<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div>HI Chris,</div><div><br></div><div>Part of the challenge (and fun) of being a sysadmin (Linux, Unix or otherwise) is system building: Getting disparate systems and linking them together into a working configuration. I'd say your TAFE lecturer knows this which is why this is part of your assessment.</div><div><br></div><div>That said, my advice to you is to <b>read the documentation</b> and be sure you fully understand what you are trying to build. Ask yourself: What software dependencies are needed for the software I'm trying to install? Are the dependencies themselves installed and working? Have I tested them?</div><div><br></div><div>Sometimes it's useful to keep the OSI model in mind to remind yourself that if a lower service or dependency isnt configured then there is no chance the ones above it will work too.</div><div><br></div><div>Practical advice:</div><div>Whilst there is nothing wrong with nginx per se, if your documentation is telling you to use apache, then use apache.</div><div>If you have full control over your DNS, the consider using a wildcard certificate from letsencrypt and then configure your webserver's virtual hosts manually, testing each one as you go.</div><div>This probably isnt part of your assessment, but in the future consider using a configuration management tool, at work we use Ansible. Its a time saver and helps me quickly test why my F%#$ing configs dont work.</div><div>Configure verbose error logging during development and read the logs.</div><div>Changing from one tool to another because you haven't put in the hard graft of learning how a tool functions and integrates into other systems is not a growth mindset. Take the time to learn, <b>read the documentation.</b></div><div>Dont trust automagic configuration tools (aka Lets encrypt) to do the work for you. If you don't understand what its doing then take the time to learn, when it fails, and it will, it wont automatically fix it for you.</div><div><br></div><div>I cannot stress this enough: <b>read the documentation.</b></div><div><b><br></b></div><div>Kind regards,</div><div><br></div><div>Warren</div><div><br></div><div><br></div><div>-----Original Message-----</div><div><b>From</b>: Chris Caston <<a href="mailto:Chris%20Caston%20%3cchris@caston.id.au%3e">chris@caston.id.au</a>></div><div><b>To</b>: <a href="mailto:plug@plug.org.au">plug@plug.org.au</a></div><div><b>Subject</b>: Re: [plug] Help with nginx configuration file</div><div><b>Date</b>: Sun, 23 Aug 2020 12:11:38 +0800</div><div><br></div><!-- text/html --><div dir="ltr"><div>I am starting to think that I should start again from scratch (wiser this time) and use ldap-account manager.<br></div><div><a href="https://www.ldap-account-manager.org/static/doc/manual/apbs08.html">https://www.ldap-account-manager.org/static/doc/manual/apbs08.html</a></div><div><br></div><div>which should I do first?<br></div><br><div> * install openldap and ldap account manager configured for nginx</div><div>OR <br></div><div> * install gitlab</div><div><br></div><div>I could point the www A resource record to another server entirely.<br></div><div><br></div><div>The problem I had with phpldapadmin is that after installing it up gitlab would not install. <br></div><div>I am thinking I be safest to install gitlab then install openldap and ldap account manager and configure for nginx</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Aug 23, 2020 at 11:41 AM Chris Caston <<a href="mailto:chris@caston.id.au">chris@caston.id.au</a>> wrote:<br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div dir="ltr"><div><div>I have set up a basic wireframe for a place-holder site and css, js and images folder under /var/www/html so this comes up instead of the default nginx site.<br><br></div>In case anyone wonders what this is for it's a combination of TAFE and my own projects. It isn't for a client. The gitlab is for Javascript apps. <br><br>Yes I understand I should try to keep things in different servers or at least docker images and I will as the infrastructure grows. <br><br></div><div>Part of the problem is that phpldapadmin uses apache2 but default and I had to look for extra instructions to get it working with nginx. <br></div><div>Is there an alternative graphical interface for openldap that works nicely with nginx?</div><div><br></div><div>best regards,</div><div><br></div><div>Chris<br></div><div><br></div><div><br></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Aug 23, 2020 at 10:43 AM Chris Caston <<a href="mailto:chris@caston.id.au" target="_blank">chris@caston.id.au</a>> wrote:<br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div dir="ltr"><div dir="ltr">I have run<br><code><pre>sudo apt install certbot python3-certbot-nginx</pre><br></code><code><pre>then</pre><br><code><pre>certbot --nginx -d </pre><a href="http://gitlab.themarketplace.space" target="_blank"><pre>gitlab.themarketplace.space</pre></a><br><br><pre>nginx: [error] invalid PID number "" in "/run/nginx.pid"</pre><br></code></code><code><pre>the pid file was empty </pre><br><br></code><code><pre>I rebooted the vps and now I have a healthy pid.</pre><br></code><code><pre>I ran certbot --nginx -d </pre><a href="http://gitlab.themarketplace.space" target="_blank"><pre>gitlab.themarketplace.space</pre></a><pre> again and selected option 1. (reinstall existing certificate)</pre><br></code><code><pre>and then option 2 ( Redirect all requests to https)</pre><br><pre>>" - Congratulations! Your certificate and chain have been saved"</pre><br><br></code><code><pre>going to </pre><a href="http://www.themarketplace.space" target="_blank"><pre>http://www.themarketplace.space</pre></a><pre> takes me to </pre><a href="https://gitlab.themarketplace.space" target="_blank"><pre>https://gitlab.themarketplace.space</pre></a><pre> which only shows the default nginx page.</pre><br><br></code><code><pre>I have now done:</pre><br></code><code><br><pre>certbot --nginx -d </pre><a href="http://gitlab.themarketplace.space" target="_blank"><pre>gitlab.themarketplace.space</pre></a><pre> -d </pre><a href="http://www.themarketplace.space" target="_blank"><pre>www.themarketplace.space</pre></a><pre> -d </pre><a href="http://ldap.themarketplace.space" target="_blank"><pre>ldap.themarketplace.space</pre></a></code><code><pre>then I did option E (expand and replace existing certificate)</pre><br></code><code><pre>then option 2 (redirect to HTTPS)</pre><br><br></code><code><pre>Now </pre><a href="http://ldap.themarketplace.space/" target="_blank"><pre>http://ldap.themarketplace.space/</pre></a><pre> seems to hold it's own and go to </pre><a href="https://ldap.themarketplace.space/" target="_blank"><pre>https://ldap.themarketplace.space/</pre></a><br></code><code><pre>but </pre><a href="http://www.themarketplace.space/" target="_blank"><pre>http://www.themarketplace.space/</pre></a><pre> goes to </pre><a href="https://gitlab.themarketplace.space/" target="_blank"><pre>https://gitlab.themarketplace.space/</pre></a><br><br></code><code><pre>Is there some way to fix this or should I just start again in a different order?</pre><br><pre>>"This file will automatically load configuration files provided by other</pre><br><pre># applications, such as Drupal or Wordpress. These applications will be made</pre><br><pre># available underneath a path with that package name, such as /drupal8."</pre><br><br></code><br><code><pre>Is this salvageable or should I start again with a clean Ubuntu install?</pre><br></code><code><br><br></code><code><pre>```</pre><br><pre>cat /etc/nginx/sites-available/default</pre><br><pre>##</pre><br><pre># You should look at the following URL's in order to grasp a solid understanding</pre><br><pre># of Nginx configuration files in order to fully unleash the power of Nginx.</pre><br><pre># </pre><a href="https://www.nginx.com/resources/wiki/start/" target="_blank"><pre>https://www.nginx.com/resources/wiki/start/</pre></a><br><pre># </pre><a href="https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/" target="_blank"><pre>https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/</pre></a><br><pre># </pre><a href="https://wiki.debian.org/Nginx/DirectoryStructure" target="_blank"><pre>https://wiki.debian.org/Nginx/DirectoryStructure</pre></a><br><pre>#</pre><br><pre># In most cases, administrators will remove this file from sites-enabled/ and</pre><br><pre># leave it as reference inside of sites-available where it will continue to be</pre><br><pre># updated by the nginx packaging team.</pre><br><pre>#</pre><br><pre># This file will automatically load configuration files provided by other</pre><br><pre># applications, such as Drupal or Wordpress. These applications will be made</pre><br><pre># available underneath a path with that package name, such as /drupal8.</pre><br><pre>#</pre><br><pre># Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.</pre><br><pre>##</pre><br><br><pre># Default server configuration</pre><br><pre>#</pre><br><pre>server {</pre><br><pre> listen 80 default_server;</pre><br><pre> listen [::]:80 default_server;</pre><br><br><pre> # SSL configuration</pre><br><pre> #</pre><br><pre> # listen 443 ssl default_server;</pre><br><pre> # listen [::]:443 ssl default_server;</pre><br><pre> #</pre><br><pre> # Note: You should disable gzip for SSL traffic.</pre><br><pre> # See: </pre><a href="https://bugs.debian.org/773332" target="_blank"><pre>https://bugs.debian.org/773332</pre></a><br><pre> #</pre><br><pre> # Read up on ssl_ciphers to ensure a secure configuration.</pre><br><pre> # See: </pre><a href="https://bugs.debian.org/765782" target="_blank"><pre>https://bugs.debian.org/765782</pre></a><br><pre> #</pre><br><pre> # Self signed certs generated by the ssl-cert package</pre><br><pre> # Don't use them in a production server!</pre><br><pre> #</pre><br><pre> # include snippets/snakeoil.conf;</pre><br><br><pre> root /var/www/html;</pre><br><br><pre> # Add index.php to the list if you are using PHP</pre><br><pre> index index.html index.htm index.nginx-debian.html;</pre><br><br><pre> server_name _;</pre><br><br><pre> location / {</pre><br><pre> # First attempt to serve request as file, then</pre><br><pre> # as directory, then fall back to displaying a 404.</pre><br><pre> try_files $uri $uri/ =404;</pre><br><pre> }</pre><br><br><pre> # pass PHP scripts to FastCGI server</pre><br><pre> #</pre><br><pre> #location ~ \.php$ {</pre><br><pre> # include snippets/fastcgi-php.conf;</pre><br><pre> #</pre><br><pre> # # With php-fpm (or other unix sockets):</pre><br><pre> # fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;</pre><br><pre> # # With php-cgi (or other tcp sockets):</pre><br><pre> # fastcgi_pass </pre><a href="http://127.0.0.1:9000" target="_blank"><pre>127.0.0.1:9000</pre></a><pre>;</pre><br><pre> #}</pre><br><br><pre> # deny access to .htaccess files, if Apache's document root</pre><br><pre> # concurs with nginx's one</pre><br><pre> #</pre><br><pre> #location ~ /\.ht {</pre><br><pre> # deny all;</pre><br><pre> #}</pre><br><pre>}</pre><br><br><br><pre># Virtual Host configuration for </pre><a href="http://example.com" target="_blank"><pre>example.com</pre></a><br><pre>#</pre><br><pre># You can move that to a different file under sites-available/ and symlink that</pre><br><pre># to sites-enabled/ to enable it.</pre><br><pre>#</pre><br><pre>#server {</pre><br><pre># listen 80;</pre><br><pre># listen [::]:80;</pre><br><pre>#</pre><br><pre># server_name </pre><a href="http://example.com" target="_blank"><pre>example.com</pre></a><pre>;</pre><br><pre>#</pre><br><pre># root /var/www/</pre><a href="http://example.com" target="_blank"><pre>example.com</pre></a><pre>;</pre><br><pre># index index.html;</pre><br><pre>#</pre><br><pre># location / {</pre><br><pre># try_files $uri $uri/ =404;</pre><br><pre># }</pre><br><pre>#}</pre><br><br><pre>server {</pre><br><br><pre> # SSL configuration</pre><br><pre> #</pre><br><pre> # listen 443 ssl default_server;</pre><br><pre> # listen [::]:443 ssl default_server;</pre><br><pre> #</pre><br><pre> # Note: You should disable gzip for SSL traffic.</pre><br><pre> # See: </pre><a href="https://bugs.debian.org/773332" target="_blank"><pre>https://bugs.debian.org/773332</pre></a><br><pre> #</pre><br><pre> # Read up on ssl_ciphers to ensure a secure configuration.</pre><br><pre> # See: </pre><a href="https://bugs.debian.org/765782" target="_blank"><pre>https://bugs.debian.org/765782</pre></a><br><pre> #</pre><br><pre> # Self signed certs generated by the ssl-cert package</pre><br><pre> # Don't use them in a production server!</pre><br><pre> #</pre><br><pre> # include snippets/snakeoil.conf;</pre><br><br><pre> root /var/www/html;</pre><br><br><pre> # Add index.php to the list if you are using PHP</pre><br><pre> index index.html index.htm index.nginx-debian.html;</pre><br><pre> server_name </pre><a href="http://gitlab.themarketplace.space" target="_blank"><pre>gitlab.themarketplace.space</pre></a><pre>; # managed by Certbot</pre><br><br><br><pre> location / {</pre><br><pre> # First attempt to serve request as file, then</pre><br><pre> # as directory, then fall back to displaying a 404.</pre><br><pre> try_files $uri $uri/ =404;</pre><br><pre> }</pre><br><br><pre> # pass PHP scripts to FastCGI server</pre><br><pre> #</pre><br><pre> #location ~ \.php$ {</pre><br><pre> # include snippets/fastcgi-php.conf;</pre><br><pre> #</pre><br><pre> # # With php-fpm (or other unix sockets):</pre><br><pre> # fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;</pre><br><pre> # # With php-cgi (or other tcp sockets):</pre><br><pre> # fastcgi_pass </pre><a href="http://127.0.0.1:9000" target="_blank"><pre>127.0.0.1:9000</pre></a><pre>;</pre><br><pre> #}</pre><br><br><pre> # deny access to .htaccess files, if Apache's document root</pre><br><pre> # concurs with nginx's one</pre><br><pre> #</pre><br><pre> #location ~ /\.ht {</pre><br><pre> # deny all;</pre><br><pre> #}</pre><br><br><br><pre> listen [::]:443 ssl ipv6only=on; # managed by Certbot</pre><br><pre> listen 443 ssl; # managed by Certbot</pre><br><pre> ssl_certificate /etc/letsencrypt/live/</pre><a href="http://www.themarketplace.space/fullchain.pem" target="_blank"><pre>www.themarketplace.space/fullchain.pem</pre></a><pre>; # managed by Certbot</pre><br><pre> ssl_certificate_key /etc/letsencrypt/live/</pre><a href="http://www.themarketplace.space/privkey.pem" target="_blank"><pre>www.themarketplace.space/privkey.pem</pre></a><pre>; # managed by Certbot</pre><br><pre> include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot</pre><br><pre> ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot</pre><br><br><br><pre>}</pre><br><pre>server {</pre><br><pre> if ($host = </pre><a href="http://gitlab.themarketplace.space" target="_blank"><pre>gitlab.themarketplace.space</pre></a><pre>) {</pre><br><pre> return 301 https://$host$request_uri;</pre><br><pre> } # managed by Certbot</pre><br><br><br><pre> listen 80 ;</pre><br><pre> listen [::]:80 ;</pre><br><pre> server_name </pre><a href="http://gitlab.themarketplace.space" target="_blank"><pre>gitlab.themarketplace.space</pre></a><pre>;</pre><br><pre> return 404; # managed by Certbot</pre><br><br><br><pre>}</pre><br><pre>server {</pre><br><br><pre> # SSL configuration</pre><br><pre> #</pre><br><pre> # listen 443 ssl default_server;</pre><br><pre> # listen [::]:443 ssl default_server;</pre><br><pre> #</pre><br><pre> # Note: You should disable gzip for SSL traffic.</pre><br><pre> # See: </pre><a href="https://bugs.debian.org/773332" target="_blank"><pre>https://bugs.debian.org/773332</pre></a><br><pre> #</pre><br><pre> # Read up on ssl_ciphers to ensure a secure configuration.</pre><br><pre> # See: </pre><a href="https://bugs.debian.org/765782" target="_blank"><pre>https://bugs.debian.org/765782</pre></a><br><pre> #</pre><br><pre> # Self signed certs generated by the ssl-cert package</pre><br><pre> # Don't use them in a production server!</pre><br><pre> #</pre><br><pre> # include snippets/snakeoil.conf;</pre><br><br><pre> root /var/www/html;</pre><br><br><pre> # Add index.php to the list if you are using PHP</pre><br><pre> index index.html index.htm index.nginx-debian.html;</pre><br><pre> server_name </pre><a href="http://ldap.themarketplace.space" target="_blank"><pre>ldap.themarketplace.space</pre></a><pre> </pre><a href="http://www.themarketplace.space" target="_blank"><pre>www.themarketplace.space</pre></a><pre>; # managed by Certbot</pre><br><br><br><pre> location / {</pre><br><pre> # First attempt to serve request as file, then</pre><br><pre> # as directory, then fall back to displaying a 404.</pre><br><pre> try_files $uri $uri/ =404;</pre><br><pre> }</pre><br><br><pre> # pass PHP scripts to FastCGI server</pre><br><pre> #</pre><br><pre> #location ~ \.php$ {</pre><br><pre> # include snippets/fastcgi-php.conf;</pre><br><pre> #</pre><br><pre> # # With php-fpm (or other unix sockets):</pre><br><pre> # fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;</pre><br><pre> # # With php-cgi (or other tcp sockets):</pre><br><pre> # fastcgi_pass </pre><a href="http://127.0.0.1:9000" target="_blank"><pre>127.0.0.1:9000</pre></a><pre>;</pre><br><pre> #}</pre><br><br><pre> # deny access to .htaccess files, if Apache's document root</pre><br><pre> # concurs with nginx's one</pre><br><pre> #</pre><br><pre> #location ~ /\.ht {</pre><br><pre> # deny all;</pre><br><pre> #}</pre><br><br><br><pre> listen [::]:443 ssl; # managed by Certbot</pre><br><pre> listen 443 ssl; # managed by Certbot</pre><br><pre> ssl_certificate /etc/letsencrypt/live/</pre><a href="http://www.themarketplace.space/fullchain.pem" target="_blank"><pre>www.themarketplace.space/fullchain.pem</pre></a><pre>; # managed by Certbot</pre><br><pre> ssl_certificate_key /etc/letsencrypt/live/</pre><a href="http://www.themarketplace.space/privkey.pem" target="_blank"><pre>www.themarketplace.space/privkey.pem</pre></a><pre>; # managed by Certbot</pre><br><pre> include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot</pre><br><pre> ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot</pre><br><br><br><br><pre>}</pre><br><pre>server {</pre><br><pre> if ($host = </pre><a href="http://ldap.themarketplace.space" target="_blank"><pre>ldap.themarketplace.space</pre></a><pre>) {</pre><br><pre> return 301 https://$host$request_uri;</pre><br><pre> } # managed by Certbot</pre><br><br><br><pre> if ($host = </pre><a href="http://www.themarketplace.space" target="_blank"><pre>www.themarketplace.space</pre></a><pre>) {</pre><br><pre> return 301 https://$host$request_uri;</pre><br><pre> } # managed by Certbot</pre><br><br><br><pre> listen 80 ;</pre><br><pre> listen [::]:80 ;</pre><br><pre> server_name </pre><a href="http://ldap.themarketplace.space" target="_blank"><pre>ldap.themarketplace.space</pre></a><pre> </pre><a href="http://www.themarketplace.space" target="_blank"><pre>www.themarketplace.space</pre></a><pre>;</pre><br><pre> return 404; # managed by Certbot</pre><br><pre>```</pre><br></code></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Aug 23, 2020 at 10:03 AM Chris Caston <<a href="mailto:chris@caston.id.au" target="_blank">chris@caston.id.au</a>> wrote:<br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div dir="ltr"><div><br></div><div>I made a backup of the nginx etc folder.</div><div><br></div><div>After I did the following gitlab completed the install:<br></div><div><br></div><div><code><pre>sudo apt-get purge nginx nginx-common nginx-full</pre><br></code><code><pre>and</pre><br><code><pre>sudo apt-get install nginx</pre><br><br></code></code><code><code><pre>going to </pre><a href="http://www.themarketplace.space" target="_blank"><pre>http://www.themarketplace.space</pre></a><pre> takes me to:</pre><br><br><a href="https://gitlab.themarketplace.space/" target="_blank"><pre>https://gitlab.themarketplace.space/</pre></a><br></code></code><code><code><pre>with a set password screen. The first time I did this it didn't work and I had to set the password through a command line console.</pre><br><br></code></code><code><code><pre>also going to </pre><a href="https://ldap.themarketplace.space/phpldapadmin/" target="_blank"><pre>https://ldap.themarketplace.space/phpldapadmin/</pre></a><pre> takes me back to gitlab so as predicted my phpldapadmin setup is broken.</pre><br><br></code></code><code><code><pre>I should mention I am getting the invalid (self-signed cert) warnings through all of this. I am looking at the sites-available default site and to</pre><br><pre>be honest I don't even know it has been configured for gitlab. /var/www/html still contains: index.nginx-debian.html</pre><br><br></code></code><code><code><pre>What am I missing?</pre><br></code></code><code><code><br><pre>Here is the nginx configuration:</pre><br><br><pre>```</pre><br><pre>cat /etc/nginx/sites-available/default</pre><br><pre>##</pre><br><pre># You should look at the following URL's in order to grasp a solid understanding</pre><br><pre># of Nginx configuration files in order to fully unleash the power of Nginx.</pre><br><pre># </pre><a href="https://www.nginx.com/resources/wiki/start/" target="_blank"><pre>https://www.nginx.com/resources/wiki/start/</pre></a><br><pre># </pre><a href="https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/" target="_blank"><pre>https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/</pre></a><br><pre># </pre><a href="https://wiki.debian.org/Nginx/DirectoryStructure" target="_blank"><pre>https://wiki.debian.org/Nginx/DirectoryStructure</pre></a><br><pre>#</pre><br><pre># In most cases, administrators will remove this file from sites-enabled/ and</pre><br><pre># leave it as reference inside of sites-available where it will continue to be</pre><br><pre># updated by the nginx packaging team.</pre><br><pre>#</pre><br><pre># This file will automatically load configuration files provided by other</pre><br><pre># applications, such as Drupal or Wordpress. These applications will be made</pre><br><pre># available underneath a path with that package name, such as /drupal8.</pre><br><pre>#</pre><br><pre># Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.</pre><br><pre>##</pre><br><br><pre># Default server configuration</pre><br><pre>#</pre><br><pre>server {</pre><br><pre> listen 80 default_server;</pre><br><pre> listen [::]:80 default_server;</pre><br><br><pre> # SSL configuration</pre><br><pre> #</pre><br><pre> # listen 443 ssl default_server;</pre><br><pre> # listen [::]:443 ssl default_server;</pre><br><pre> #</pre><br><pre> # Note: You should disable gzip for SSL traffic.</pre><br><pre> # See: </pre><a href="https://bugs.debian.org/773332" target="_blank"><pre>https://bugs.debian.org/773332</pre></a><br><pre> #</pre><br><pre> # Read up on ssl_ciphers to ensure a secure configuration.</pre><br><pre> # See: </pre><a href="https://bugs.debian.org/765782" target="_blank"><pre>https://bugs.debian.org/765782</pre></a><br><pre> #</pre><br><pre> # Self signed certs generated by the ssl-cert package</pre><br><pre> # Don't use them in a production server!</pre><br><pre> #</pre><br><pre> # include snippets/snakeoil.conf;</pre><br><br><pre> root /var/www/html;</pre><br><br><pre> # Add index.php to the list if you are using PHP</pre><br><pre> index index.html index.htm index.nginx-debian.html;</pre><br><br><pre> server_name _;</pre><br><br><pre> location / {</pre><br><pre> # First attempt to serve request as file, then</pre><br><pre> # as directory, then fall back to displaying a 404.</pre><br><pre> try_files $uri $uri/ =404;</pre><br><pre> }</pre><br><br><pre> # pass PHP scripts to FastCGI server</pre><br><pre> #</pre><br><pre> #location ~ \.php$ {</pre><br><pre> # include snippets/fastcgi-php.conf;</pre><br><pre> #</pre><br><pre> # # With php-fpm (or other unix sockets):</pre><br><pre> # fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;</pre><br><pre> # # With php-cgi (or other tcp sockets):</pre><br><pre> # fastcgi_pass </pre><a href="http://127.0.0.1:9000" target="_blank"><pre>127.0.0.1:9000</pre></a><pre>;</pre><br><pre> #}</pre><br><br><pre> # deny access to .htaccess files, if Apache's document root</pre><br><pre> # concurs with nginx's one</pre><br><pre> #</pre><br><pre> #location ~ /\.ht {</pre><br><pre> # deny all;</pre><br><pre> #}</pre><br><pre>}</pre><br><br><br><pre># Virtual Host configuration for </pre><a href="http://example.com" target="_blank"><pre>example.com</pre></a><br><pre>#</pre><br><pre># You can move that to a different file under sites-available/ and symlink that</pre><br><pre># to sites-enabled/ to enable it.</pre><br><pre>#</pre><br><pre>#server {</pre><br><pre># listen 80;</pre><br><pre># listen [::]:80;</pre><br><pre>#</pre><br><pre># server_name </pre><a href="http://example.com" target="_blank"><pre>example.com</pre></a><pre>;</pre><br><pre>#</pre><br><pre># root /var/www/</pre><a href="http://example.com" target="_blank"><pre>example.com</pre></a><pre>;</pre><br><pre># index index.html;</pre><br><pre>#</pre><br><pre># location / {</pre><br><pre># try_files $uri $uri/ =404;</pre><br><pre># }</pre><br><pre>#}</pre><br><pre>```</pre><br><br><br></code></code><code><code><br></code></code></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Aug 23, 2020 at 9:16 AM Chris Caston <<a href="mailto:chris@caston.id.au" target="_blank">chris@caston.id.au</a>> wrote:<br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div dir="ltr"><div>I am making a snapshot of the place my VPS it at now with the broken gitlab install.</div><div>I am considering going back to a default gninx configuration and setting up gitlab again. I had it working on a previous build before I decided to start again and openldap for auth. Even though it will break the phpLDAPadmin setup I can compare the /etc/nginx/sites-available/default files to work out how to make a hybrid.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Aug 22, 2020 at 4:06 PM Chris Caston <<a href="mailto:chris@caston.id.au" target="_blank">chris@caston.id.au</a>> wrote:<br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div dir="ltr"><div><div>Hi everyone,</div><div><br></div>I have installed Ubuntu 20.04 with openldap, nginx and phpLDAPadmin with SSL and basic http auth. This part is working fine but next I want to install gitlab. <br><div><br></div><div>It errors out with:</div><div><br></div><div>```</div><div>There was an error running gitlab-ctl reconfigure:<br><br>letsencrypt_certificate[<a href="http://gitlab.themarketplace.space" target="_blank">gitlab.themarketplace.space</a>]</div><div>``` *snipped*<br></div><div><br></div>I'm a bit uncertain as to how my nginx configuration should be set.<br><br>```<br>sudo nginx -t<br>nginx: the configuration file /etc/nginx/nginx.conf syntax is ok<br>nginx: configuration file /etc/nginx/nginx.conf test is successful``````<br>certbot --nginx -d <a href="http://gitlab.themarketplace.space" target="_blank">gitlab.themarketplace.space</a><br><br>IMPORTANT NOTES:<br> - Unable to install the certificate<br> - Congratulations! Your certificate and chain have been saved at:<br> /etc/letsencrypt/live/<a href="http://gitlab.themarketplace.space/fullchain.pem" target="_blank">gitlab.themarketplace.space/fullchain.pem</a><br> Your key file has been saved at:<br> /etc/letsencrypt/live/<a href="http://gitlab.themarketplace.space/privkey.pem" target="_blank">gitlab.themarketplace.space/privkey.pem</a><br> Your cert will expire on 2020-11-20. To obtain a new or tweaked<br> version of this certificate in the future, simply run certbot again<br> with the "certonly" option. To non-interactively renew *all* of<br> your certificates, run "certbot renew"<br>```<br>I assume that I need to get that working for gitlab will install.<br><br><br><br>```<br>cat /etc/nginx/sites-available/default<br>server {<br>server_name <a href="http://ldap.themarketplace.space" target="_blank">ldap.themarketplace.space</a>;<br><br># document root<br>root /var/www/html;<br>index index.php index.html index.htm;<br><br># application: phpldapadmin<br>location /phpldapadmin {<br>auth_basic "Please authenticate:";<br>auth_basic_user_file /etc/apache2/htpasswd;<br>alias /usr/share/phpldapadmin/htdocs;<br>index index.php index.html index.htm;<br>}<br><br><br><br><br>location ~ ^/phpldapadmin/.*\.php$ {<br>root /usr/share;<br>if ($request_filename !~* htdocs) {<br>rewrite ^/phpldapadmin(/.*)?$ /phpldapadmin/htdocs$1;<br>}<br>fastcgi_pass unix:/run/php/php7.4-fpm.sock;<br>fastcgi_index index.php;<br>fastcgi_param SCRIPT_FILENAME $request_filename;<br>include fastcgi_params;<br>}<br><br># logging<br>error_log /var/log/nginx/phpldapadmin.error.log;<br>access_log /var/log/nginx/phpldapadmin.access.log;<br><br> listen 443 ssl; # managed by Certbot<br> ssl_certificate /etc/letsencrypt/live/<a href="http://ldap.themarketplace.space/fullchain.pem" target="_blank">ldap.themarketplace.space/fullchain.pem</a>; # managed by Certbot<br> ssl_certificate_key /etc/letsencrypt/live/<a href="http://ldap.themarketplace.space/privkey.pem" target="_blank">ldap.themarketplace.space/privkey.pem</a>; # managed by Certbot<br> include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot<br> ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot<br><br>}<br>server {<br> if ($host = <a href="http://ldap.themarketplace.space" target="_blank">ldap.themarketplace.space</a>) {<br> return 301 https://$host$request_uri;<br> } # managed by Certbot<br><br><br>server_name <a href="http://ldap.themarketplace.space" target="_blank">ldap.themarketplace.space</a>;<br>listen 80;<br> return 404; # managed by Certbot<br><br>}```<br>I have four A resource records:</div><div>```<br><a href="http://themarketplace.space" target="_blank">themarketplace.space</a> A 139.180.171.63<br><a href="http://gitlab.themarketplace.space" target="_blank">gitlab.themarketplace.space</a> A 139.180.171.63<br><a href="http://ldap.themarketplace.space" target="_blank">ldap.themarketplace.space</a> A 139.180.171.63<br><a href="http://www.themarketplace.space" target="_blank">www.themarketplace.space</a> A 139.180.171.63</div><div>```<br></div><div>So I'm not sure if my /etc/nginx/sites-available/default should have multiple server blocks each with it's own server_name and exactly what format it needs to be in for gitlab to work.</div><div><br></div><div>Any help would be much appreciated.</div><div><br></div><div>Thank you.</div><div><br></div><div>Chris Caston<br></div></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
<pre>_______________________________________________</pre><pre>PLUG discussion list: </pre><a href="mailto:plug@plug.org.au"><pre>plug@plug.org.au</pre></a><pre><br></pre><a href="http://lists.plug.org.au/mailman/listinfo/plug"><pre>http://lists.plug.org.au/mailman/listinfo/plug</pre></a><pre><br></pre><pre>Committee e-mail: </pre><a href="mailto:committee@plug.org.au"><pre>committee@plug.org.au</pre></a><pre><br></pre><pre>PLUG Membership: </pre><a href="http://www.plug.org.au/membership"><pre>http://www.plug.org.au/membership</pre></a></body></html>