Edgewall Software

Changes between Version 25 and Version 26 of TracNginxRecipe


Ignore:
Timestamp:
Jan 25, 2016, 4:52:37 PM (8 years ago)
Author:
figaro
Comment:

Further cosmetic changes

Legend:

Unmodified
Added
Removed
Modified

  • TracNginxRecipe

    v25 v26  
     1[[PageOutline(2-5,Contents,pullout)]]
     2
    13= Using Nginx as your main web server for multiple Trac Projects
    24
    3 This recipe below is actually a very simple setup but the instructions did not make it obvious. This setup is perfect if you use Nginx as your main webserver. First you set up Nginx as your main web server and then you set up multiple instances of Tracd Web Server. Trac has an embedded webserver that is included in Trac and called Tracd. Then you have Nginx serve requests to your Tracd web server instances.
     5This recipe below describes some setups where [http://www.nginx.net/ Nginx] is your main webserver. Nginx is an Apache replacement by [http://sysoev.ru/en/ Igor Sysoev]. First set up Nginx as your main web server and then set up multiple instances of Tracd Web Server. Trac has an embedded webserver that is included in Trac and called Tracd. Then you have Nginx serve requests to your Tracd web server instances.
    46
    57== Why you should use Tracd behind Nginx
    68
    7 This is an easy set up which allows Nginx to act as an excellent load balancer.  Tracd is lightweight and fast and its easy to get working with your Trac projects.  You can start multiple instances of the Tracd web server on different ports for different Trac projects.  Nginx as your main webserver can serve requests to these various running instances of the Tracd web server.  This also works for multiple Trac Projects on multiple vhosts.  In short its fast, lightweight, and easy to set up.
    8 
    9 Here are the steps you need to take.
     9This is a setup where Nginx acts as a load balancer. Tracd is lightweight and fast and it is easy to get working with Trac. You can start multiple instances of the Tracd web server on different ports for different Trac projects. Nginx as your main webserver can serve requests to these instances of the Tracd web server. This also works for multiple Trac Projects on multiple vhosts. In short it's fast, lightweight, and easy to set up.
     10
     11Here are the steps you need to take:
    1012
    1113 1. Set up Nginx as your main webserver on port 80.
    12  1. Start multiple instances of the Tracd embedded web server on different ports for each Trac Project.
    13  1. Configure Nginx to serve requests to your various running instances of Tracd Webserver.
     14 1. Start multiple instances of the Tracd embedded web server on different ports for each Trac project.
     15 1. Configure Nginx to serve requests to your various running instances of Tracd webserver.
    1416
    1517== Using Tracd with Nginx in Cluster Mode
    16 I am intensely dissatisfied with Trac and Apache. We have multiple vhosts, and multiple Trac sites per vhost. When we tried upgrading from Subversion 1.2.3 we hit [ticket:2611 this bug]:
    17  * apache/mod_python still occasionally segfaults.
     18
     19When using Trac and Apache with multiple vhosts, and multiple Trac sites per vhost, and upgrading from Subversion 1.2.3 to 1.4, we hit [ticket:2611 this bug]:
     20 * apache/mod_python occasionally segfaults.
    1821 * apache/mod_python was causing strange occasional delays, likely related to the segfaults.
    19  * We would like to upgrade to SVN 1.4
    20 
    21 '''Caveat''': Only use this with PostgreSQL. If you want to do this, but are on SQLite, then use Pacopablos [http://trac-hacks.org/wiki/SqliteToPgScript Sqlite-to-Pg]. We use it here, and it's great.
     22
     23'''Caveat''': Only use this with PostgreSQL. If you want to do this, but are on SQLite, then use Pacopablos [http://trac-hacks.org/wiki/SqliteToPgScript Sqlite-to-Pg] script. We use it here, and it's great.
    2224
    2325== Tracd - Trac's light and fast embedded web server
    … …  
    2527Run multiple tracd instances. This offers a speed benefit if you use [http://fasterfox.mozdev.org/ FasterFox], as well as good concurrency responsiveness.
    2628
    27 Using the Gentoo init system, it was easy to create simple init scripts (which I attached to this page). Here is a simplified example, which makes for easier wiki'ing:
     29Using the Gentoo init system, it was easy to create simple init scripts, which are attached to this page. Here is a simplified example:
    2830
    2931'''Multi-Site tracd Startup''': works with Trac-0.10 and up:
    … …  
    3739== Nginx
    3840
    39 Install [http://www.nginx.net/ Nginx], the Excellent Apache Replacement by [http://sysoev.ru/en/ Igor Sysoev]. All examples are based on Gentoo and the Gentoo package is under /etc/nginx.
    40 
    41 Sample /etc/nginx/nginx.conf:
    42 {{{
    43 #!nginx
     41Install Nginx. All examples are based on Gentoo and the Gentoo package is under `/etc/nginx`.
     42
     43Sample `/etc/nginx/nginx.conf`:
     44{{{#!nginx
    4445http {
    4546  include         /etc/nginx/mime.types;
    … …  
    6162          error_log       /var/log/nginx/live.error_log info;
    6263 
     64          location / {
     65                  proxy_pass      http://live_trachosts_com;
     66                  include         /etc/nginx/proxy.conf;
     67                  # if your system doesn't have the proxy.conf file, add the following two lines to get redirects working:
     68                  # proxy_redirect on;
     69                  # proxy_set_header Host $host;
     70          }
     71 
     72  }
     73}}}
     74
     75== Nginx + SSL
     76
     77Here is what we do for SSL in `/etc/nginx/nginx.conf`:
     78{{{#!nginx
     79http {
     80  include         /etc/nginx/mime.types;
     81  default_type    application/octet-stream;
     82
     83  include         /etc/nginx/nginx-defaults.conf;
     84
     85  upstream live_trachosts_com {
     86          server  127.0.0.1:3050;
     87          server  127.0.0.1:3051;
     88          #[... up to the number of instance, or more, if you want to be free to add more ...]
     89  }
     90 
     91  server {
     92          listen          192.168.1.254:80;
     93          server_name     live.trachosts.com live;
     94 
     95          access_log      /var/log/nginx/live.access.log main;
     96          error_log       /var/log/nginx/live.error_log info;
     97 
     98          location / {
     99                  rewrite         ^/(.*)$ https://imrlive.com/$1 redirect;
     100          }
     101 
     102  }
     103  server {
     104          listen          192.168.1.254:443;
     105          server_name     live.trachosts.com live;
     106 
     107          access_log      /var/log/nginx/live.access.log main;
     108          error_log       /var/log/nginx/live.error_log info;
     109 
     110          ssl                  on;
     111          ssl_certificate      /etc/nginx/ssl/_nginx.cert;
     112          ssl_certificate_key  /etc/nginx/ssl/traclive.key;
     113          keepalive_timeout    70;
     114          add_header           Front-End-Https    on;
     115
    63116          location / {
    64117                  proxy_pass      http://live_trachosts_com;
    … …  
    70123 
    71124  }
    72 }}}
    73 
    74 == Nginx + SSL
    75 
    76 Here is what we do for SSL in /etc/nginx/nginx.conf:
    77 {{{
    78 #!nginx
    79 http {
    80   include         /etc/nginx/mime.types;
    81   default_type    application/octet-stream;
    82 
    83   include         /etc/nginx/nginx-defaults.conf;
    84 
    85   upstream live_trachosts_com {
    86           server  127.0.0.1:3050;
    87           server  127.0.0.1:3051;
    88           #[... up to the number of instance, or more, if you want to be free to add more ...]
    89   }
    90  
    91   server {
    92           listen          192.168.1.254:80;
    93           server_name     live.trachosts.com live;
    94  
    95           access_log      /var/log/nginx/live.access.log main;
    96           error_log       /var/log/nginx/live.error_log info;
    97  
    98           location / {
    99                   rewrite         ^/(.*)$ https://imrlive.com/$1 redirect;
    100           }
    101  
    102   }
    103   server {
    104           listen          192.168.1.254:443;
    105           server_name     live.trachosts.com live;
    106  
    107           access_log      /var/log/nginx/live.access.log main;
    108           error_log       /var/log/nginx/live.error_log info;
    109  
    110           ssl                  on;
    111           ssl_certificate      /etc/nginx/ssl/_nginx.cert;
    112           ssl_certificate_key  /etc/nginx/ssl/traclive.key;
    113           keepalive_timeout    70;
    114           add_header           Front-End-Https    on;
    115 
    116           location / {
    117                   proxy_pass      http://live_trachosts_com;
    118                   include         /etc/nginx/proxy.conf;
    119                   # my system doesn't have the proxy.conf file so I needed to add the following two lines to get redirects working:
    120                   # proxy_redirect on;
    121                   # proxy_set_header Host $host;
    122           }
    123  
    124   }
    125125}
    126126}}}
    … …  
    128128=== Static Content
    129129
    130 Serving static files from htdocs dir ala /<site>/chrome/site aliases `http://live.trachosts.com/myproj/chrome/site` to `/var/trachosts/trac/myproj/htdocs`
    131 {{{
    132 #!nginx
     130Serving static files from htdocs dir ala /<site>/chrome/site aliases `http://live.trachosts.com/myproj/chrome/site` to `/var/trachosts/trac/myproj/htdocs`:
     131{{{#!nginx
    133132        location ~ /(.*?)/chrome/site/ {
    134133                rewrite /(.*?)/chrome/site/(.*) /$1/htdocs/$2 break;
    135134                root    /var/trachosts/trac;
    136135        }
    137 
    138136}}}
    139137
    140138== Subversion
    141139
    142 This section can be skiped if you're using tracd and start it as follows:
    143 {{{
     140This section can be skipped, if you're using tracd and start it as follows:
     141{{{#!sh
    144142/usr/bin/python /usr/bin/tracd -d -p 3050 --basic-auth projec1,/var/www/trac/project1/db/users.htdigest,svn --pidfile=/var/www/trac/tracd.3050 --protocol=http -e /var/www/trac
    145143}}}
    146144
    147 We still need to get access to subversion via Apache mod_dav_svn. I created a vhost in apache for _only_ the svn URLs. Other people might not use this setup.
    148 
    149 {{{
    150 #!apache
     145We still need to get access to Subversion via Apache mod_dav_svn. I created a vhost in Apache for _only_ the svn URLs. Other people might not use this setup.
     146
     147{{{#!apache
    151148Listen 127.0.0.1:80
    152149<VirtualHost *:80>
    153150    ServerAdmin webmaster@trachosts.com
    154151
    155     # in order to support COPY and MOVE, etc -  over https (443),
     152    # in order to support COPY and MOVE, etc - over https (443),
    156153    # ServerName _must_ be the same as the nginx servername
    157154    ServerName live.trachosts.com
    … …  
    185182
    186183Add this to the server section of the Nginx config, in the :80 line, or the :443:
    187 {{{
    188 #!nginx
     184{{{#!nginx
    189185location /svn {
    190186        proxy_pass      http://127.0.0.1:80;
    … …  
    201197
    202198`start-meta-site.sh`:
    203 {{{
    204 #!sh
     199{{{#!sh
    205200INSTANCES="3050 3051 3052 3053 3054 3055 3056"
    206201USER="apache"
    … …  
    230225
    231226`start-single-site.sh`
    232 {{{
    233 #!sh
     227{{{#!sh
    234228INSTANCES="3050 3051 3052"
    235229USER="apache"
    … …  
    265259
    266260`/usr/local/etc/rc.d/trac`:
    267 {{{
    268 #!sh
     261{{{#!sh
    269262#!/bin/sh
    270263#
    … …  
    422415== Handling authentication in Nginx
    423416
    424 If you want to handle the authentication in Nginx rather than trac, that is also possible. Since you are proxying the tracd server from Nginx, you just have to tell Nginx to forward the Authorization header to tracd, and be sure to use the same authentication scheme in both (Basic / Digest). Also, both Nginx and trac must access the same password file, or an identical copy. As a simple example, let's assume you are using Basic authentication. Digest would be very similar.
     417If you want to handle the authentication in Nginx rather than through Trac, that is also possible. Since you are proxying the tracd server from Nginx, you just have to tell Nginx to forward the authorization header to tracd, and use the same authentication scheme in both (Basic / Digest). Also, both Nginx and Trac must access the same password file, or an identical copy. As a simple example, let's assume you are using Basic authentication. Digest would be very similar.
    425418
    426419This is the Nginx configuration snippet:
    427 {{{
    428 #!nginx
     420{{{#!nginx
    429421server {
    430422        location / {
    … …  
    438430
    439431And then, you can start tracd with the following command if you use multi-project setup (notice the *):
    440 {{{
    441 #!sh
     432{{{#!sh
    442433tracd --port=8000 --hostname=127.0.0.1 --env-parent-dir=/home/trac --basic-auth="*,/etc/nginx/htpasswd,Restricted"
    443434}}}
     435
    444436Or the following command if you run one tracd per project:
    445 {{{
    446 #!sh
     437{{{#!sh
    447438tracd --port=8000 --single-env /path/to/trac/environments/project --basic-auth="project,/etc/nginx/htpasswd,Restricted"
    448439}}}
     440
    449441You can adjust those commands to your specific needs (daemonize, etc).
    450442
    451 == Todo ==
     443== Todo
     444
    452445 * Post the actual config files ''somewhere''.
    453446
    454 == Questions ==
     447== Questions
     448
    455449 * is this possible with client certificate authentication?
    456450
    457451----
    458452See also TracFastCgi#SimpleNginxConfiguration1
    459 {{{
    460 #!sh
     453
     454{{{#!sh
    461455          if [ $? -eq 0 ]
    462456           then