 89
 90Next, I used [[https://certbot.eff.org/][certbot]] to issue an HTTPS (Hypertext Transfer Protocol Secure)
 91certificate for my domains using the following commands:
 92
 93#+begin_src sh
 94sudo apt install snapd; sudo snap install core; sudo snap refresh core
 95sudo snap install --classic certbot
 96sudo ln -s /snap/bin/certbot /usr/bin/certbot
 97sudo certbot --nginx
 98#+end_src
 99
100Now that =certbot= ran successfully and updated my Nginx configuration files to
101include a =443= server block of code, I went back in and edited the
102configuration file to include security HTTP headers. This part is optional, but
103is recommended for security purposes; you can even test a website's HTTP header
104security at [[https://securityheaders.com/][Security Headers]].
105
106The configuration below shows a set-up where you only want your website to serve
107content from its own domain, except for images and scripts, which may come from
108=nullitics.com=. All other content would be blocked from loading in a browser.
109
110#+begin_src sh
111sudo nano /etc/nginx/sites-available/your_domain
112#+end_src
113
114#+begin_src sh
115server {
116    ...
117        add_header Content-Security-Policy "default-src 'none'; img-src 'self' https://nullitics.com; script-src 'self' https://nullitics.com; style-src 'self'; font-src 'self'";
118        add_header X-Content-Type-Options "nosniff";
119        add_header X-XSS-Protection "1; mode=block";
120        add_header X-Frame-Options "DENY";
121        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
122        add_header Referrer-Policy "no-referrer";
123    ...
124}
125#+end_src
126
127#+begin_src sh
128sudo systemctl restart nginx
129#+end_src
130
131** Nginx vs. Apache
132
133As I stated at the beginning, my historical hesitation with trying Nginx was
134that the differences in configuration formats scared me away from leaving
135Apache. However, I prefer Nginx to Apache for a few reasons:
136
1371. Nginx uses only one configuration file (=your_domain=) vs. Apache's two-file
138   approach for HTTP vs. HTTPS (=your_domain.conf= and
139   =your_domain-le-ssl.conf=).
1402. Symlinking new configurations files and reloading Nginx are way easier than
141   Apache's process of having to enable headers with =a2enmod mod_headers=,
142   enable PHP with =a2enmod php= (plus any other mods you need), and then
143   enabling sites with =a2ensite=, and THEN reloading Apache.
1443. The contents of the Nginx configuration files seem more organized and logical
145   with the curly-bracket approach. This is a minor reason, but everything just
146   felt cleaner while I was installing my sites and that had a big quality of
147   life impact on the installation for me.
148
149They're both great software packages, but Nginx just seems more organized and
150easier to use these days. I will certainly be exploring the Nginx docs to see
151what other fun things I can do with all of this.
152
153* Gemini Server: Agate
154
155Finally, I set up the Agate software on this server again to host my Gemini
156server content, using Rust as I have before. You can read my other post for more
157information on installing Agate: [[https://cleberg.net/blog/hosting-a-gemini-server/][Hosting a Gemini Server]].
158
159All in all, Debian + Nginx is very slick and I prefer it over my old combination
160of Ubuntu + Apache (although it's really just Nginx > Apache for me, since
161Debian seems mostly the same as Ubuntu is so far).