nginx from source with pagespeed and passenger on ubuntu 16.04 and above

nginx_source_pagespeed_passenger_ubuntu.md

sudo apt-get -y update
sudo apt-get install -y build-essential libcurl4-openssl-dev unzip software-properties-common git libpcre3-dev libpcre3

adding zlib, openssl and pcre

cd && mkdir sources && cd sources
wget https://downloads.sourceforge.net/project/pcre/pcre/8.41/pcre-8.41.tar.gz && tar xzvf pcre-8.41.tar.gz
wget http://www.zlib.net/zlib-1.2.11.tar.gz && tar xzvf zlib-1.2.11.tar.gz
wget https://www.openssl.org/source/openssl-1.1.0f.tar.gz && tar xzvf openssl-1.1.0f.tar.gz

rvm (https://github.com/rvm/ubuntu_rvm)

sudo apt-add-repository -y ppa:rael-gc/rvm
sudo apt-get update
sudo apt-get install -y rvm
source /etc/profile.d/rvm.sh
rvm install 2.4.2
gem install passenger --no-rdoc --no-ri

maxmind (https://github.com/maxmind/libmaxminddb)

sudo add-apt-repository ppa:maxmind/ppa
sudo apt-get install -y libmaxminddb0 libmaxminddb-dev mmdb-bin

modules

build directory

cd ~/ && mkdir modules && cd modules

clone addons

git clone https://github.com/bpaquet/ngx_http_enhanced_memcached_module
git clone https://github.com/leev/ngx_http_geoip2_module

download and pre-configure pagespeed

https://www.modpagespeed.com/doc/build_ngx_pagespeed_from_source in 'Build instructions', 'First download ngx_pagespeed' only

NPS_VERSION=1.12.34.2-stable
wget https://github.com/pagespeed/ngx_pagespeed/archive/v${NPS_VERSION}.zip
unzip v${NPS_VERSION}.zip
cd ngx_pagespeed-${NPS_VERSION}/
NPS_RELEASE_NUMBER=${NPS_VERSION/beta/}
NPS_RELEASE_NUMBER=${NPS_VERSION/stable/}
psol_url=https://dl.google.com/dl/page-speed/psol/${NPS_RELEASE_NUMBER}.tar.gz
[ -e scripts/format_binary_url.sh ] && psol_url=$(scripts/format_binary_url.sh PSOL_BINARY_URL)
wget ${psol_url}
tar -xzvf $(basename ${psol_url})

download latest nginx

cd
wget http://nginx.org/download/nginx-1.13.3.tar.gz
tar xvzf nginx-1.13.3.tar.gz
cd nginx-1.13.3

configure nginx

yes Y | ./configure \
  --prefix=/usr/share/nginx \
  --sbin-path=/usr/sbin/nginx \
  --modules-path=/usr/lib/nginx/modules \
  --conf-path=/etc/nginx/nginx.conf \
  --error-log-path=/var/log/nginx/error.log \
  --http-log-path=/var/log/nginx/access.log \
  --pid-path=/run/nginx.pid \
  --lock-path=/var/lock/nginx.lock \
  --http-client-body-temp-path=/var/lib/nginx/body \
  --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
  --http-proxy-temp-path=/var/lib/nginx/proxy \
  --http-scgi-temp-path=/var/lib/nginx/scgi \
  --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
  --with-compat \
  --with-file-aio \
  --with-threads \
  --with-http_addition_module \
  --with-http_auth_request_module \
  --with-http_dav_module \
  --with-http_flv_module \
  --with-http_gunzip_module \
  --with-http_gzip_static_module \
  --with-http_mp4_module \
  --with-http_random_index_module \
  --with-http_realip_module \
  --with-http_slice_module \
  --with-http_ssl_module \
  --with-http_sub_module \
  --with-http_stub_status_module \
  --with-http_v2_module \
  --with-http_secure_link_module \
  --with-mail \
  --with-mail_ssl_module \
  --with-stream \
  --with-stream_realip_module \
  --with-stream_ssl_module \
  --with-stream_ssl_preread_module \
  --with-debug \
  --with-openssl=/root/sources/openssl-1.1.0f \
  --with-openssl-opt=enable-ec_nistp_64_gcc_128 \
  --with-openssl-opt=no-nextprotoneg \
  --with-openssl-opt=no-weak-ssl-ciphers \
  --with-openssl-opt=no-ssl3 \
  --with-zlib=/root/sources/zlib-1.2.11 \
  --with-pcre=/root/sources/pcre-8.41 \
  --add-dynamic-module=$(passenger-config --nginx-addon-dir) \
  --add-module=/root/modules/ngx_http_enhanced_memcached_module \
  --add-module=/root/modules/ngx_http_geoip2_module \
  --add-module=/root/modules/ngx_pagespeed-1.12.34.2-stable
make
sudo make install
mkdir -p /var/lib/nginx/body

add in /etc/systemd/system/nginx.service

cat <<EOF > /etc/systemd/system/nginx.service
[Unit]
Description=A high performance web server and a reverse proxy server
After=network.target

[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
ExecStop=-/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid
TimeoutStopSec=5
KillMode=mixed

[Install]
WantedBy=multi-user.target
EOF

then

sudo systemctl start nginx.service && sudo systemctl enable nginx.service

the follwing is now available

sudo systemctl is-enabled nginx.service
sudo systemctl restart nginx.service
sudo systemctl stop nginx.service

add passenger to nginx.conf

top of file, outside http, events or server blocks

load_module /usr/lib/nginx/modules/ngx_http_passenger_module.so;

activate pagespeed in nginx.conf

Within http block or specifically, in server block

pagespeed on;
pagespeed FileCachePath /tmp/ngx_pagespeed_cache;
pagespeed LowercaseHtmlNames on;
pagespeed XHeaderValue "Powered By ngx_pagespeed";

For any server blocks :

location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" {
  add_header "" "";
}
location ~ "^/pagespeed_static/" { }
location ~ "^/ngx_pagespeed_beacon$" { }

Interesting filters :

pagespeed LowercaseHtmlNames on;
pagespeed EnableFilters recompress_images;
pagespeed EnableFilters convert_meta_tags;
pagespeed EnableFilters hint_preload_subresources;
pagespeed EnableFilters flatten_css_imports;
pagespeed EnableFilters extend_cache;
pagespeed EnableFilters inline_preview_images;
pagespeed EnableFilters resize_rendered_image_dimensions;
pagespeed EnableFilters insert_dns_prefetch;
pagespeed EnableFilters defer_javascript;
pagespeed EnableFilters rewrite_javascript;
pagespeed EnableFilters responsive_images,resize_images;
pagespeed EnableFilters lazyload_images;
pagespeed LazyloadImagesBlankUrl "https://www.gstatic.com/psa/static/1.gif";

More ngx_pagespeed configuration

https://www.modpagespeed.com/doc/configuration

helpful tutorial

https://www.vultr.com/docs/how-to-compile-nginx-from-source-on-ubuntu-16-04

Adding nginx amplify agent (https://amplify.nginx.com)

Installing

curl -L -O https://github.com/nginxinc/nginx-amplify-agent/raw/master/packages/install.sh
wget https://github.com/nginxinc/nginx-amplify-agent/raw/master/packages/install.sh
API_KEY='xxx' sh ./install.sh

Add the stub_status endpoint

server {
	listen 127.0.0.1:80;
	server_name 127.0.0.1;
	location /nginx_status {
		stub_status on;
		allow 127.0.0.1;
		deny all;
	}
}

Configure the logs

In http block

log_format  main_ext  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" '
                      '"$host" sn="$server_name" '
                      'rt=$request_time '
                      'ua="$upstream_addr" us="$upstream_status" '
                      'ut="$upstream_response_time" ul="$upstream_response_length" '
                      'cs=$upstream_cache_status' ;
access_log  /var/log/nginx/access.log  main_ext;
error_log  /var/log/nginx/error.log warn;

Simple load balancer

in http block

upstream backend  {
  server 174.138.47.205;
  server 128.199.64.246;
}

in a server block

location / {
    proxy_pass  http://backend;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Secure access

The clients (here : 174.138.47.205, 128.199.64.246) should not be reachable via ip, but should let the master server in. On each client, in the default nginx.conf file, within http block, add :

allow xxx.xxx.xxx.xxx; # master ip
deny all;

Reverse proxy to cloud funtion hosted on firebase

server {
        ...
        location / {
            proxy_pass https://deemx-1288.firebaseapp.com;
            # sample self signed certs
            proxy_ssl_certificate /etc/nginx/ssl/nginx.crt;
            proxy_ssl_certificate_key /etc/nginx/ssl/nginx.key;
            proxy_pass_request_headers   on;
            proxy_ssl_name $proxy_host;
        }
}

Pagespeed PHP/fpm example