@cryptotaxi247 / netdata-1
Code Commits Issues Pulls Sessions CI/CD
master
master
md 180 lines 5.69 KB
Rendered Raw
1 # Running Netdata behind H2O
2
3 [H2O](https://h2o.examp1e.net/) is a new generation HTTP server that provides quicker response to users with less CPU utilization when compared to older generation of web servers.
4
5 It is notable for having much simpler configuration than many popular HTTP servers, low resource requirements, and integrated native support for many things that other HTTP servers may need special setup to use.
6
7 ## Why H2O
8
9 - Sane configuration defaults mean that typical configurations are very minimalistic and easy to work with.
10
11 - Native support for HTTP/2 provides improved performance when accessing the Netdata dashboard remotely.
12
13 - Password protect access to the Netdata dashboard without requiring Netdata Cloud.
14
15 ## H2O configuration file
16
17 On most systems, the H2O configuration is found under `/etc/h2o`. H2O uses [YAML 1.1](https://yaml.org/spec/1.1/), with a few special extensions, for its configuration files, with the main configuration file being `/etc/h2o/h2o.conf`.
18
19 You can edit the H2O configuration file with Nano, Vim or any other text editors with which you’re comfortable.
20
21 After making changes to the configuration files, perform the following:
22
23 - Test the configuration with `h2o -m test -c /etc/h2o/h2o.conf`
24
25 - Restart H2O to apply the changes with `/etc/init.d/h2o restart` or `service h2o restart`
26
27 ## Ways to access Netdata via H2O
28
29 ### As a virtual host
30
31 With this method instead of `SERVER_IP_ADDRESS:19999`, the Netdata dashboard can be accessed via a human-readable URL such as `netdata.example.com` used in the configuration below.
32
33 ```yaml
34 hosts:
35 netdata.example.com:
36 listen:
37 port: 80
38 paths:
39 /:
40 proxy.preserve-host: ON
41 proxy.reverse.url: http://127.0.0.1:19999
42 ```
43
44 ### As a subfolder of an existing virtual host
45
46 This method is recommended when Netdata is to be served from a subfolder (or directory).
47 In this case, the virtual host `netdata.example.com` already exists and Netdata has to be accessed via `netdata.example.com/netdata/`.
48
49 ```yaml
50 hosts:
51 netdata.example.com:
52 listen:
53 port: 80
54 paths:
55 /netdata:
56 redirect:
57 status: 301
58 url: /netdata/
59 /netdata/:
60 proxy.preserve-host: ON
61 proxy.reverse.url: http://127.0.0.1:19999
62 ```
63
64 ### As a subfolder for multiple Netdata servers, via one H2O instance
65
66 This is the recommended configuration when one H2O instance will be used to manage multiple Netdata servers via subfolders.
67
68 ```yaml
69 hosts:
70 netdata.example.com:
71 listen:
72 port: 80
73 paths:
74 /netdata/server1:
75 redirect:
76 status: 301
77 url: /netdata/server1/
78 /netdata/server1/:
79 proxy.preserve-host: ON
80 proxy.reverse.url: http://198.51.100.1:19999
81 /netdata/server2:
82 redirect:
83 status: 301
84 url: /netdata/server2/
85 /netdata/server2/:
86 proxy.preserve-host: ON
87 proxy.reverse.url: http://198.51.100.2:19999
88 ```
89
90 Of course, you can add as many backend servers as you like.
91
92 Using the above, you access Netdata on the backend servers like this:
93
94 - `http://netdata.example.com/netdata/server1/` to reach Netdata on `198.51.100.1:19999`
95 - `http://netdata.example.com/netdata/server2/` to reach Netdata on `198.51.100.2:19999`
96
97 ### Encrypt the communication between H2O and Netdata
98
99 In case Netdata's web server has been [configured to use TLS](/src/web/server/README.md#examples), it is
100 necessary to specify inside the H2O configuration that the final destination is using TLS. To do this, change the
101 `http://` on the `proxy.reverse.url` line in your H2O configuration with `https://`
102
103 ### Enable authentication
104
105 :::tip Simpler Alternative
106
107 If you use Netdata Cloud, [Bearer Token Protection](/docs/netdata-agent/configuration/secure-your-netdata-agent-with-bearer-token.md) provides authentication with a single setting - no htpasswd files or H2O auth configuration needed.
108
109 :::
110
111 Create an authentication file to enable basic authentication via H2O, this secures your Netdata dashboard.
112
113 If you don't have an authentication file, you can use the following command:
114
115 ```sh
116 printf "yourusername:$(openssl passwd -apr1)" > /etc/h2o/passwords
117 ```
118
119 And then add a basic authentication handler to each path definition:
120
121 ```yaml
122 hosts:
123 netdata.example.com:
124 listen:
125 port: 80
126 paths:
127 /:
128 mruby.handler: |
129 require "htpasswd.rb"
130 Htpasswd.new("/etc/h2o/passwords", "netdata.example.com")
131 proxy.preserve-host: ON
132 proxy.reverse.url: http://127.0.0.1:19999
133 ```
134
135 For more information on using basic authentication with H2O, see [their official documentation](https://h2o.examp1e.net/configure/basic_auth.html).
136
137 ## Limit direct access to Netdata
138
139 If your H2O server is on `localhost`, you can use this to ensure external access is only possible through H2O:
140
141 ```text
142 [web]
143 bind to = 127.0.0.1 ::1
144 ```
145
146 You can also use a unix domain socket. This will provide faster communication between H2O and Netdata as well:
147
148 ```text
149 [web]
150 bind to = unix:/run/netdata/netdata.sock
151 ```
152
153 In the H2O configuration, use a line like the following to connect to Netdata via the unix socket:
154
155 ```text
156 proxy.reverse.url http://[unix:/run/netdata/netdata.sock]
157 ```
158
159 If your H2O server is not on localhost, you can set:
160
161 ```text
162 [web]
163 bind to = *
164 allow connections from = IP_OF_H2O_SERVER
165 ```
166
167 *note: Netdata v1.9+ support `allow connections from`*
168
169 `allow connections from` accepts [Netdata simple patterns](/src/libnetdata/simple_pattern/README.md) to match against
170 the connection IP address.
171
172 ## Prevent the double access.log
173
174 H2O logs accesses and Netdata logs them too. You can prevent Netdata from generating its access log, by setting
175 this in `/etc/netdata/netdata.conf`:
176
177 ```text
178 [logs]
179 access = off
180 ```