update Nginx guide with changes (#6466)
* update Nginx guide with changes * Fix URL for security guide * Remove enable TLS statement * update header title
Promise Akpan committed
Jul 16, 2019 at 08:04 UTC
360162e105183c67622ae6521cff03471658144b
2 files changed
+59
-21
docs/Running-behind-nginx.md
+58
-20
@@ -1,9 +1,43 @@
1
-# Netdata via nginx
1
+# Running Netdata behind Nginx
2
3
-To pass Netdata via a nginx, use this:
3
+## Intro
4
+
5
+[Nginx](https://nginx.org/en/) is an HTTP and reverse proxy server, a mail proxy server, and a generic TCP/UDP proxy server used to host websites and applications of all sizes.
6
+
7
+The software is known for its low impact on memory resources, high scalability, and its modular, event-driven architecture which can offer secure, predictable performance.
8
+
9
+## Why Nginx
10
+
11
+- By default, Nginx is fast and lightweight out of the box.
12
+
13
+- Nginx is used and useful in cases when you want to access different instances of Netdata from a single server.
14
+
15
+- Password-protect access to Netdata, until distributed authentication is implemented via the Netdata cloud Sign In mechanism.
16
+
17
+- A proxy was necessary to encrypt the communication to netdata, until v1.16.0, which provided TLS (HTTPS) support.
18
+
19
+## Nginx configuration file
20
+
21
+All Nginx configurations can be found in the `/etc/nginx/` directory. The main configuration file is `/etc/nginx/nginx.conf`. Website or app-specific configurations can be found in the `/etc/nginx/site-available/` directory.
22
+
23
+Configuration options in Nginx are known as directives. Directives are organized into groups known as blocks or contexts. The two terms can be used interchangeably.
24
+
25
+Depending on your installation source, you’ll find an example configuration file at `/etc/nginx/conf.d/default.conf` or `etc/nginx/sites-enabled/default`, in some cases you may have to manually create the `sites-available` and `sites-enabled` directories.
26
+
27
+You can edit the Nginx configuration file with Nano, Vim or any other text editors you are comfortable with.
28
+
29
+After making changes to the configuration files:
30
+
31
+- Test Nginx configuration with `nginx -t`.
32
+
33
+- Restart Nginx to effect the change with `/etc/init.d/nginx restart` or `service nginx restart`.
34
+
35
+## Ways to access Netdata via Nginx
36
37
### As a virtual host
38
39
+With this method instead of `SERVER_IP_ADDRESS:19999`, the Netdata dashboard can be accessed via a human-readable URL such as `netdata.example.com` used in the configuration below.
40
+
41
```
42
upstream backend {
43
# the Netdata server
@@ -30,9 +64,11 @@ server {
64
}
65
}
66
```
33
-
67
### As a subfolder to an existing virtual host
68
69
+This method is recommended when Netdata is to be served from a subfolder (or directory).
70
+In this case, the virtual host `netdata.example.com` already exists and Netdata has to be accessed via `netdata.example.com/netdata/`.
71
+
72
```
73
upstream netdata {
74
server 127.0.0.1:19999;
@@ -69,7 +105,9 @@ server {
105
}
106
```
107
72
-### As a subfolder for multiple Netdata servers, via one nginx
108
+### As a subfolder for multiple Netdata servers, via one Nginx
109
+
110
+This is the recommended configuration when one Nginx will be used to manage multiple Netdata servers via subfolders.
111
112
```
113
upstream backend-server1 {
@@ -114,25 +152,25 @@ Of course you can add as many backend servers as you like.
152
153
Using the above, you access Netdata on the backend servers, like this:
154
117
-- `http://nginx.server/netdata/server1/` to reach `backend-server1`
118
-- `http://nginx.server/netdata/server2/` to reach `backend-server2`
155
+- `http://netdata.example.com/netdata/server1/` to reach `backend-server1`
156
+- `http://netdata.example.com/netdata/server2/` to reach `backend-server2`
157
120
-### Using TLS communication
158
+### Encrypt the communication between Nginx and Netdata
159
122
-In case Netdata's web server has been [configured to use TLS](../web/server/#enabling-tls-support), you must also encrypt the communication between Nginx and Netdata.
123
-
124
-To enable encryption, first [enable TLS/SSL on Nginx](http://nginx.org/en/docs/http/configuring_https_servers.html) and then put the following in the location section of your Nginx configuration:
160
+In case Netdata's web server has been [configured to use TLS](../web/server/#enabling-tls-support), it is necessary to specify inside the Nginx configuration that the final destination is using TLS. To do this, please, append the following parameters in your `nginx.conf`
161
162
```
163
proxy_set_header X-Forwarded-Proto https;
164
proxy_pass https://localhost:19999;
165
```
166
131
-If nginx is not configured as described here, you will probably receive the error `SSL_ERROR_RX_RECORD_TOO_LONG`.
167
+Optionally it is also possible to [enable TLS/SSL on Nginx](http://nginx.org/en/docs/http/configuring_https_servers.html), this way the user will encrypt not only the communication between Nginx and Netdata but also between the user and Nginx.
168
+
169
+If Nginx is not configured as described here, you will probably receive the error `SSL_ERROR_RX_RECORD_TOO_LONG`.
170
171
### Enable authentication
172
135
-Create an authentication file to enable basic authentication via Nginx. Do not use authentication without having first [enabled TLS](#using-tls-communication)!
173
+Create an authentication file to enable basic authentication via Nginx, this secures your Netdata dashboard.
174
175
If you don't have an authentication file, you can use the following command:
176
@@ -151,7 +189,7 @@ server {
189
}
190
```
191
154
-## limit direct access to Netdata
192
+## Limit direct access to Netdata
193
194
If your Nginx is on `localhost`, you can use this to protect your Netdata:
195
@@ -162,7 +200,7 @@ If your Nginx is on `localhost`, you can use this to protect your Netdata:
200
201
---
202
165
-You can also use a unix domain socket. This will also provide a faster route between nginx and Netdata:
203
+You can also use a unix domain socket. This will also provide a faster route between Nginx and Netdata:
204
205
```
206
[web]
@@ -170,7 +208,7 @@ You can also use a unix domain socket. This will also provide a faster route bet
208
```
209
_note: Netdata v1.8+ support unix domain sockets_
210
173
-At the nginx side, use something like this to use the same unix domain socket:
211
+At the Nginx side, use something like this to use the same unix domain socket:
212
213
```
214
upstream backend {
@@ -181,7 +219,7 @@ upstream backend {
219
220
---
221
184
-If your nginx server is not on localhost, you can set:
222
+If your Nginx server is not on localhost, you can set:
223
224
```
225
[web]
@@ -193,9 +231,9 @@ _note: Netdata v1.9+ support `allow connections from`_
231
232
`allow connections from` accepts [Netdata simple patterns](../libnetdata/simple_pattern/) to match against the connection IP address.
233
196
-## prevent the double access.log
234
+## Prevent the double access.log
235
198
-nginx logs accesses and Netdata logs them too. You can prevent Netdata from generating its access log, by setting this in `/etc/netdata/netdata.conf`:
236
+Nginx logs accesses and Netdata logs them too. You can prevent Netdata from generating its access log, by setting this in `/etc/netdata/netdata.conf`:
237
238
```
239
[global]
@@ -204,7 +242,7 @@ nginx logs accesses and Netdata logs them too. You can prevent Netdata from gene
242
243
## SELinux
244
207
-If you get an 502 Bad Gateway error you might check your nginx error log:
245
+If you get an 502 Bad Gateway error you might check your Nginx error log:
246
247
```sh
248
# cat /var/log/nginx/error.log:
@@ -214,4 +252,4 @@ If you get an 502 Bad Gateway error you might check your nginx error log:
252
If you see something like the above, chances are high that SELinux prevents nginx from connecting to the backend server. To fix that, just use this policy: `setsebool -P httpd_can_network_connect true`.
253
254
217
-[]()
255
+[]()
\ No newline at end of file
docs/netdata-security.md
+1
-1
@@ -89,7 +89,7 @@ In Netdata v1.9+ there is also access list support, like this:
89
90
#### Use an authenticating web server in proxy mode
91
92
-Use one web server to provide authentication in front of **all your Netdata servers**. So, you will be accessing all your Netdata with URLs like `http://{HOST}/netdata/{NETDATA_HOSTNAME}/` and authentication will be shared among all of them (you will sign-in once for all your servers). Instructions are provided on how to set the proxy configuration to have Netdata run behind [nginx](Running-behind-nginx.md#netdata-via-nginx), [Apache](Running-behind-apache.md), [lighthttpd](Running-behind-lighttpd.md#netdata-via-lighttpd-v14x) and [Caddy](Running-behind-caddy.md#netdata-via-caddy).
92
+Use one web server to provide authentication in front of **all your Netdata servers**. So, you will be accessing all your Netdata with URLs like `http://{HOST}/netdata/{NETDATA_HOSTNAME}/` and authentication will be shared among all of them (you will sign-in once for all your servers). Instructions are provided on how to set the proxy configuration to have Netdata run behind [nginx](Running-behind-nginx.md), [Apache](Running-behind-apache.md), [lighthttpd](Running-behind-lighttpd.md#netdata-via-lighttpd-v14x) and [Caddy](Running-behind-caddy.md#netdata-via-caddy).
93
94
To use this method, you should firewall protect all your Netdata servers, so that only the web server IP will allowed to directly access Netdata. To do this, run this on each of your servers (or use your firewall manager):
95