ITCooky Recipes

to start
systemctl start php-fpm.service
systemctl enable php-fpm.service

First website launch
Make a folder for future sites
mkdir /usr/local/www
I copied an example from nginx
cp -r /etc/nginx/html /usr/local/www
make a file there
vi /usr/local/www/html/info.php
code

<?php
phpinfo();
?>

And change the nginx settings
right here
vi /etc/nginx/conf/nginx.conf
code

#user nobody;
worker_processes 1;

error_log /dev/null crit;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;

sendfile on;
#tcp_nopush on;

#keepalive_timeout 0;
keepalive_timeout 65;

include /etc/nginx/conf/conf.d/*.conf;
}

Create a folder where we will put the site settings
mkdir /etc/nginx/conf/conf.d
make file
vi /etc/nginx/conf/conf.d/default.conf
code

#
# The default server
#
server {
listen 80;
server_name localhost;

location / {
root /usr/local/www/html;
index index.php index.html index.htm;
}

# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/local/www/html;
}


location ~ \.php$ {
root /usr/local/www/html;
fastcgi_pass unix:/var/run/php.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}

# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
location ~ /\.ht {
deny all;
 }
}

start
service nginx restart
service php-fpm restart

And according to the idea, it should work, but it never works, but it worked for me – I wrote all the steps here for myself, the most part, of course!

Website transfer
On the old server, archive the folder with the site and the database
tar -cvf itc.tar ./itcooky.com
mysqldump --user=root --password --host=localhost wpita > ./wpita.sql
I download these files on the new server
scp user@123.123.123.123:/home/user/itc.tar ./
scp user@123.123.123.123:/home/user/wpita.sql ./
The file can be immediately unzipped in the folder/usr/local/www/
tar -xvf itc.tar
And for the base, you must first create it and make a user for it

Let’s go to mysql
mysql -u root -p
We make a user with the name
CREATE DATABASE wpit;
CREATE USER 'wpita'@'localhost' IDENTIFIED BY 'QWErty123!';
GRANT ALL PRIVILEGES ON wpit.* TO 'wpita'@'localhost';
ALTER USER 'wpita'@'localhost' IDENTIFIED WITH mysql_native_password BY 'QWErty123!';
exit
If the MySQL database password contains #, Sphinx will not be able to read it, so it is best not to type # in the password.

After that, you can add the base.
mysql -u root -p wpita < wpita.sql
For Letsencrypt, you need to transfer certificates from the old server, but first install it on the new one
wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
./certbot-auto --nginx
And now the certificates, we do on old server
cd /home/user
tar -cvf lc.tar /etc/letsencrypt
on new server
cd /usr/local/src
scp user@123.123.123.123:/home/user/lc.tar ./
tar -xvf lc.tar
And we will transfer everything to the /etc/letsencrypt folder for now this is enough, then it will be necessary to configure the renewal of certificates
If the site folder in server has changed, this should be reflected in the letsencrypt files in the /etc/letsencrypt/renewal folder; otherwise certifiers will refuse to update
To update the certificates themselves, I add
crontab -e
line

19 6 9,18,27 * * /usr/local/src/certbot-auto renew -q&&/usr/sbin/service nginx reload

On the new server I make settings for the site
vi /etc/nginx/conf/conf.d/it.conf
I add text: everything that requests http via ip4 and ip6 is forwarted to https

server {
    listen 80;
    listen [::]:80;
    server_name itcooky.com www.itcooky.com es.itcooky.com en.itcooky.com;
    return 301 https://$host$request_uri;
access_log  off;
}

and
vi /etc/nginx/conf/conf.d/itSSL.conf
I add the text: here http2 appeared on the second line if everything was done correctly before then the site will start serving content to browsers in h2

server {
listen       443 ssl http2;
listen [::]:443 ssl http2;
    server_name es.itcooky.com en.itcooky.com www.itcooky.com itcooky.com;
    ssl_certificate /etc/letsencrypt/live/itcooky.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/itcooky.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/itcooky.com/chain.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;
    add_header Strict-Transport-Security "max-age=31536000";
    add_header Content-Security-Policy "img-src https: data:; upgrade-insecure-requests";


access_log  off;
location / {
        root   /usr/local/www/itcooky.com;
        index  index.php index.html index.htm;
    }



    error_page  404              /404.html;
location = /404.html {
     root   /usr/local/www/itcooky.com;
 }
error_page 500 /500.html;
location = /500.html {
        root   /usr/local/www/itcooky.com;
    }
error_page 502 /502.html;
location = /502.html {
        root   /usr/local/www/itcooky.com;
    }
error_page 503 /503.html;
location = /503.html {
        root   /usr/local/www/itcooky.com;
    }
error_page 504 /504.html;  
location = /504.html {
        root   /usr/local/www/itcooky.com;
    }


    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    location ~ \.php$ {
        root           /usr/local/www/itcooky.com;
        fastcgi_pass   unix:/var/run/php.sock; 
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }

location ~ .(gif|png|jpeg|jpg|svg)$ {
root           /usr/local/www/itcooky.com;
     valid_referers none blocked ~.google. ~.bing. ~.yahoo. ~.yandex. itcooky.com *.itcooky.com;
     if ($invalid_referer) {
        return   403;
    }
}
    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }
}

I also add so that nothing is shown on IP
vi /etc/nginx/conf/conf.d/ipnull.conf
code

server {
    listen      80 default_server;
    listen [::]:80 default_server; 
    server_name 195.201.94.20;
    return      444;
}

in 443 there will already be a certificate error, I don't know how to make it more beautiful ...

Restart nginx
service nginx restart

Now go to your domain registrar's personal account and change the A records to IP4 of the new server, as well as the AAAA records to IP6! For the RU zone, the changes are activated instantly, for COM in one hour.

CAUTION: Before adding AAAA records, you must make sure that your domain's NS server supports IP6. If it is not supported and you have added AAAA records, that may cause some internet services that have IP6 in priority to malfunction, for example FeedBurner or renewal of LetsEncrypt certificates. This is my case, the R01 (RU-CENTER Group) registrar allowed to add AAAA records on its NS server, but it doesn't work with IP6!

Well, I still want IP6, Hertzner gives his DNS in my personal account, let's go.
The process of adding your domain is more or less clear, all records will be copied automatically, you just need to add AAAA records, and I got confused here

The personal account indicates
IPv6 2a01:4f8:c2c:96ca::/64
This is a range, DNS will not accept this record

Add to DNS
2a01:4f8:c2c:96ca::
it will also be wrong

I look at the server what IP6 is on the interface
ifconfig
this
2a01:4f8:c2c:96ca::1

I indicate it in DNS Hertzner. Here one more difference was found, to refer to a domain without everything (without www) it is necessary to write instead of the empty space @ , the Russian registrar had an empty space!

In total that's the number of records I have

After that, you need to add in your domain registrar account, the Hetzner NS server and after 12 hours the site will start to be approved for IP6
Lets checked if everything worked, yes of course it worked, I've already done it a hundred times!

IP6 verification was faster on this site ipv6-test.com

This is how you can verify that http2 works on the site http2.pro

Рубрика PC recepi

One Response to “Installing http2 site on cloude(VPS) hosting HETZNER in Germany!”

1. How to migrate a website with WordPress and a phpBB forum from CentOS to Ubuntu on Hetzner! « ITCooky Recipes says:

   September 4, 2022 at 6:01 am

   […] is not my first migration, of course, and in Hetzner is the second, here is the first described Installing http2 site on cloude(VPS) hosting HETZNER in Germany! I won’t write in detail about how to create a VPS there, I created a VPS just the same and […]

   Reply