Join the community today
Become a Member

Get Centminmod installation to work on Linode with Letsencrypt, Wordpress and Nginx

Discussion in 'Install & Upgrades or Pre-Install Questions' started by hkim, Feb 15, 2019.

  1. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    Please fill in any relevant information that applies to you:
    • CentOS Version: CentOS 7 64bit ?
    • Centmin Mod Version Installed: 123.09beta01
    • Nginx Version Installed: i.e. 1.15.3
    • PHP Version Installed: 7.2.9
    • MariaDB MySQL Version Installed: 10.2.xx
    • When was last time updated Centmin Mod code base ? : centmin.sh menu option 23 submenu option 2
    • Persistent Config:
    I have now tried to install and get Centminmod to be functional the last couple of days. I have read the published guides but I just can't this to work properly.

    1) I have turned off selinux.
    2. I have installed centminmod successfully. My Linode is well abova the minimum requirements.
    3) "Set the Default Server Main Hostname Nginx Vhost" (Getting Started Guide - CentminMod.com LEMP Nginx web stack for CentOS)

    When I enter uname -n, I get my full domain name = psykolog.nu.

    This is obviously going to be my site domain for my visitors to navigate to.


    So what should I do here? Should I go on with setting up a DNS entry for a new hostname (for example centhost.psykolog.nu) and change the hostname to centhost.psykolog.nu with

    (a) hostnamectl set-hostname centhost.psykolog.nu
    (b) edit /etc/hosts and add "serverip centhost.psykolog.nu centhost"
    (c) save /etc/hosts and then type centhost centhost.psykolog.nu
    (d) restart the network?

    Sorry if I'm just repeating the instructions but I'm just trying to follow the instructions correctly this time so the installation will not break as it has done many times the couple of days. For your info I get this when I type hostnamectl status before changing:

    [root@psykolog.nu ~]# hostnamectl status
    Static hostname: localhost.localdomain
    Transient hostname: psykolog.nu
    Icon name: computer-vm
    Chassis: vm
    Machine ID:-
    Boot ID: -
    Virtualization: kvm
    Operating System: CentOS Linux 7 (Core)
    CPE OS Name: cpe:/o:centos:centos:7
    Kernel: Linux 3.10.0-957.el7.x86_64
    Architecture: x86-64
     
  2. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    Ok, for a newbie it is confusing in the guide with "hostname hostname.newdomain.com" when hostname is a command and not the subdomain of choosing. Maybe "hostname subdomainofyourchoice.newdomain.com" would be easier to understand...

    Now, this means that in the /etc/hosts it should state:

    ip-address centhost.psykolog.nu hostname and not ip-address centhost.psykolog.nu centhost?
     
  3. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    Ok I have now followed the instructions to the second part: " Add Your First Domain Name's Nginx Vhost Configuration".

    What I want to go straight forward and run option 22 in the centmin and create a nginx/wordpress installation with letsencrypt SSL (with only https). Is this possible?
     
  4. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    Got everything working. My previous problem was with defining wrong hostname. Also added LETSENCRYPT_DETECT='y' in /etc/centminmod/custom_config.inc before option 22.
     
  5. eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    12:11 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Great to hear you sorted that out
    Yes Getting Started Step 1 needs a hostname other than your site domain name as per Getting Started Guide - CentminMod.com LEMP Nginx web stack for CentOS so steps a) and b) are correct and only needed to be done and then as per instructions edit main hostname vhost at virtual.conf and modify server_name line to list the hostname you setup centhost.psykolog.nu
    Then restart nginx service
     
  6. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    I also managed to install phpmyadmin. But now I cannot access phpmyadmin at centhost.psykolog.nu due to cert error. How can I fix this? I have a letsencrypt cert on main domain psykolog.nu.

    From the error log (/var/log/localhost.error.log):

    2019/02/15 01:41:05 [error] 13716#13716: *109 open() "/usr/local/nginx/html/application/configs/application.ini" failed (2: No such file or directory), client: 159.203.11.15, server: centhost.psykolog.nu, request: "GET /application/configs/application.ini HTTP/1.1", host: "178.79.154.124:80"

    Seems like phpmyadmin by default uses http when it should be https on my configuration?
     
    Last edited: Feb 15, 2019
  7. eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    12:11 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    how was phpmyadmin installed ? via phpmyadmin.sh addon phpmyadmin.sh Addon ? that sets up self-signed ssl on main hostname access only.
     
  8. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    Really thankful for your support (can I donate somehow?)

    The problem is that I have HSTS enabled.

    It was installed via phpmyadmin.sh. I saw on your reply to another poster: Nginx - SSL - phpmyadmin main hostname HTTPS SSL: conflicting server name ignored

    Could this be relevant for me too?

    From what I understand:

    1. Edit phpmyadmin_ssl.conf and change:

    (a) replace crt and key to use the main site ssl
    (b) exclude the line 'include /usr/loal/nginx/conf/phpmyadmin_https.conf'
    (c) included the line 'include /usr/local/nginx/conf/php.conf'
    (d) remove the redirection line under location: 'return 302 https://$server_name4$request_uri;'

    2. then restart nginx.

    Should this work?
     
    Last edited: Feb 15, 2019
  9. eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    12:11 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    yup https://community.centminmod.com/link-forums/ways-you-can-support-centmin-mod.62/ :D

    I see

    The only thing that can mess up virtual.conf main host is if you install phpmyadmin.sh addon. Otherwise, you can manually setup main hostname outlined in Getting Started Guide step 1 with HTTPS using vhost generator at Generate Centmin Mod Nginx Vhost - CentminMod.com LEMP Nginx web stack for CentOS

    type on domain fieldin main host name domain which has to have valid DNS A record pointing to server ip i.e. host.domain.com and check box that says Generate Self-Signed SSL / Letsencrypt SSL HTTPS Vhost (File ONLY) *

    Vhost type = basic and hit submit

    follow first 3 acme.sh commands only to get letsencrypt ssl cert but edit web root from
    /home/nginx/domains/host.domain.com/public to point to /usr/local/nginx/html and remove www. domain from -d

    enable letsencrypt in 123.09beta01 - 3 commands
    Code (Text):
    touch /etc/centminmod/custom_config.inc
    echo "LETSENCRYPT_DETECT='y'" >> /etc/centminmod/custom_config.inc
    /usr/local/src/centminmod/addons/acmetool.sh acmeupdate
    

    get letsencrypt ssl cert - 1 line cmd - webroot defined by -w /usr/local/nginx/html
    Code (Text):
    /root/.acme.sh/acme.sh --force --issue --days 60 -d host.domain.com -w /usr/local/nginx/html -k 2048 --useragent centminmod-centos-acmesh-webroot --log /root/centminlogs/acmetool.sh-debug-log-host.domain.com.log --log-level 2
    

    install letsencrypt ssl cert - 2 line cmds
    Code (Text):
    mkdir -p /usr/local/nginx/conf/ssl/host.domain.com
    /root/.acme.sh/acme.sh --installcert -d host.domain.com --certpath /usr/local/nginx/conf/ssl/host.domain.com/host.domain.com-acme.cer --keypath /usr/local/nginx/conf/ssl/host.domain.com/host.domain.com-acme.key --capath /usr/local/nginx/conf/ssl/host.domain.com/host.domain.com-acme.cer --reloadCmd /usr/bin/ngxreload --fullchainpath /usr/local/nginx/conf/ssl/host.domain.com/host.domain.com-fullchain-acme.key
    

    then make a copy of /usr/local/nginx/conf/conf.d/virtual.conf as /usr/local/nginx/conf/conf.d/virtual.ssl.conf
    Code (Text):
    cp -a /usr/local/nginx/conf/conf.d/virtual.conf /usr/local/nginx/conf/conf.d/virtual.ssl.conf
    

    now edit within /usr/local/nginx/conf/conf.d/virtual.ssl.conf with ssl cert lines so looks like
    Code (Text):
    server {
      listen 443 ssl http2;
      server_name host.domain.com;
    
      ssl_certificate      /usr/local/nginx/conf/ssl/host.domain.com/host.domain.com-acme.cer;
      ssl_certificate_key  /usr/local/nginx/conf/ssl/host.domain.com/host.domain.com-acme.key;
      include /usr/local/nginx/conf/ssl_include.conf;
    
      http2_max_field_size 16k;
      http2_max_header_size 32k;
      # dual cert supported ssl ciphers
      ssl_ciphers TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS;
      ssl_prefer_server_ciphers   on;
      #add_header Alternate-Protocol  443:npn-spdy/3;
      #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
      #add_header X-Frame-Options SAMEORIGIN;
      #add_header X-Xss-Protection "1; mode=block" always;
      #add_header X-Content-Type-Options "nosniff" always;
      #spdy_headers_comp 5;
      ssl_buffer_size 1369;
      ssl_session_tickets on;
    
      # enable ocsp stapling
      resolver 8.8.8.8 8.8.4.4 valid=10m;
      resolver_timeout 10s;
      ssl_stapling on;
      ssl_stapling_verify on;
      ssl_trusted_certificate /usr/local/nginx/conf/ssl/host.domain.com/host.domain.com-acme.cer;
    
            root   html;
            access_log              /var/log/nginx/localhost.access.log     combined buffer=8k flush=1m;
            error_log               /var/log/nginx/localhost.error.log      error;
    
    # ngx_pagespeed & ngx_pagespeed handler
    #include /usr/local/nginx/conf/pagespeed.conf;
    #include /usr/local/nginx/conf/pagespeedhandler.conf;
    #include /usr/local/nginx/conf/pagespeedstatslog.conf;
    
    # limit_conn limit_per_ip 16;
    # ssi  on;
    
            location /nginx_status {
            stub_status on;
            access_log   off;
            allow 127.0.0.1;
            #allow youripaddress;
            deny all;
            }
    
                location / {
    
    # block common exploits, sql injections etc
    #include /usr/local/nginx/conf/block.conf;
    
    #Enables directory listings when index file not found
    #autoindex  on;
         
                }
    
    include /usr/local/nginx/conf/staticfiles.conf;
    include /usr/local/nginx/conf/include_opcache.conf;
    include /usr/local/nginx/conf/php.conf;
    #include /usr/local/nginx/conf/phpstatus.conf;
    include /usr/local/nginx/conf/drop.conf;
    #include /usr/local/nginx/conf/errorpage.conf;
    #include /usr/local/nginx/conf/vts_mainserver.conf;
    
           }
    

    restart nginx
    Code (Text):
    ngxrestart
    

    now you should be able to access both https and non-https hostname and then if all is working do a non-https to https 302 temp redirect



    If you do have phpmyadmin.sh installed phpmyadmin, you can probably try this to fix the conflict via these steps.

    1. Get the contents of /usr/local/nginx/conf/phpmyadmin_https.conf and place it in your above created
    /usr/local/nginx/conf/conf.d/virtual.ssl.conf main hostname HTTPS nginx vhost within server{} context

    2. Backup locally copy of phpmyadmin.sh auto generated self-signed SSL cert HTTPS vhost at /usr/local/nginx/conf/conf.d/phpmyadmin_ssl.conf

    3. Then take the below following values contained within /usr/local/nginx/conf/conf.d/phpmyadmin_ssl.conf and transpose them into your above created
    /usr/local/nginx/conf/conf.d/virtual.ssl.conf main hostname HTTPS nginx vhost within server{} context
    Code (Text):
    keepalive_timeout 3000;
    client_body_buffer_size 256k;
    client_body_timeout 3000s;
    client_header_buffer_size 256k;
    ## how long a connection has to complete sending
    ## it's headers for request to be processed
    client_header_timeout 60s;
    client_max_body_size 512m;
    connection_pool_size 512;
    directio 512m;
    ignore_invalid_headers on;
    large_client_header_buffers 8 256k;
    


    4. Then remove /usr/local/nginx/conf/conf.d/phpmyadmin_ssl.conf

    5. Test Nginx config & Restart Nginx & PHP-FPM
    Code (Text):
    nginx -t
    nprestart
    
     
  10. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    I followed your guide here to install phpmyadmin:

    Addon phpmyadmin.sh - CentminMod.com LEMP Nginx web stack for CentOS

    So I guess the second suggestion is to go with?

    I have following files in /usr/local/nginx/conf/conf.d/

    [11:16][root@centhost.psykolog.nu conf.d]# ls
    demodomain.com.conf phpmyadmin_ssl.conf psykolog.nu.ssl.conf virtual.conf

    So I guess I should take the content of the phpmyadmin_https.conf and place it in psykolog.nu_ssl.conf and not virtual.conf?


    So these values is uniqe for phpmyadmin?

    What will the inmplication of this modification be on future updates of for example phpmyadmin or Nginx. That I have to manually adjust this settings after each update?
     
  11. eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    12:11 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    phpmyadmin.sh installed and above modified setup for https won't be affected by future updates usually

    values are for if you make copy of virtual.conf for /usr/local/nginx/conf/conf.d/virtual.ssl.conf as the sole nginx vhost used for main hostname and not psykolog.nu_ssl.conf as that would only have yourdomain ssl cert and not your mainhostname.domain.com ssl cert for above main hostname centhost.psykolog.nu
    so only instructions you should follow are in post #9 here
     
  12. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    After this step, configuring virtual.ssl.conf generates following error with nginx -t
    [12:18][root@centhost.psykolog.nu conf.d]# nginx -t
    nginx: [emerg] "root" directive is duplicate in /usr/local/nginx/conf/conf.d/virtual.ssl.conf:32
    nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed
     
  13. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    I followed your steps but it still does not work.

    nginx -t
    nginx: [warn] conflicting server name "centhost.psykolog.nu" on 0.0.0.0:443, ignored
    nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

    virtual.ssl.conf:
    Code:
    server {
                listen 443 ssl http2;
                server_name centhost.psykolog.nu;
                root   html;
    
    
            ssl_certificate      /usr/local/nginx/conf/ssl/centhost.psykolog.nu/centhost.psykolog.nu-acme.cer;
            ssl_certificate_key  /usr/local/nginx/conf/ssl/centhost.psykolog.nu/centhost.psykolog.nu-acme.key;
            include              /usr/local/nginx/conf/ssl_include.conf;
    
      http2_max_field_size 16k;
      http2_max_header_size 32k;
      # dual cert supported ssl ciphers
      ssl_ciphers TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:ECDHE-ECD$
      ssl_prefer_server_ciphers   on;
      #add_header Alternate-Protocol  443:npn-spdy/3;
      #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
      #add_header X-Frame-Options SAMEORIGIN;
      #add_header X-Xss-Protection "1; mode=block" always;
      #add_header X-Content-Type-Options "nosniff" always;
      #spdy_headers_comp 5;
      ssl_buffer_size 1369;
      ssl_session_tickets on;
    
      # enable ocsp stapling
      resolver 8.8.8.8 8.8.4.4 valid=10m;
      resolver_timeout 10s;
      ssl_stapling on;
      ssl_stapling_verify on;
      ssl_trusted_certificate /usr/local/nginx/conf/ssl/centhost.psykolog.nu/centhost.psykolog.nu-acme.cer;
    
    #        root   html;
    #        access_log              /var/log/nginx/localhost.access.log     combined buffer=8k flush=1m;
     #       error_log               /var/log/nginx/localhost.error.log      error;
    
    # ngx_pagespeed & ngx_pagespeed handler
    #include /usr/local/nginx/conf/pagespeed.conf;
    #include /usr/local/nginx/conf/pagespeedhandler.conf;
    #include /usr/local/nginx/conf/pagespeedstatslog.conf;
    
    # limit_conn limit_per_ip 16;
    # ssi  on;
    
            location /nginx_status {
            stub_status on;
            access_log   off;
            allow 127.0.0.1;
            #allow youripaddress;
            deny all;
            }
    
                location / {
    
    # block common exploits, sql injections etc
    #include /usr/local/nginx/conf/block.conf;
    
    #Enables directory listings when index file not found
    #autoindex  on;
    
                }
    
    include /usr/local/nginx/conf/staticfiles.conf;
    include /usr/local/nginx/conf/include_opcache.conf;
    include /usr/local/nginx/conf/php.conf;
    #include /usr/local/nginx/conf/phpstatus.conf;
    include /usr/local/nginx/conf/drop.conf;
    #include /usr/local/nginx/conf/errorpage.conf;
    #include /usr/local/nginx/conf/vts_mainserver.conf;
    
           }
    
     
    Last edited: Feb 15, 2019
  14. hkim

    hkim New Member

    28
    3
    3
    Feb 14, 2019
    Ratings:
    +4
    Local Time:
    4:11 AM
    Sorry. I did not follow all the steps. Stupid me! ;)

    Thank you very much! I have made a small donation for your kind support. If I decide to use Centminmod for my server, I will definetly pay for a premium membership!
     
    Last edited: Feb 15, 2019
  15. eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    12:11 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    You're welcome and very much appreciated with donation and premium membership support :D

    Remember there's more ways to boost performance from an out of the box install via Insight Guide - How to boost Centmin Mod LEMP stack performance :)
     
  16. Mak Adang

    Mak Adang Member

    62
    20
    8
    Jan 4, 2015
    Ratings:
    +23
    Local Time:
    9:11 AM
    1.9.0
    10.0.18-MariaDB
    Hi @eva2000 , can this virtual.ssl.conf using cloudflare origin certificates because i have same cases with hsts enable and clodflare says that origin certificates can be used for wildcard
    Thank you.
     
  17. eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    12:11 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    yes it's like any other nginx vhost essentially