View source for ArchLinux:Services

{{DISPLAYTITLE:{{TitleIcon|arch=true}} Production Services on Arch Linux}}<metadesc>How to run production services on Arch Linux.</metadesc>
<div id="tocalign">__TOC__</div>
{{UnderConstruction}}
{{Back|Arch Linux}}
{{SeeAlso|ArchLinux:KVM|KVM on Arch Linux}}
= {{Icon24|sitemap}} Introduction =
The following are additional (optional) write-ups for setting up specific services inside of VMs.
= {{Icon24|sitemap}} NGINX =
Login to the nginx virtual machine and shut it down. Then edit the virtual machine on the host.
{{Console|1=virsh edit nginx}}
Add a mountpoint for the nginx directory on the host.
{{Console|prompt=false|1=     <nowiki><filesystem type='mount' accessmode='mapped'></nowiki><br/>      <nowiki><source dir='/www/nginx'/></nowiki><br/>      <nowiki><target dir='neutron-nginx'/></nowiki><br/>    <nowiki></filesystem></nowiki>}}
Restart the nginx machine and login via ssh.
{{Console|1=virsh start nginx}}
Create a directory for nginx files.
{{Console|1=sudo mkdir /nginx}}
Set the directory to mount on boot.
{{Console|title=/etc/fstab|prompt=false|1=neutron-nginx	 /nginx	9p	trans=virtio	0	0}}
Reboot the machine to make sure the mounting works.

Install {{mono|nginx-mainline}}.
{{Console|1=pacaur -S nginx-mainline}}
Enable http and https in nftables.
{{Console|title=/etc/nftable.conf|prompt=false|1=tcp dport {http,https} accept}}
Restart nftables to apply the new rules.
{{Console|1=sudo systemctl restart nftables}}
Start and enable the nginx service.
{{Console|1=sudo systemctl enable nginx|2=sudo systemctl start nginx}}
You should be able to visit the IP address of the machine and see the nginx default page.

For configuration first create blank configs and directories needed.
{{Console|1=sudo touch /nginx/nginx.conf /nginx/http.conf|2=sudo mkdir /nginx/logs /nginx/conf.d /nginx/https}}
Set permissions accordingly.
{{Console|1=sudo chown -R http:http /nginx/*}}
Edit the main nginx config, replace all of it with a single include.
{{Console|title=/etc/nginx/nginx.conf|prompt=false|1=include /nginx/nginx.conf}}
Create the actual main configuration, use {{mono|sudo}} to edit the configs.
{{Console|1=sudoedit /nginx/nginx.conf}}
{{margin}}
{{Console|title=/nginx/nginx.conf|prompt=false|1=user http;<br/>worker_processes auto;<br/>worker_cpu_affinity auto;<br/>pcre_jit on;<br/><br/>events {<br/>  worker_connections 4096;<br/>}<br/><br/>error_log /nginx/logs/nginx-error.log;<br/><br/>include /nginx/http.conf;}}
Create the http block configuration.
{{Console|title=/nginx/http.conf|prompt=false|1=http {<br/>  include mime.types;<br/>  default_type application/octet-stream;<br/><br/>log_format main '$remote_addr - $remote_user [$time_local] "$request" '<br/>    '$status $body_bytes_sent "$http_referer" '<br/>    '"$http_user_agent" "$http_x_forwarded_for"';<br/><br/>  access_log /nginx/logs/nginx-access.log main;<br/><br/>  sendfile on;<br/>  tcp_nopush on;<br/>  aio threads;<br/>  charset utf-8;<br/>  keepalive_timeout 65;<br/>  gzip on;<br/>  gzip_disable "msie6";<br/>  limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;<br/>  include /nginx/conf.d/*.conf;<br/>} }}
Then create configs for each website in {{mono|/nginx/conf.d/}} with the naming scheme {{mono|*.conf}}. There is a great post on Stack Overflow<ref>[//stackoverflow.com/questions/41930060/how-do-you-score-a-with-100-on-all-categories-on-ssl-labs-test-with-lets-encry Stack Overflow]. How do you score A+ with 100 on all categories on SSL Labs test with Let's Encrypt and Nginx?</ref> about achieving an A+ rating with 100 points in every category on [//www.ssllabs.com/ssltest/analyze.html?d=kyau.net SSL Labs].
== {{Icon24|notebook}} PHP ==
Install the packages required for PHP.
{{Console|1=pacaur -S php php-fpm php-gd php-intl php-mcrypt php-sqlite imagemagick}}
Open up the main {{mono|php-fpm}} config.
{{Console|title=/etc/php/php-fpm.conf|prompt=false|1=error_log {{=}} /nginx/logs/php-fpm.log}}
Then edit the config for your server instance.
{{Console|title=/etc/php/php-fpm.d/www.conf|prompt=false|1=listen.allowed_clients {{=}} 127.0.0.1<br/>...<br/>php_admin_flag[log_errors] {{=}} on<br/>php_admin_value[error_log] {{=}} /nginx/logs/php.log<br/>php_admin_value[memory_limit] {{=}} 256M<br/>php_admin_value[post_max_size] {{=}} 2048M<br/>php_admin_value[upload_max_filesize] {{=}} 2048M<br/>php_admin_value[date.timezone] {{=}} America/Toronto}}
Open up the PHP config {{mono|/etc/php/php.ini}} and enable the modules: {{mono|bz2}}, {{mono|exif}}, {{mono|gd}}, {{mono|gettext}}, {{mono|iconv}}, {{mono|intl}}, {{mono|mcrypt}}, {{mono|mysqli}}, {{mono|pdo_mysql}}, {{mono|sockets}}, {{mono|sqlite3}} by commenting out the extension lines.
Start and enable the php-fpm service.
{{Console|1=sudo systemctl enable php-fpm|2=sudo systemctl start php-fpm}}
Import all of the web files and update the configs in {{mono|conf.d}} for all websites.
== {{Icon24|notebook}} SSL ==
Using SSL encryption is a must. First install the required packages.
{{Console|1=pacaur -S certbot}}
Bring down nginx temporarily.
{{Console|1=sudo systemctl stop nginx}}
Use certbot to get a certificate for all domains needed.
{{Console|1=sudo certbot certonly --agree-tos --standalone --email your@address.com --rsa-key-size 4096 -d domain.com,www.domain.com,subdomain.domain.com}}
Generate a dhparam.
{{Console|1=sudo openssl dhparam -out /etc/letsencrypt/live/kyau.net/dhparam4096.pem 4096}}
Start back up nginx.
{{Console|1=sudo systemctl start nginx}}
A timer can then be setup to run {{mono|certbot}} twice daily.
{{Console|title=/etc/systemd/system/certbot.timer|prompt=false|1=[Unit]<br/>Description{{=}}Twice daily renewal of Let's Encrypt's certificates<br/><br/>[Timer]<br/>OnCalendar{{=}}0/12:00:00<br/>RandomizedDelaySec{{=}}1h<br/>Persistent{{=}}true<br/><br/>[Install]<br/>WantedBy{{=}}timers.target}}
Also create the service for {{mono|certbot}}.
{{Console|title=/etc/systemd/system/certbot.service|prompt=false|1=[Unit]<br/>Description{{=}}Let's Encrypt renewal<br/><br/>[Service]<br/>Type{{=}}oneshot<br/>ExecStart{{=}}/usr/bin/certbot renew --pre-hook "/usr/bin/systemctl stop nginx.service" --post-hook "/usr/bin/systemctl start nginx.service" --quiet --agree-tos}}
Enable and start the timer.
{{Console|1=sudo systemctl enable certbot.timer|2=sudo systemctl start certbot.timer}}

= {{Icon24|sitemap}} SQL =
Create a directory on the host machine for the nginx and sql server.
{{Console|1=sudo mkdir /www/sql /www/nginx}}
Make sure it has the right permissions.
{{Console|1=sudo chown -R kvm:kvm /www}}
Edit the sql virtual machine to mount the folder inside of the VM.
{{Console|1=sudo virsh edit sql}}
{{margin}}
{{Console|prompt=false|1=…<br/>  <nowiki><filesystem type='mount' accessmode='passthrough'></nowiki><br/>    <nowiki><source dir='/www/sql'/></nowiki><br/>    <nowiki><target dir='neutron-sql'/></nowiki><br/>  <nowiki></filesystem></nowiki><br/>…}}
Shutdown the virtual machine, then restart it back up.

Login to the sql virtual machine and create a directory for SQL.
{{Console|1=mkdir /sql}}
Mount the partition from the HOST system.
{{Console|1=mount neutron-sql /sql -t 9p -o trans{{=}}virtio}}
Also set this to mount on boot.
{{Console|title=/etc/fstab|prompt=false|1=neutron-sql	 /sql	9p	trans{{=}}virtio	0	0}}
After the directory is mounted make sure it has the right permissions.
{{Console|1=sudo chown mysql:mysql /sql|2=sudo chmod 770 /sql}}
Install {{mono|mariadb}}.
{{Console|1=pacaur -S mariadb}}
Initialize the SQL database directory.
{{Console|1=sudo mysql_install_db --user{{=}}mysql --basedir{{=}}/sql/base --datadir{{=}}/sql/db}}
Modify the MySQL global config to support a different basedir, bind to IPv6 in addition to IPv4 and disable filesystem access.
{{Console|title=/etc/mysql/my.cnf|prompt=false|1=…<br/>[mysqld]<br/>bind-address {{=}} ::<br/>port         {{=}} 3306<br/>socket       {{=}} /run/mysqld/mysqld.sock<br/>datadir      {{=}} /sql/db<br/>local-infile {{=}} 0<br/>…<br/>tmpdir       {{=}} /tmp/<br/>…}}
Enable and start the systemd service.
{{Console|1=sudo systemctl enable mariadb|2=sudo systemctl start mariadb}}
Run the MySQL post-install security check, change the remove password and remove all demo/test related material.
{{Console|1=sudo mysql_secure_installation}}
== {{Icon|notebook}} User Setup ==
Open mysql and change the {{mono|root}} username and allow access from the nginx virtual machine.
{{Console|1=mysql -u root -p}}
{{margin}}
{{Console|prompt=false|1={{White|MariaDB>}} RENAME USER 'root'@'localhost' to 'kyau'@'localhost';<br/>{{White|MariaDB>}} RENAME USER 'root'@'127.0.0.1' to 'kyau'@'127.0.0.1';<br/>{{White|MariaDB>}} RENAME USER 'root'@'::1' to 'kyau'@'::1';<br/>{{White|MariaDB>}} GRANT ALL PRIVILEGES ON *.* TO 'kyau'@'142.44.172.255' IDENTIFIED BY 'my-password' WITH GRANT OPTION;<br/>{{White|MariaDB>}} FLUSH PRIVILEGES;}}
Confirm the changes by listing all users.
{{Console|prompt=false|1={{White|MariaDB>}} SELECT User,Host,Password FROM mysql.user;}}
== {{Icon|notebook}} UTF8MB4 ==
Optionally, enable {{mono|UTF8MB4}} support, which is recommended over {{mono|UTF8}} as it will provide full unicode support.
{{Console|title=/etc/mysql/my.cnf|prompt=false|1=[client]<br/>default-character-set {{=}} utf8mb4<br/>…<br/>[mysqld]<br/>collation_server {{=}} utf8mb4_unicode_ci<br/>character_set_client {{=}} utf8mb4<br/>character_set_server {{=}} utf8mb4<br/>skip-character-set-client-handshake<br/>…<br/>[mysql]<br/>default-character-set {{=}} utf8mb4<br/>…}}
== {{Icon|notebook}} Importing Databases ==
Head over to the current SQL server and export the needed database.
{{Console|1=mysqldump -u kyau -p --databases ''<db1> <db2>…'' > backup.sql}}
Import them to the new database server.
{{Console|1=mysql -u kyau -p|2={{White|MariaDB>}} source backup.sql}}

== {{Icon|notebook}} Database Maintenance ==
MariaDB includes {{mono|mysqlcheck}} to check, analyze, repair and optimize database tables.

To check all tables in all databases:
{{Console|1=mysqlcheck --all-databases -u root -p -m}}
To analyze all tables in all databases:
{{Console|1=mysqlcheck --all-databases -u root -p -a}}
To repair all tables in all databases:
{{Console|1=mysqlcheck --all-databases -u root -p -r}}
To optimize all tables in all databases:
{{Console|1=mysqlcheck --all-databases -u root -p -o}}
To check if any tables require upgrades:
{{Console|1=mysqlcheck --all-databases -u root -p -g}}
If any tables require upgrades, it is recommended to run a full upgrade (this should also be done in-between major MariaDB version releases).
{{Console|1=mysql_upgrade -u root -p}}
== {{Icon|notebook}} Firewall ==
Add rules to the firewall to allow access from the nginx virtual machine to MySQL.
{{Console|title=/etc/nftables.conf|prompt=false|1=ip saddr 142.44.172.255 tcp dport 3306 ct state new,established counter accept}}

= {{Icon24|book-brown}} References =
<references/>

[[Category:Arch Linux]]