nginxでhttp2通信の実現ーApacheからnginxへ移行したい方必見

nginx（エンジンエックス）といえば、
大量のリクエストに高速でしかも消費メモリを抑えて
対応できるというイメージをお持ちだと思います。

そう！
実際にそうなんです！

なので、Apacheからnginxへ移行したい方のために、
nginxのインストールからlet’s encryptを使って
http2通信を実現するところまでをご紹介します。

1 nginxでhttp2通信の実現

nginxでhttp2通信の実現

nginxのインストール

※OSは、CentOS 7になります。

yumでちゃちゃっとできちゃいます。

まず、

vim /etc/yum.repos.d/nginx.repo

1	vim /etc/yum.repos.d/nginx.repo

で以下を記述。

[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1

[nginx]

name=nginx repo

baseurl=http://nginx.org/packages/centos/7/$basearch/

gpgcheck=0

enabled=1

それから、

yum install nginx

1	yum install nginx

※2016/8/29時点では、最新安定版は1.10.1になります。

nginxの起動設定及び起動

systemctl enable nginx
systemctl start nginx

1 2	systemctl enable nginx systemctl start nginx

nginxのインストールは、以上で終了です！

nginxの設定

example.comで
/var/www/publicにアクセスするものとして
設定を進めます。

①ディレクトリ、テストファイルの作成

mkdir -p /var/www/public/
chmod -R 777 /var/www
echo "<h1>This is a test.</h1>" > /var/www/public/index.html

mkdir -p /var/www/public/

chmod -R 777 /var/www

echo "<h1>This is a test.</h1>" > /var/www/public/index.html

②nginx.confの編集

※高速化のためにやっているだけので、
絶対に必要なものではありません。

vim /etc/nginx/nginx.conf

1	vim /etc/nginx/nginx.conf

以下を記述

user  nginx;
worker_processes auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

worker_rlimit_nofile  150000;

events {
	worker_connections  65535;
	multi_accept on;
	use epoll;
}

http {
	include       /etc/nginx/mime.types;
	default_type  application/octet-stream;

	server_tokens off;
	charset UTF-8;


	log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
					  '$status $body_bytes_sent "$http_referer" '
					  '"$http_user_agent" "$http_x_forwarded_for" "$request_time"';



	access_log  /var/log/nginx/access.log  main;

	sendfile        on;
	tcp_nopush      on;

	keepalive_timeout 5;
	keepalive_requests 20;

	gzip  off;

	open_file_cache max=100 inactive=10s;
	open_file_cache_valid 30s;
	open_file_cache_min_uses 2;
	open_file_cache_errors on;

	server_names_hash_bucket_size 64;
	server_name_in_redirect off;

	include /etc/nginx/conf.d/*.conf;
}

user nginx;

worker_processes auto;

error_log /var/log/nginx/error.log warn;

pid /var/run/nginx.pid;

worker_rlimit_nofile 150000;

events {

worker_connections 65535;

multi_accept on;

use epoll;

}

http {

include /etc/nginx/mime.types;

default_type application/octet-stream;

server_tokens off;

charset UTF-8;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for" "$request_time"';

access_log /var/log/nginx/access.log main;

sendfile on;

tcp_nopush on;

keepalive_timeout 5;

keepalive_requests 20;

gzip off;

open_file_cache max=100 inactive=10s;

open_file_cache_valid 30s;

open_file_cache_min_uses 2;

open_file_cache_errors on;

server_names_hash_bucket_size 64;

server_name_in_redirect off;

include /etc/nginx/conf.d/*.conf;

}

③example.com用のconfファイルの作成

vim /etc/nginx/conf.d/examplecom.conf

1	vim /etc/nginx/conf.d/examplecom.conf

以下を記載

server {
  listen 80;
  server_name example.com;

  # Path to the root of your installation
  root /var/www/public/;

  error_log  /var/log/example.com.error.log;

  add_header Cache-Control public;

  # set max upload size
  client_max_body_size 10G;

  # Disable gzip to avoid the removal of the ETag header
  gzip off;

  index index.html;

  location = /robots.txt {
	allow all;
	log_not_found off;
	access_log off;
  }

  location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README){
	deny all;
  }

  location / {
	rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
	access_log  /var/log/example.com.access.log main;
	try_files $uri $uri/ $uri.html $uri/index.html;
  }

  # Optional: set long EXPIRES header on static assets
  location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
	expires 30d;
	# Optional: Don't log access to assets
	access_log off;
  }
}

server {

listen 80;

server_name example.com;

# Path to the root of your installation

root /var/www/public/;

error_log /var/log/example.com.error.log;

add_header Cache-Control public;

# set max upload size

client_max_body_size 10G;

# Disable gzip to avoid the removal of the ETag header

gzip off;

index index.html;

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README){

deny all;

}

location / {

rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;

access_log /var/log/example.com.access.log main;

try_files $uri $uri/ $uri.html $uri/index.html;

}

# Optional: set long EXPIRES header on static assets

location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {

expires 30d;

# Optional: Don't log access to assets

access_log off;

}

nginxの再起動

systemctl restart nginx

1	systemctl restart nginx

以上で、example.comでアクセスできるようになったはずです！

http2通信の導入

http2通信を導入するには、ブラウザの仕様上SSLをはる必要があるので、
無料のSSLであるlet’s encryptを使って実現します。

①let’s encrypt クライアントのインストール

まずは、gitをインストールします。

yum -y install git

1	yum -y install git

let’s encrypt クライアントの本体をインストールします。

cd /usr/local/
git clone https://github.com/letsencrypt/letsencrypt

1 2	cd /usr/local/ git clone https://github.com/letsencrypt/letsencrypt

②let’s encrypt クライアントが依存するパッケージのインストール

cd letsencrypt/
./letsencrypt-auto --help

1 2	cd letsencrypt/ ./letsencrypt-auto --help

③証明書の取得

./letsencrypt-auto certonly --webroot \
-w /var/www/public/ -d example.com \
--agree-tos

./letsencrypt-auto certonly --webroot \

-w /var/www/public/ -d example.com \

--agree-tos

④証明書の自動更新の設定

let’s encryptの証明書は、有効期限が3ヶ月なので、
自動で更新できるようにcronを設定します。

crontab -u root -e

1	crontab -u root -e

以下を記述

00 05 01 * * /usr/local/letsencrypt/letsencrypt-auto renew --force-renew && /bin/systemctl restart nginx

1	00 05 01 * * /usr/local/letsencrypt/letsencrypt-auto renew --force-renew && /bin/systemctl restart nginx

これで毎月1日の5:00に自動で更新されます。

⑤example.com用のconfファイルの編集

vim /etc/nginx/conf.d/examplecom.conf

1	vim /etc/nginx/conf.d/examplecom.conf

以下に変更

server {
  listen 80;
  server_name example.com;
  # enforce https
  return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl http2;
  server_name example.com;

  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !DH !aNULL !eNULL !LOW !kECDH !DSS !MD5 !EXP !PSK !SRP !CAMELLIA !SEED';
  ssl_session_cache    shared:SSL:10m;
  ssl_session_timeout  10m;


  # Path to the root of your installation
  root /var/www/public/;

  error_log  /var/log/example.com.error.log;

  add_header Cache-Control public;
  add_header Strict-Transport-Security 'max-age=31536000;';

  # set max upload size
  client_max_body_size 10G;

  # Disable gzip to avoid the removal of the ETag header
  gzip off;

  index index.html;

  location = /robots.txt {
	allow all;
	log_not_found off;
	access_log off;
  }

  location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README){
	deny all;
  }

  location / {
	rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
	access_log  /var/log/example.com.access.log main;
	try_files $uri $uri/ $uri.html $uri/index.html;
  }


  # Optional: set long EXPIRES header on static assets
  location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
	expires 30d;
	# Optional: Don't log access to assets
	access_log off;
  }
}

server {

listen 80;

server_name example.com;

# enforce https

return 301 https://$server_name$request_uri;

}

server {

listen 443 ssl http2;

server_name example.com;

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !DH !aNULL !eNULL !LOW !kECDH !DSS !MD5 !EXP !PSK !SRP !CAMELLIA !SEED';

ssl_session_cache shared:SSL:10m;

ssl_session_timeout 10m;

# Path to the root of your installation

root /var/www/public/;

error_log /var/log/example.com.error.log;

add_header Cache-Control public;

add_header Strict-Transport-Security 'max-age=31536000;';

# set max upload size

client_max_body_size 10G;

# Disable gzip to avoid the removal of the ETag header

gzip off;

index index.html;