Nginx Beta Branch Invitation To Test Native Nginx IPv6 Vhost Config Support in 130.00beta01

Centmin Mod Nginx vhost creation routines don't support IPv6 Nginx vhost creation out of the box right now. You have to manually make Nginx vhost config changes to enable IPv6 support. But native Nginx IPv6 vhost config support is long overdue, with @Tracy Perry @wmtech @happyhacking being the latest users to remind me of this issue.

So I have some experimental patch code for Centmin Mod 130.00beta01 that I have been working on, which will add native Nginx IPv6 vhost config support conditionally when Centmin Mod detects that the server has a publicly resolving IPv6 IP address only. If your server isn't setup for IPv6, then a publicly resolving IPv6 IP address won't be detected.

Testing Invitation

---

I invite folks to test this experimental patch code and report feedback in this thread. To test this Centmin Mod local code on your server, run the following commands as root user in SSH:

Commands below as at November 29, 2022, committed the patched code to 130.00beta01 branch

Code (Text):

# update 130.00beta01 locally
cmupdate
# run centmin.sh menu once and exit to apply changes
echo 24 | centmin

To enable this patched code set in persistent config file /etc/centminmod/custom_config.inc the variables:

Code (Text):

VPS_IPSIX_CHECK_DISABLE='n'
VPS_IPSIX_CHECK_DISABLE_DEBUG='y'

Then run centmin.sh menu option 2, 22 menu based Nginx vhost creation routines or run nv or addons/acmetool.sh commandline based Nginx vhost creation routines and see if your domain's Nginx vhost config files have setup IPv6 listen directives in:

• /usr/local/nginx/conf/conf.d/yourdomain.com.ssl.conf
• /usr/local/nginx/conf/conf.d/yourdomain.com.conf

i.e. for HTTPS nginx vhost

Code (Text):

server {
  listen 443 ssl http2;
  listen   [::]:443 ssl http2;
  server_name yourdomain.com www.yourdomain.com;

and non-HTTPS nginx vhost

Code (Text):

server {
  listen   80;
  listen   [::]:80;
  server_name yourdomain.com www.yourdomain.com;

When you run centmin.sh menu option 2, 22 you will see some debug output from enabling VPS_IPSIX_CHECK_DISABLE_DEBUG='y'

Code (Text):

VPS_IPSIX_CHECK_DISABLE=n
IP_SYSTEM_VALIDATE_V4=0
IP_SYSTEM_VALIDATE_V6=0
DEDI_LISTEN="listen   80;"
DEDI_LISTEN_V6="listen   [::]:80;"
DEDI_LISTEN_HTTPS_V6="listen   [::]:443 ssl http2;"
DEDI_LISTEN=listen   80;
DEDI_LISTEN_V6=listen   [::]:80;

• First line verifies VPS_IPSIX_CHECK_DISABLE=n is appropriately set to enable to dynamic check.
• Second & third lines for IP_SYSTEM_VALIDATE_V4 and IP_SYSTEM_VALIDATE_V6 are to check for valid IPv4 and IPv6 resolving server IP addresses. If valid, value of variable should = 0 if invalid, variable value = 1
• Last 5 lines are just checking the values assigned to variables that will populate in your created Nginx vhost config files.

Notes:

• You can test this on a test VPS server or test Nginx vhost domain creation subdomain/domain and don't necessarily need to test on live production sites.
• This patch only works when SECOND_IP variable isn't set in the persistent config file /etc/centminmod/custom_config.inc. If you use SECOND_IP variable for dedicated IPv4 IPs defined for Nginx vhost, then the native Nginx IPv6 vhost config support is currently disabled as it's more complicated to implement and will leave that for a later stage to work on.
• If later on, you run cmupdate command, it will wipe the patched code from your local install and revert back to the unpatched code. So you will need to rerun the patch commands to be able to test this again.
• Future 130.00beta01 updates may break the patch commands below. Once folks reported feedback and bugs in this thread and I see the patches are working, I will add it to the default 130.00beta01 code base so that future cmupdate command run will be enough to get these updates.

 

Yeah ideally. Though for noobs, it will be complicated with IPv6 format and recognising and defining an individual IP address versus a range

Yeah thought about that but if your domain is behind a reverse proxy like Cloudflare, resolving the domain's IPv6 would be the Cloudflare IPv6 IP address and not the server's.

Yeah one reason I haven't do so for SECOND_IP setups right now

Yeah the way I lookup the publicly resolving IPv6 for the server, it should always be an IPv6 IP available on the server. You can manually check via these commands too

Code (Text):

curl -4s https://geoip.centminmod.com/v4 | jq -r '.ip'
curl -6s https://geoip.centminmod.com/v4 | jq -r '.ip'

Let me know if they end up with incorrect server publicly resolving IPv4/IPv6 IP addresses.

 

Oh re-read that, you mean if folks want to add a new IPv6 IP address later and after the Centmin Mod Nginx vhost was created.

 

Yeah I overlooked that for Letsencrypt web root validation. If you're using Cloudflare, skip webroot letsencrypt validation and use Cloudflare DNS API as per Letsencrypt Free SSL Certificates

 

Yeah but anything requiring end user input will ultimately rely the end users knowledge around this. Right now centmin.sh menu option 2 and 22 are only options with end user input as an option interactively. Command line nv or addons/acmetool.sh and centmin.sh menu option 2/22 would need to be updated to support adding end user defined individual IPv6 IP addresses for setup.

For tighter Cloudflare integration I am also working on supporting end users defining a custom JSON site config file which Centmin Mod can read to create Nginx vhosts which are behind Cloudflare via Cloudflare API - so it can also setup Cloudflare DNS, settings and SSL etc. Very early alpha version preview at GitHub - centminmod/centminmod-config-json. Haven't worked on it in a while though.

Depends on the web host though so hosts are only giving a few individual IPv6 IPs and not a full range.

Yeah was going to use ip command but depends on how server is configured

 

My experience too with some web hosts which is another reason IPv6 hasn't been native to Centmin Mod Nginx to date. Right now thinking of just committing the above patch but leave it disabled and let users enable it via the first post persistent config file variables.

 

You referring for when the persistent config variables enabled for this patched updated or when it's disabled by default? I assume the latter? If persistent config variables are enabled then nginx vhost would have IPv6 native support added and I can script that AAAA DNS record on desired vhost domain name resolves to the same server and if it does, then let it continue without further prompts as the user would have already setup the desired AAAA DNS ipv6 address on DNS end. So only prompt/warn if the detected AAAA DNS record does exist or does not resolve to same server and persistent config variables are disabled.

Or do you want prompts/warnings that facilitate the end result that an individual ipv6 ip address is used rather than listening on all ipv6 addresses available on the server at nginx server level?

Or just enable persistent config variables by default and enable nginx native ipv6 on all vhosts where server supports ipv6 regardless of whether the vhost domain DNS has a AAAA DNS record?

Yeah but forum Centmin Mod users only make up a small fraction of total users but then they will find out either way what is not supported heh

 

Been thinking about this more using different individual ipv6 ip addresses and how that would work for bulk nginx vhost creation in unattended manner https://community.centminmod.com/th...g-nginx-vhost-mysql-users-and-databases.8257/. When someone bulk creates 100x nginx vhost sites how to assign I individual ipv6 ip addresses to each of those 100x nginx vhost domain names? Then automate setting up the relevant AAAA DNS records for 100 domains. With IPv4 the same ip address can be used for all 100x nginx vhost domain names. Now with individual ipv6 some web hosts provide less than a /64 range so you may not have the required ipv6 individual ip addresses for all 100x of those domains.

 

Might want to start a bug report at https://community.centminmod.com/forums/bug-reports.12/

Maybe after several months of testing on Centmin Mod 130.00beta01 at least. Will depend on how much feedback/testing this IPv6 native Nginx patch testing gets on 130.00beta01.

Yeach but with any CDN reverse proxy in front of the domain, that could mask the real IPv4/IPv6 addresses. But I could check if the detected IPv4/IPv6 below to the Centmin Mod server too.

i.e. to get list of publicly available IPv6 IP addresses/ranges on server - on some web hosts I get return individual IPv6 IP addresses but on others I get an entire range.

Code (Text):

ip -o -6 addr show $(ip -o addr show scope global | grep $(curl -s https://geoip.centminmod.com/v4 | jq -r '.ip') | awk '{print $2}') scope global | sed -e 's/^.*inet6 \([^ ]\+\).*/\1/'