Setup a simple web server with bozohttpd on NetBSD

查看原文 / View Original 编辑 / Edit

Setup a simple web server with bozohttpd on NetBSD

在 NetBSD 上使用 bozohttpd 搭建简易 Web 服务器

bozohttpd.rocks Setup a simple web server with bozohttpd on NetBSD. If you’d prefer to use OpenBSD, check out httpd.rocks. If you’d prefer to use something like Caddy instead, check out caddy.ninja. bozohttpd.rocks 介绍了如何在 NetBSD 上搭建一个简单的 Web 服务器。如果你更倾向于使用 OpenBSD，请查看 httpd.rocks；如果你想使用像 Caddy 这样的工具，请查看 caddy.ninja。

Before You Begin…

开始之前……

This guide assumes you have already setup NetBSD on your desired server of choice. If you need help setting up NetBSD on a VPS, check out the official guide here. Most commands will need to run with elevated permissions. For this we will use NetBSD’s priv. You will need to install priv from packages. 本指南假设你已经在目标服务器上安装好了 NetBSD。如果你需要关于在 VPS 上安装 NetBSD 的帮助，请查看此处的官方指南。大多数命令需要以提升的权限运行，为此我们将使用 NetBSD 的 priv 工具。你需要从软件包中安装 priv。

Make sure you create a file for your user entry under /usr/pkg/etc/priv/your-username: 请确保在 /usr/pkg/etc/priv/your-username 下为你的用户创建一个条目文件：

# run as root for any command
0:root:01160:

All the examples in this guide will use bozo.httpd.rocks for the domains (how meta…). Please remember to change this to your desired URL. 本指南中的所有示例都将使用 bozo.httpd.rocks 作为域名（多么元化的示例……）。请记得将其更改为你想要的 URL。

Prep Your Domain(s)

准备你的域名

Make sure your DNS records are setup and working as intended with your desired domain. You can check their status with: 确保你的 DNS 记录已设置完毕，并能按预期解析你的域名。你可以通过以下命令检查其状态：

dig bozo.httpd.rocks

Website Files

网站文件

Place your website files in the proper directory. For this guide we will be placing all files into /var/www/bozo.httpd.rocks. 将你的网站文件放置在合适的目录中。在本指南中，我们将把所有文件放入 /var/www/bozo.httpd.rocks。

Configuring inetd.conf

配置 inetd.conf

inetd executes a fresh httpd per connection, so it reads the cert files at the start of every request. (Not the best for performance, but for our simple requirements it’s fine!) Place the following in your /etc/inetd.conf file: inetd 会为每个连接执行一个新的 httpd 进程，因此它会在每次请求开始时读取证书文件。（这对性能来说不是最优的，但对于我们的简单需求来说已经足够了！）将以下内容放入你的 /etc/inetd.conf 文件中：

http stream tcp nowait:600 _httpd /usr/libexec/httpd httpd /var/www/bozo.httpd.rocks

Start bozohttpd

启动 bozohttpd

Start bozohttpd on port 80 only. We don’t need to worry about TLS right now. We start the web server by reloading inetd, since that is where we call it: 仅在 80 端口启动 bozohttpd。我们现在不需要担心 TLS。我们通过重载 inetd 来启动 Web 服务器，因为我们是在那里调用它的：

/etc/rc.d/inetd restart

Setup HTTPS

设置 HTTPS

First, we need to install acme-client from packages: 首先，我们需要从软件包中安装 acme-client：

pkgin install acme-client

Next we create all the directories / sub-directories that will be required in the following steps: 接下来，我们创建后续步骤所需的所有目录/子目录：

mkdir -p /etc/acme
mkdir -p /var/www/bozo.httpd.rocks/.well-known/acme-challenge
mkdir -p /etc/openssl/private
chmod 700 /etc/openssl/private

Configuring acme-client.conf

配置 acme-client.conf

Write to /usr/pkg/etc/acme-client.conf. Make sure to change the domain and directory path to match your own! 编辑 /usr/pkg/etc/acme-client.conf。请务必更改域名和目录路径以匹配你自己的设置！

authority letsencrypt {
    api url "https://acme-v02.api.letsencrypt.org/directory"
    account key "/etc/acme/letsencrypt-privkey.pem"
}

domain bozo.httpd.rocks {
    domain key "/etc/openssl/private/bozo.httpd.rocks.key"
    domain full chain certificate "/etc/openssl/certs/bozo.httpd.rocks.fullchain.pem"
    sign with letsencrypt
    challengedir "/var/www/bozo.httpd.rocks/.well-known/acme-challenge"
}

Now we can get the certs: 现在我们可以获取证书了：

acme-client -vAD bozo.httpd.rocks

If everything worked correctly, those new key and pem files should exist. Feel free to double check: 如果一切正常，那些新的 key 和 pem 文件应该已经存在。你可以随时检查一下：

ls -l /etc/openssl/private/bozo.httpd.rocks.key /etc/openssl/certs/bozo.httpd.rocks.fullchain.pem

Important: Before moving on, we need to: 重要提示：在继续之前，我们需要：

  1. Tweak the permissions of our cert files to avoid unwanted errors
  2. 调整证书文件的权限以避免不必要的错误
  3. Setup a simple cronjob to check our cert expiry dates daily
  4. 设置一个简单的 cron 任务，每天检查证书过期日期

Tweaking Permissions

调整权限

priv chown root:wheel /etc/openssl/private/bozo.httpd.rocks.key
priv chmod 600 /etc/openssl/private/bozo.httpd.rocks.key
priv chgrp wheel /etc/openssl/private
priv chmod 700 /etc/openssl/private

Running a Daily cronjob

运行每日 cron 任务

You’ll want to setup this cron entry under root: 你需要在 root 用户下设置此 cron 条目：

priv crontab -e

Then setup something simple: 然后设置一个简单的任务：

0 3 * * * acme-client bozo.httpd.rocks && /etc/rc.d/inetd restart

Updating inetd.conf to Support HTTPS

更新 inetd.conf 以支持 HTTPS

Return to the original inetd.conf file and include support for https: 回到原始的 inetd.conf 文件并加入对 https 的支持：

http stream tcp nowait:600 _httpd /usr/libexec/httpd httpd /var/www/bozo.httpd.rocks
https stream tcp nowait:600 root /usr/libexec/httpd httpd -U _httpd -Z /etc/openssl/certs/bozo.httpd.rocks.fullchain.pem /etc/openssl/private/bozo.httpd.rocks.key /var/www/bozo.httpd.rocks

You might have noticed that we use root user for the https instance. This is required to avoid issues with running our acme-client job above. Now restart inetd one last time: 你可能已经注意到我们为 https 实例使用了 root 用户。这是为了避免运行上述 acme-client 任务时出现问题。现在最后一次重启 inetd：

/etc/rc.d/inetd restart

That’s it! Enjoy your web server! 就是这样！尽情享受你的 Web 服务器吧！

What About Multiple Websites?

多个网站怎么办？

Don’t worry! I’ve got you covered. The following assumes you completed everything above this section. 别担心！我已经为你准备好了。以下内容假设你已经完成了本节之前的所有步骤。

Updating acme-client.conf

更新 acme-client.conf

We will make a new key/pem pair (calling it websites) that will be shared across all of our hosted domains. The first step is to include these “alternate” domains inside our acme-client.conf file: 我们将创建一个新的 key/pem 对（命名为 websites），它将在我们所有托管的域名之间共享。第一步是在我们的 acme-client.conf 文件中包含这些“备用”域名：

authority letsencrypt {
    api url "https://acme-v02.api.letsencrypt.org/directory"
    account key "/etc/acme/letsencrypt-privkey.pem"
}

domain bozo.httpd.rocks {
    domain key "/etc/openssl/private/websites.key"
    domain full chain certificate "/etc/openssl/certs/websites.fullchain.pem"
    alternative names { example.com example.org example.net }
    sign with letsencrypt
    challengedir "/var/www/acme"
}

使用符号链接解决问题！

You’ll need to “trick” acme-client (in the next steps) into targeting the shared .well-known directory. This will need to be done for each domain: 你需要（在接下来的步骤中）“欺骗” acme-client，使其指向共享的 .well-known 目录。这需要为每个域名执行一次：

priv mkdir -p /var/www/example.com/.well-known
priv ln -sf /var/www/acme /var/www/example.com/.well-known/acme-challenge

Updating inetd.conf

更新 inetd.conf

We need to slightly tweak our existing inetd.conf file and utilize bozohttpd’s -v & -V parameters: 我们需要稍微调整现有的 inetd.conf 文件，并利用 bozohttpd 的 -v 和 -V 参数：

http stream tcp nowait:600 _httpd /usr/libexec/httpd httpd -v /var/www -V default /var/www/default

Also be sure to remove the specific https line entirely. After making those changes you can restart inetd: 同时确保完全删除之前的 https 行。完成这些更改后，你可以重启 inetd：

priv /etc/rc.d/inetd restart

And now run through acme-client to grab the new certs: 现在运行 acme-client 来获取新证书：

priv acme-client -v bozo.httpd.rocks

Editing rc.conf

编辑 rc.conf

Now we make some simple adjustments to our /etc/rc.conf file: 现在我们对 /etc/rc.conf 文件做一些简单的调整：

httpd=YES
httpd_flags="-v /var/www -V -U _httpd -Z /etc/openssl/certs/websites.fullchain.pem /etc/openssl/private/websites.key"
httpd_wwwdir="/var/www/default"

and reload that as well: 并重载它：

priv /etc/rc.d/httpd restart
← 返回新闻列表 / Back to news list