nginx magento ssl postfix - server and do-it-yourself shop

The last post was about building a server from source.
Many said that now this is not rolling, give them packages.

But mostly it was whining, like - I’m smarter than you, you don’t work correctly, the config is not a boy’s ... no one said how to fix it, where to do it correctly and differently, what other configuration options are there, and so on. Yes, and heck with him, everyone has his views, I accept it.
Yet someone took note of himself, well, someone passed by.
Why am I writing about this? There are websites, forums with mailing lists, there are many manuals, but people continue to go crazy in search of a normal explanation of the settings and settings. They pay other grief to specialists, and they put everything crooked and not full configs, without optimization. And if there is no difference - why pay more (c) ??? Anyone would like to set up their server and put the store, and for a start he needs a start, to show that it is very simple, what can be saved at the beginning, then, when everything works, think about it - is it so difficult? But can I continue to do everything myself? to do better picking up the experience? Yes, everything can be done by yourself. Not for nothing the old wisdom says - if you want it to be good, do it yourself!

In order not to write empty, we will specifically do the installation and launch of the server for the store, under management - MAGENTO 1.4.0.1
')

================================================= ===========================

I rummaged through no, and found an interesting site and repository with the latest versions of packages for Sentos 5.
here is the repository itself:
centos.alt.ru/pub/repository/centos/5/i386

Install repository

The CentALT repository requires the EPEL repository to work.
Installation is the same as always:

1. Install the epel repository.
rpm -ihv download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-3.noarch.rpm

2. Install the CentALT repository.
rpm -ihv centos.alt.ru/repository/centos/5/i386/centalt-release-5-3.noarch.rpm

and then the end of the line implies pressing -enter- :)

We look that it is possible and it is necessary to update:

# yum list updates
# yum update

Look what is installed

# rpm -qa
# yum list installed

Install the necessary software:

# yum install nginx
# yum install php-fpm php-mysql php-gd php-mcrypt php-dom
# yum install mysql-server
# yum install openssl
# yum install vsftpd
# yum install postfix dovecot
# yum install phpmyadmin
# yum update

We include autostart services:

# / sbin / chkconfig nginx on
# / sbin / chkconfig mysqld on
# / sbin / chkconfig php-fpm on
# / sbin / chkconfig dovecot on

# /etc/init.d/sendmail stop
# / sbin / chkconfig sendmail off

Now we need to remove the installed sendmail package:
# yum remove sendmail

# / sbin / chkconfig postfix on
# /etc/init.d/postfix start

link phpMyAdmin to our working directory
# find / -name 'phpmyadmin *'
# ln -s / usr / share / phpMyAdmin version? / var / www / html / phpmyadmin

If you need to use ssl, generate a certificate request and server key:

The trick is that now you can get a certificate for free, your hoster or domain registrar should have an affiliate with COMODO, when you buy a domain or server, they are given a certificate.

# cd
# openssl req -nodes -newkey rsa: 1024 -keyout myserver.key -out server.csr

server.csr -> filling out, answering all the questions

support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=3&nav=0 , 96.1

Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []: IT
Common Name (eg, YOUR name) []: www.mysite.com
Email Address []:

A challenge password []:
An optional company name []:

open the file and send the data through
a special form from the provider to issue a certificate.

Further, having received all necessary certificates from the provider, we put them all in one bundle:
see instructions
# support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=1209

We throw everything in the root directory, for example.

then we move all this to the folder from where nginx will read all https for requests
# mkdir / etc / nginx / cert
# cd
# mv myserver.key / etc / nginx / cert /
# mv bundle.crt / etc / nginx / cert /

Configuring nginx (/etc/nginx/nginx.conf file).

# In this example, the store is located on the path / in the / var / www / html / folder.
# for php used PHP-FPM connected via unix socket.

### config starts ### <br/>
<br/>
# USER - , . <br/>
# , , . <br/>
user nginx;<br/>
<br/>
# . <br/>
worker_processes 1 ;<br/>
<br/>
error_log /var/log/nginx/error.log;<br/>
<br/>
# , . <br/>
pid /var/run/nginx.pid;<br/>
# <br/>
events {<br/>
worker_connections 1024 ;<br/>
}<br/>
<br/>
http {<br/>
# include - . . <br/>
include /etc/nginx/mime.types;<br/>
default_type application/octet-stream;<br/>
<br/>
# <br/>
# configure log format <br/>
# log_format main '$remote_addr - $remote_user [$time_local] ' <br/>
# '"$request" $status $body_bytes_sent "$http_referer" ' <br/>
# '"$http_user_agent" "$http_x_forwarded_for"'; <br/>
# access_log /var/log/nginx/access.log main; <br/>
# <br/>
<br/>
# Linux FreeBSD 4.x. <br/>
# . <br/>
tcp_nopush on ;<br/>
# keep-alive. <br/>
# ( , ) <br/>
tcp_nodelay off ;<br/>
<br/>
sendfile on ; # sendfile(). <br/>
keepalive_timeout 65 ; # . <br/>
<br/>
# ngx_http_gzip_module - , gzip, 2 . <br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_gzip_module.html <br/>
gzip on ; # gzip. <br/>
gzip_proxied any; # . <br/>
# gzip MIME- "text/html". "text/html" ! <br/>
gzip_types text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript; <br/>
gzip_http_version 1.1 ;<br/>
<br/>
# FastCGI-. <br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_fastcgi_module.html <br/>
fastcgi_connect_timeout 300 ;<br/>
fastcgi_send_timeout 300 ;<br/>
fastcgi_read_timeout 300 ;<br/>
# , , FastCGI-. <br/>
fastcgi_buffer_size 64k;<br/>
# , , FastCGI-. <br/>
fastcgi_buffers 4 64k;<br/>
<br/>
# fastcgi nodes <br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_upstream.html#upstream <br/>
# . <br/>
upstream backend {<br/>
server unix:/tmp/fcgi.sock; # unix <br/>
}<br/>
<br/>
# . <br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_core_module.html#server <br/>
server {<br/>
<br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_core_module.html#listen <br/>
# , . <br/>
listen 80 ; <br/>
<br/>
# . <br/>
# , , unix-. <br/>
# , . <br/>
server_name www.name.com; # <br/>
root /var/www/html; # . <br/>
autoindex off ; # , directory listing - off <br/>
<br/>
# URI, . <br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_core_module.html#error_page <br/>
error_page 404 error/404.html;<br/>
error_page 502 503 504 error/500.html;<br/>
# error_page 404 = @magento; <br/>
<br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_core_module.html#location <br/>
# URI . <br/>
# , ... <br/>
location ~ (/(app/|includes/|lib/|pkginfo/|var/|report/config.xml)|/\.svn/|/.hta.+)<br/>
{<br/>
deny all ; # ... <br/>
}<br/>
<br/>
# <br/>
location ~ (\.php|/downloader/?|/report/?)$ {<br/>
try_files /error/404.html $uri/ = 404 ;<br/>
# FastCGI-. <br/>
fastcgi_pass backend;<br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_fastcgi_module.html <br/>
include /etc/nginx/fastcgi_params;<br/>
fastcgi_param script_FILENAME $document_root$fastcgi_script_name;<br/>
}<br/>
<br/>
# <br/>
# <br/>
location = /downloader { rewrite ^ /downloader/ permanent; }<br/>
<br/>
# <br/>
location = /downloader/ {<br/>
try_files /error/404.html $uri/ = 404 ;<br/>
fastcgi_pass backend;<br/>
include /etc/nginx/fastcgi_params;<br/>
fastcgi_param script_FILENAME $document_root/downloader/index.php;<br/>
}<br/>
<br/>
location = /report { rewrite ^ /report/ permanent; }<br/>
<br/>
location = /report/ {<br/>
try_files /error/404.html $uri/ = 404 ;<br/>
fastcgi_pass backend;<br/>
include /etc/nginx/fastcgi_params;<br/>
fastcgi_param script_FILENAME $document_root/report/index.php;<br/>
}<br/>
<br/>
location / {<br/>
# set expire headers <br/>
if ($request_uri ~* " \. (ico|css|js|gif|jpe?g|png)$" ) {<br/>
expires max; # http://sysoev.ru/nginx/docs/http/ngx_http_headers_module.html#expires <br/>
}<br/>
# "@" location. <br/>
# location , <br/>
# . <br/>
try_files $uri $uri/ @magento;<br/>
index index.php;<br/>
expires max;<br/>
}<br/>
<br/>
# "@" ( ) <br/>
location @magento {<br/>
fastcgi_pass backend;<br/>
include /etc/nginx/fastcgi_params;<br/>
fastcgi_param script_FILENAME $document_root/index.php;<br/>
}<br/>
} <br/>
<br/>
# HTTPS , , , . <br/>
# <br/>
server {<br/>
listen 443 ; # SSL port <br/>
server_name www.name.com;<br/>
root /var/www/html;<br/>
autoindex off ;<br/>
<br/>
# error_page 404 495 496 497 error/400.html; <br/>
# error_page 502 503 504 error/500.html; <br/>
<br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_ssl_module.html <br/>
ssl on ; # HTTPS . <br/>
ssl_protocols SSLv3 TLSv1; # . <br/>
ssl_ciphers HIGH:!ADH:!MD5; # . <br/>
# , SSLv3 TLSv1 , . <br/>
ssl_prefer_server_ciphers on ;<br/>
<br/>
# CA . <br/>
ssl_certificate /etc/nginx/cert/bundle.crt;<br/>
# . <br/>
ssl_certificate_key /etc/nginx/cert/myserver.key;<br/>
<br/>
# . <br/>
ssl_session_cache shared:SSL:10m;<br/>
# , , <br/>
ssl_session_timeout 10m;<br/>
<br/>
<br/>
keepalive_timeout 65 ;<br/>
<br/>
# http://sysoev.ru/nginx/docs/http/ngx_http_headers_module.html#add_header <br/>
add_header Front-End-Https on ;<br/>
<br/>
location ~ (/(app/|includes/|lib/|pkginfo/|var/|report/config.xml)|/\.svn/|/.hta.+)<br/>
{<br/>
deny all ;<br/>
}<br/>
<br/>
location ~ (\.php|/downloader/?|/report/?)$ {<br/>
try_files /error/404.html $uri/ = 404 ;<br/>
fastcgi_pass backend;<br/>
include /etc/nginx/fastcgi_params;<br/>
fastcgi_param script_FILENAME $document_root$fastcgi_script_name;<br/>
fastcgi_param HTTPS on ; # ssl <br/>
}<br/>
<br/>
location = /downloader { rewrite ^ /downloader/ permanent; }<br/>
<br/>
location = /downloader/ {<br/>
try_files /error/404.html $uri/ = 404 ;<br/>
<br/>
fastcgi_pass backend;<br/>
include /etc/nginx/fastcgi_params;<br/>
fastcgi_param script_FILENAME $document_root/downloader/index.php;<br/>
fastcgi_param HTTPS on ; # ssl <br/>
}<br/>
<br/>
location = /report { rewrite ^ /report/ permanent; }<br/>
<br/>
location = /report/ {<br/>
try_files /error/404.html $uri/ = 404 ;<br/>
<br/>
fastcgi_pass backend;<br/>
include /etc/nginx/fastcgi_params;<br/>
fastcgi_param script_FILENAME $document_root/report/index.php;<br/>
fastcgi_param HTTPS on ; # ssl <br/>
}<br/>
<br/>
location / {<br/>
try_files $uri $uri/ @magento;<br/>
index index.php;<br/>
expires max;<br/>
}<br/>
<br/>
location @magento {<br/>
fastcgi_pass backend;<br/>
include /etc/nginx/fastcgi_params;<br/>
fastcgi_param script_FILENAME $document_root/index.php;<br/>
fastcgi_param HTTPS on ; # ssl <br/>
}<br/>
# phpmyadmin, https://www.mysite.com/phpmyadmin/ <br/>
location = /phpmyadmin { rewrite ^ /phpmyadmin/ permanent; }<br/>
}<br/>
<br/>
} <br/>
<br/>
<br/>
### config ends ### <br/>




PHP-FPM configuration (/etc/php-fpm.conf file). A local socket is used.

 <configuration>
         <section name = "global_options">
                 <value name = "pid_file"> / var / run / php-fpm.pid </ value>
                 <value name = "error_log"> / var / log / php-fpm.log </ value>
                 <value name = "log_level"> notice </ value>
                 <value name = "emergency_restart_threshold"> 10 </ value>
                 <value name = "emergency_restart_interval"> 1m </ value>
                 <value name = "process_control_timeout"> 5s </ value>
                 <value name = "daemonize"> yes </ value>
         </ section>
         <workers>
                 <section name = "pool">
                         <value name = "name"> default </ value>
                         <value name = "listen_address"> / tmp / fcgi.sock </ value>
                         <value name = "listen_options">
                                 <value name = "owner"> </ value>
                                 <value name = "group"> </ value>
                                 <value name = "mode"> 0666 </ value>
                         </ value>
                         <value name = "php_defines">
                         </ value>
                         <value name = "user"> nginx </ value>
                         <value name = "group"> nginx </ value>
                         <value name = "pm">
                                 <value name = "style"> static </ value>
                                 <value name = "max_children"> 10 </ value>
                                 <value name = "apache_like">
                                         <value name = "StartServers"> 20 </ value>
                                         <value name = "MinSpareServers"> 5 </ value>
                                         <value name = "MaxSpareServers"> 35 </ value>
                                 </ value>
                         </ value>
                         <value name = "request_terminate_timeout"> 0s </ value>
                         <value name = "request_slowlog_timeout"> 0s </ value>
                         <value name = "slowlog"> logs / slow.log </ value>
                         <value name = "rlimit_files"> 1024 </ value>
                         <value name = "rlimit_core"> 0 </ value>
                         <value name = "chroot"> </ value>
                         <value name = "chdir"> </ value>
                         <value name = "catch_workers_output"> yes </ value>
                         <value name = "max_requests"> 500 </ value>
                         <value name = "allowed_clients"> 127.0.0.1 </ value>
                         <value name = "environment">
                                 <value name = "HOSTNAME"> $ HOSTNAME </ value>
                                 <value name = "PATH"> / usr / local / bin: / usr / bin: / bin </ value>
                                 <value name = "TMP"> / tmp </ value>
                                 <value name = "TMPDIR"> / tmp </ value>
                                 <value name = "TEMP"> / tmp </ value>
                                 <value name = "OSTYPE"> $ OSTYPE </ value>
                                 <value name = "MACHTYPE"> $ MACHTYPE </ value>
                                 <value name = "MALLOC_CHECK _"> 2 </ value>
                         </ value>
                 </ section>
         </ workers>
 </ configuration>
 </ code> 

Run nginx and php-fpm:

# /etc/init.d/php-fpm start
# /etc/init.d/nginx start

We start mysqld, and we assign the password for mysql

# /etc/init.d/mysqld start
# / usr / bin / mysql_secure_installation

Now add the user and the magento database:

# mysql --user = root -p
# mysql> CREATE USER 'magento' @ 'localhost' IDENTIFIED BY 'my_password';
# mysql> CREATE DATABASE magento;
# mysql> GRANT ALL PRIVILEGES ON `magento`. * TO 'magento' @ '%' WITH GRANT OPTION;

Installing Magento Via SSH

swing here and install magento here
# cd / var / www / html /
# wget www.magentocommerce.com/downloads/assets/1.4.0.1/magento-1.4.0.1.tar.gz

download demo products and installations
# wget www.magentocommerce.com/downloads/assets/1.2.0/magento-sample-data-1.2.0.tar.gz

unpacking
# tar -zxvf magento-1.4.0.1.tar.gz

unpacking
# tar -zxvf magento-sample-data-1.2.0.tar.gz

we collect everything in one pile
# mv magento-sample-data-1.2.0 / media / * magento / media /

pulling up the database
# mv magento-sample-data-1.2.0 / magento_sample_data_for_1.2.0.sql magento / data.sql

and throw everything on the root
# mv magento / * magento / .htaccess.

correct rights
# chmod o + w var var / .htaccess app / etc

correct rights
# chmod -R o + w media

we push the base with your values ​​- DBHOST DBUSER DBPASS DBNAME
# mysql -h DBHOST -u DBUSER -pDBPASS DBNAME <data.sql

setting
# ./pear mage-setup.

setting
# ./pear install magento-core / Mage_All_Latest-stable

we clean the garbage
# rm -rf downloader / pearlib / cache / * downloader / pearlib / download / *

we clean the garbage
# rm -rf magento / magento-sample-data-1.2.0 /

we clean the garbage
# rm -rf magento-1.4.0.1.tar.gz magento-sample-data-1.2.0.tar.gz data.sql

We assign the correct owner to all files:

# cd / var / www /
# chown -R nginx: nginx html

READY !!!

Now go to the magento configuration step, indicating in the browser the address of our installation,
for example www.mysite.com
Must earn magento installation wizard.
In the database settings we specify the user magento (and the password you assigned), the host address is localhost.
Also note the “Skip Base URL validation before next step” flag.

Create FTP user 'masterftp' and password:

centos.name/?page/howto/Install-Vsftpd
-> Configure vsftpd

new user in the nginx group only FTP access:
# useradd -g nginx -s / sbin / nologin masterftp
# passwd masterftp

for a user who is already in the system only FTP access:
# usermod -g nginx -s / sbin / nologin username

FTP server config itself (just in case)
# vi /etc/vsftpd/vsftpd.conf

Start / Stop
# service vsftpd start
# service vsftpd stop

Setting up the soap - we will take everything and forward to another address:

maybe you need a mail user (john)?
# adduser mailuser

Now you need to minimally configure postfix for receiving and sending mail
The most optimal setting option can be found here.
on an example make your own changes
wiki.centos.org/HowTos/postfix#head-761bdd5d364ddb0dcbb4e1fcdc5af9d8f41286e5

Create a file / etc / postfix / virtual for redirection.
# vi / etc / postfix / virtual

We indicate that we accept everything and send further:
@ yourdomain.com mymail@gmail.com

We save.

we specify new mail rules:
# postmap / etc / postfix / virtual

Also put in /etc/postfix/main.cf:
virtual_alias_maps = hash: / etc / postfix / virtual

update mailer:
# service postfix reload

Now run postfix:
# service postfix restart

================================================= ==============
server is configured, the store is running, mail is flying ... beer is pouring ...

Thanks for attention.
sorry if something goes wrong :)