maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

Add multistack configuration for nginx, fixes #584

Browse Source
This commit is contained in:
Tilman Klaeger (tilman19)
2012-12-02 15:15:04 +01:00
committed by Michael Kaufmann (d00p)
parent a5048007de
commit af899c290f
1 changed files with 120 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

185
scripts/jobs/cron_tasks.inc.http.30.nginx.php
View File

@@ -182,7 +182,6 @@ class nginx
$this->nginx_data[$vhost_filename] .= "\t".'# Froxlor default vhost' . "\n";
$this->nginx_data[$vhost_filename] .= "\t".'server_name ' . $this->settings['system']['hostname'] . ';' . "\n";
$this->nginx_data[$vhost_filename] .= "\t".'access_log /var/log/nginx/access.log;' . "\n";
$mypath = '';
@@ -214,15 +213,7 @@ class nginx
* SSL config options
*/
if ($row_ipsandports['ssl'] == '1') {
if ($row_ipsandports['ssl_cert_file'] != '') {
$this->nginx_data[$vhost_filename] .= "\t" . 'ssl_certificate ' . makeCorrectFile($row_ipsandports['ssl_cert_file']) . ';' . "\n";
}
if ($row_ipsandports['ssl_key_file'] != '') {
$this->nginx_data[$vhost_filename] .= "\t" . 'ssl_certificate_key ' .makeCorrectFile($row_ipsandports['ssl_key_file']) . ';' . "\n";
}
if ($row_ipsandports['ssl_ca_file'] != '') {
$this->nginx_data[$vhost_filename] .= 'ssl_client_certificate ' . makeCorrectFile($row_ipsandports['ssl_ca_file']) . ';' . "\n";
}
$this->nginx_data[$vhost_filename].=$this->composeSslSettings($row_ipsandports);
}
$this->nginx_data[$vhost_filename] .= "\t".'location ~ \.php$ {'."\n";
@@ -263,27 +254,41 @@ class nginx
$this->createNginxHosts($row_ipsandports['ip'], $row_ipsandports['port'], $row_ipsandports['ssl'], $vhost_filename);
}
$this->createNginxHosts();
/**
* standard error pages
*/
$this->_createStandardErrorHandler();
}
protected function createNginxHosts($ip, $port, $ssl, $vhost_filename)
protected function createNginxHosts()
{
$query = "SELECT * FROM " . TABLE_PANEL_IPSANDPORTS . " WHERE `ip` = '" . $ip . "' AND `port` = '" . $port . "'";
$ipandport = $this->db->query_first($query);
$query = "SELECT `d`.*, `pd`.`domain` AS `parentdomain`, `c`.`loginname`,
`d`.`phpsettingid`, `c`.`adminid`, `c`.`guid`, `c`.`email`,
`c`.`documentroot` AS `customerroot`, `c`.`deactivated`,
`c`.`phpenabled` AS `phpenabled`, `d`.`mod_fcgid_starter`,
`d`.`mod_fcgid_maxrequests`, `p`.`ssl` AS `ssl`,
`p`.`ssl_cert_file`, `p`.`ssl_key_file`, `p`.`ssl_ca_file`, `p`.`ssl_cert_chainfile`
FROM `".TABLE_PANEL_DOMAINS."` `d`
$query2 = "SELECT `d`.*, `pd`.`domain` AS `parentdomain`, `c`.`loginname`, `c`.`guid`, `c`.`email`, `c`.`documentroot` AS `customerroot`, `c`.`deactivated`, `c`.`phpenabled` AS `phpenabled` FROM `" . TABLE_PANEL_DOMAINS . "` `d` LEFT JOIN `" . TABLE_PANEL_CUSTOMERS . "` `c` USING(`customerid`) LEFT JOIN `" . TABLE_PANEL_DOMAINS . "` `pd` ON (`pd`.`id` = `d`.`parentdomainid`) ";
if ($ssl == '0') {
$query2 .= "WHERE `d`.`ipandport` = '" . $ipandport['id'] . "' ";
} else {
$query2 .= "WHERE `d`.`ssl_ipandport` = '" . $ipandport['id'] . "' ";
}
$query2 .= "AND `d`.`aliasdomain` IS NULL AND `d`.`email_only` <> 1 ORDER BY `d`.`iswildcarddomain`, `d`.`domain` ASC";
LEFT JOIN `".TABLE_PANEL_CUSTOMERS."` `c` USING(`customerid`)
LEFT JOIN `".TABLE_PANEL_DOMAINS."` `pd` ON (`pd`.`id` = `d`.`parentdomainid`)
$included_vhosts = array();
$result_domains = $this->db->query($query2);
INNER JOIN (
SELECT * FROM (
SELECT `di`.`id_domain` , `p`.`ssl`, `p`.`ssl_cert_file`, `p`.`ssl_key_file`, `p`.`ssl_ca_file`, `p`.`ssl_cert_chainfile`
FROM `".TABLE_DOMAINTOIP."` `di` , `".TABLE_PANEL_IPSANDPORTS."` `p`
WHERE `p`.`id` = `di`.`id_ipandports`
ORDER BY `p`.`ssl` DESC
) AS my_table_tmp
GROUP BY `id_domain`
) AS p ON p.`id_domain` = `d`.`id`
WHERE `d`.`aliasdomain` IS NULL
ORDER BY `d`.`parentdomainid` DESC, `d`.`iswildcarddomain`, `d`.`domain` ASC;";
$result_domains = $this->db->query($query);
while ($domain = $this->db->fetch_array($result_domains)) {
if (is_dir($this->settings['system']['apacheconf_vhost'])) {
safe_exec('mkdir -p '.escapeshellarg(makeCorrectDir($this->settings['system']['apacheconf_vhost'])));
@@ -294,25 +299,20 @@ class nginx
$this->nginx_data[$vhost_filename] = '';
}
$query = "SELECT * FROM " . TABLE_PANEL_IPSANDPORTS . " WHERE `id`='" . $domain['ipandport'] . "'";
$ipandport = $this->db->query_first($query);
$domain['ip'] = $ipandport['ip'];
$domain['port'] = $ipandport['port'];
$domain['ssl_cert_file'] = $ipandport['ssl_cert_file'];
if ((!empty($this->nginx_data[$vhost_filename]) && !is_dir($this->settings['system']['apacheconf_vhost']))
|| is_dir($this->settings['system']['apacheconf_vhost'])
if ((!empty($this->nginx_data[$vhost_filename])
&& !is_dir($this->settings['system']['apacheconf_vhost']))
|| is_dir($this->settings['system']['apacheconf_vhost'])
) {
if ($ssl == '1') {
$ssl_vhost = true;
$ips_and_ports_index = 'ssl_ipandport';
} else {
$ssl_vhost = false;
$ips_and_ports_index = 'ipandport';
// Create non-ssl host
$this->nginx_data[$vhost_filename].= $this->getVhostContent($domain, false);
if ($domain['ssl'] == '1' || $domain['ssl_redirect'] == '1') {
$vhost_filename_ssl = $this->getVhostFilename($domain, true);
if (!isset($this->nginx_data[$vhost_filename_ssl])) {
$this->nginx_data[$vhost_filename_ssl] = '';
}
// Now enable ssl stuff
$this->nginx_data[$vhost_filename_ssl] .= $this->getVhostContent($domain, true);
}
$this->nginx_data[$vhost_filename].= $this->getVhostContent($domain, $ssl_vhost);
$this->nginx_data[$vhost_filename].= isset($this->needed_htpasswds[$domain[$ips_and_ports_index]]) ? $this->needed_htpasswds[$domain[$ips_and_ports_index]] . "\n" : '';
}
}
}
@@ -347,35 +347,44 @@ class nginx
{
if ($ssl_vhost === true
&& $domain['ssl'] != '1'
&& $domain['ssl_redirect'] != '1'
) {
return '';
}
if ($ssl_vhost === true
&& $domain['ssl'] == '1'
) {
$query = "SELECT * FROM " . TABLE_PANEL_IPSANDPORTS . " WHERE `id`='" . $domain['ssl_ipandport'] . "'";
} else {
$query = "SELECT * FROM " . TABLE_PANEL_IPSANDPORTS . " WHERE `id`='" . $domain['ipandport'] . "'";
}
$ipandport = $this->db->query_first($query);
$domain['ip'] = $ipandport['ip'];
$domain['port'] = $ipandport['port'];
$domain['ssl_cert_file'] = $ipandport['ssl_cert_file'];
if (filter_var($domain['ip'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
$ipport = '[' . $domain['ip'] . ']:' . $domain['port'];
} else {
$ipport = $domain['ip'] . ':' . $domain['port'];
}
$vhost_content = '';
$vhost_content.= 'server { ' . "\n";
// open vhost-container
$vhost_content .= 'server { ' . "\n";
// listening statement (required)
$vhost_content .= "\t" . 'listen ' . $ipport . ($ssl_vhost == true ? ' ssl' : '') . ';' . "\n";
$query = "SELECT * FROM `".TABLE_PANEL_IPSANDPORTS."` `i`, `".TABLE_DOMAINTOIP."` `dip` WHERE dip.id_domain = '$domain[id]' AND i.id = dip.id_ipandports ";
if ($ssl_vhost === true
&& ($domain['ssl'] == '1' || $domain['ssl_redirect'] == '1')
) {
// by ordering by cert-file the row with filled out SSL-Fields will be shown last,
// thus it is enough to fill out 1 set of SSL-Fields
$query .= "AND i.ssl = 1 ORDER BY i.ssl_cert_file ASC;";
} else {
$query .= "AND i.ssl = '0';";
}
$result = $this->db->query($query);
while ($ipandport = $this->db->fetch_array($result)) {
$domain['ip'] = $ipandport['ip'];
$domain['port'] = $ipandport['port'];
if (filter_var($domain['ip'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
$ipport = '[' . $domain['ip'] . ']:' . $domain['port'];
} else {
$ipport = $domain['ip'] . ':' . $domain['port'];
}
$vhost_content.= "\t" . 'listen ' . $ipport . ($ssl_vhost == true ? ' ssl' : '') . ';' . "\n";
}
$domain['ssl_cert_file'] = $ipandport['ssl_cert_file']; // save latest delivered ssl settings
$domain['ssl_key_file'] = $ipandport['ssl_key_file'];
$domain['ssl_ca_file'] = $ipandport['ssl_ca_file'];
// #418
$domain['ssl_cert_chainfile'] = $ipandport['ssl_cert_chainfile'];
// get all server-names
$vhost_content .= $this->getServerNames($domain);
@@ -383,8 +392,8 @@ class nginx
// respect ssl_redirect settings, #542
if ($ssl_vhost == false
&& $domain['ssl'] == '1'
&& $domain['ssl_redirect'] == '1'
) {
&& $domain['ssl_redirect'] == '1')
{
$domain['documentroot'] = 'https://' . $domain['domain'] . '/';
}
@@ -398,8 +407,17 @@ class nginx
$vhost_content .= $this->getWebroot($domain, $ssl_vhost);
if ($this->_deactivated == false) {
$vhost_content .= $this->create_pathOptions($domain);
$vhost_content .= $this->composePhpOptions($domain, $ssl_vhost);
if ($ssl_vhost === true
&& $domain['ssl'] == '1'
&& $this->settings['system']['use_ssl'] == '1'
) {
$vhost_content.= $this->composeSslSettings($domain);
}
$vhost_content.= $this->create_pathOptions($domain);
$vhost_content.= $this->composePhpOptions($domain, $ssl_vhost);
$vhost_content.= isset($this->needed_htpasswds[$domain['id']]) ? $this->needed_htpasswds[$domain['id']] . "\n" : '';
if ($domain['specialsettings'] != "") {
$vhost_content .= $domain['specialsettings'] . "\n";
@@ -432,6 +450,41 @@ class nginx
return $vhost_content;
}
protected function composeSslSettings($domain) {
$sslsettings = '';
if ($domain['ssl_cert_file'] == '') {
$domain['ssl_cert_file'] = $this->settings['system']['ssl_cert_file'];
}
if ($domain['ssl_key_file'] == '') {
$domain['ssl_key_file'] = $this->settings['system']['ssl_key_file'];
}
if ($domain['ssl_ca_file'] == '') {
$domain['ssl_ca_file'] = $this->settings['system']['ssl_ca_file'];
}
// #418
if ($domain['ssl_cert_chainfile'] == '') {
$domain['ssl_cert_chainfile'] = $this->settings['system']['ssl_cert_chainfile'];
}
if ($domain['ssl_cert_file'] != '') {
// FIXME ssl on now belongs to the listen block as 'ssl' at the end
$sslsettings .= "\t" . 'ssl on;' . "\n";
$sslsettings .= "\t" . 'ssl_certificate ' . makeCorrectFile($domain['ssl_cert_file']) . ';' . "\n";
$sslsettings .= "\t" . 'ssl_certificate_key ' .makeCorrectFile($domain['ssl_key_file']) . ';' . "\n";
if ($domain['ssl_ca_file'] != '') {
$sslsettings.= 'ssl_client_certificate ' . makeCorrectFile($domain['ssl_ca_file']) . ';' . "\n";
}
}
return $sslsettings;
}
protected function create_pathOptions($domain)
{
$has_location = false;