From b5e21daa9801d31bfe6b42757014097e821c5f91 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Wed, 19 Nov 2014 00:55:58 +0000 Subject: [PATCH] enable SPDY by installing nginx 1.6 from the nginx PPA --- conf/nginx-ssl.conf | 2 +- conf/nginx.conf | 2 +- setup/system.sh | 2 ++ setup/web.sh | 19 +++++++++++++++++-- 4 files changed, 21 insertions(+), 4 deletions(-) diff --git a/conf/nginx-ssl.conf b/conf/nginx-ssl.conf index 8d1598cb..2e6d3d59 100644 --- a/conf/nginx-ssl.conf +++ b/conf/nginx-ssl.conf @@ -40,7 +40,7 @@ keepalive_timeout 70; # Buffer size of 1400 bytes fits in one MTU. # nginx 1.5.9+ ONLY -#ssl_buffer_size 1400; +ssl_buffer_size 1400; # SPDY header compression (0 for none, 9 for slow/heavy compression). Preferred is 6. # diff --git a/conf/nginx.conf b/conf/nginx.conf index 241bcebe..69d5467e 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -12,7 +12,7 @@ server { # The secure HTTPS server. server { - listen 443 ssl; + listen 443 ssl spdy; server_name $HOSTNAME; diff --git a/setup/system.sh b/setup/system.sh index 5cbda2e2..20e4abd2 100755 --- a/setup/system.sh +++ b/setup/system.sh @@ -17,11 +17,13 @@ hide_output apt-get -y upgrade # when generating random numbers for private keys (e.g. during # ldns-keygen). # * unattended-upgrades: Apt tool to install security updates automatically. +# * software-properties-common: Provides apt-add-repository. # * ntp: keeps the system time correct # * fail2ban: scans log files for repeated failed login attempts and blocks the remote IP at the firewall apt_install python3 python3-dev python3-pip \ wget curl \ + software-properties-common \ haveged unattended-upgrades ntp fail2ban # Allow apt to install system updates automatically every day. diff --git a/setup/web.sh b/setup/web.sh index ec1ef0ac..752f8705 100755 --- a/setup/web.sh +++ b/setup/web.sh @@ -13,12 +13,27 @@ if [ -f /usr/sbin/apache2 ]; then hide_output apt-get -y --purge autoremove fi +# Ubuntu 14.04 comes with nginx 1.4.6, but we want 1.6.x to have SPDY support +# which is the more modern best practice. We'll get nginx from the nginx PPA. +# An update from stock nginx to the nginx ppa causes trouble, so we'll purge +# first. +if nginx -v 2>&1 | grep 1.4; then + apt-get purge -y nginx +fi + +# Then add the PPA. Test first so we don't have to run apt-get update if the +# PPA was already present. +if [ ! -f /etc/apt/sources.list.d/nginx-stable-trusty.list ]; then + hide_output add-apt-repository -y ppa:nginx/stable + hide_output apt-get update +fi + # Install nginx and a PHP FastCGI daemon. -# -# Turn off nginx's default website. apt_install nginx php5-fpm +# Turn off nginx's default website. + rm -f /etc/nginx/sites-enabled/default # Copy in a nginx configuration file for common and best-practices