Using Nginx on Asustor Nas

/ NAS - more cheats, SprUng, KEEPERS, CODE-NOW-NOW-NOW, NAS, Featured Today, Asustor AS5202T / 1 minute of reading
What a NAS wants and what a NAS needs ...Config Attempts / Experimentsmore ...

Why Asustor Might Enforce GUI Management

  1. Prevent Misconfiguration:

    • The GUI provides a controlled environment to ensure changes do not break the web server or conflict with the NAS’s internal processes.
    • Direct edits to config files may be overwritten by Asustor’s scripts or updates.

  2. Custom Integration:

    • Asustor likely has a customized version of Apache with tailored paths, behaviors, and dependencies specific to the NAS environment.
    • It manages configurations centrally through the GUI for simplicity and consistency.

  3. Auto-Regeneration of Config Files:

    • Configurations made via the GUI might be dynamically written into files when you hit “Apply.”
    • Manual edits to files might get overwritten when changes are made through the GUI.

  4. User-Friendly Design:

    • NAS devices are designed for non-technical users, so Asustor expects configurations to be performed through a graphical interface rather than requiring command-line expertise.

Recommendations

  1. Use the Web Center GUI:

    • Configure the Web Server, Virtual Hosts, and PHP settings using the Web Center interface.

    • For example:

      • Add domains like spiffynasty.com and assign their respective directories via the Virtual Host section.
      • Enable HTTPS and set certificates through the GUI.

  2. Virtual Hosts Management:

    • Define individual virtual hosts for each website or app under Virtual Host in the Web Center.
    • Map them to subdirectories (e.g., /Web, /Docker/Nextcloud) and assign ports.

  3. Logging and Advanced Settings:

    • Use the Log section in the Web Center to monitor server activity.
    • For SSL, PHP, and caching, use the Web Server and Implementation tabs.

  4. Avoid Direct File Edits:

    • As much as possible, avoid modifying configuration files directly unless absolutely necessary.
    • Any manual changes risk being overwritten or ignored by the GUI’s backend scripts.

When to Use Manual Edits

If the GUI doesn’t provide a setting you need (e.g., advanced SSL configurations or custom module loading), you can:

  1. Test Temporary Manual Changes:

    • Locate the generated Apache configuration files (e.g., /usr/builtin/etc/apache2/) and edit them carefully.
    • Restart Apache using any available NAS-specific commands (not systemctl).

  2. Check for Overwrite Risks:

    • Before making changes, determine if the GUI or NAS scripts will overwrite your edits. For example:

      grep "apache2.conf" /usr/builtin/etc/script/*

    • This will show if any scripts reference and potentially overwrite apache2.conf.

  3. Revert to GUI Control:

    • If manual edits fail or cause issues, restore the NAS to default settings and use the Web Center.

Steps Forward

  • Use the Web Center to configure your sites and test their functionality.
  • If specific customizations are required, let me know, and I can guide you on implementing them alongside the GUI-managed environment.

Since NGINX is available as an app on your Asustor NAS, you can leverage it for your reverse proxy needs. Here’s how you can proceed to make NGINX the front-end proxy while maintaining the built-in Apache for system-required services:

Key Considerations for Asustor NAS

  1. Custom Apache Environment:

    • Files and logs may not follow the standard Linux Apache structure.
    • Instead of /etc/apache2, configuration files are located in /usr/builtin/etc/apache2/.
    • Instead of /var/log/apache2, logs may be directed elsewhere or disabled to conserve space.

  2. Custom Management Tools:

    • Standard tools like systemctl or service may not work. Instead, Apache may be managed using scripts or proprietary Asustor tools.

    • Check for any NAS-specific web server management commands:

      sudo find / -name "apache*" 2>/dev/null

  3. Minimal or Custom Logs:

    • Logging may be minimal or redirected to /dev/null to save space. Check your configuration file or any NAS-specific UI for logging options.

To avoid disrupting the NAS-specific Apache setup, follow these steps:

1. Locate Apache Control Commands

  • Try starting, stopping, or restarting Apache using custom scripts provided by Asustor. For example:

    /usr/builtin/etc/script/FU54apache2 start
/usr/builtin/etc/script/FU54apache2 stop
/usr/builtin/etc/script/FU54apache2 restart

  • If these scripts don’t work, look for other control utilities:

    sudo find / -name "*apache*" -exec ls -l {} \;

2. Identify Logs

  • Apache logs might be redirected or disabled entirely. To check:

    sudo grep "ErrorLog" /usr/builtin/etc/apache2/apache2.conf
sudo find / -name "error_log" 2>/dev/null

  • If logging is disabled (e.g., 

    

    ), you can enable it by modifying 
    

    

    :
    

    ErrorLog "/volume1/Web/error_log"
LogLevel warn
CustomLog "/volume1/Web/access_log" combined
    

    • 

  • Restart Apache after making changes.
    

    • 



3. Do Not Replace Without Backup


    

  • Before modifying or replacing any configuration, 
    

    back up the original file
    

    :
    

    sudo cp /usr/builtin/etc/apache2/apache2.conf /usr/builtin/etc/apache2/apache2.conf.bak
    

    • 



4. Recreate apache2.conf Carefully


    

  • If the file is truly missing or corrupted, use a minimal configuration:
    

    ServerRoot "/usr/builtin"
Listen 8080
DocumentRoot "/volume1/Web"
<Directory "/volume1/Web">
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
    

    • 

  • Save the file to /usr/builtin/etc/apache2/apache2.conf.
    

    • 



5. Verify Before Restart


    

  • Test the configuration file if possible:
    

    /usr/builtin/bin/httpd -t
    

    • 

  • If no 
    

    

     binary is available, proceed cautiously with restarting Apache:
    

    /usr/builtin/etc/script/FU54apache2 restart
    

    • 



6. Test Accessibility


    

  • Verify that Apache is serving files correctly by visiting http://<your-nas-ip>:8080 in a browser.
    • 





If Custom Tools Are Broken


If the built-in Apache scripts or utilities are malfunctioning:


    

  • Use the NAS UI to reinstall or repair the Apache application.
    • 

  • If this isn’t possible, you may need to contact Asustor support for assistance or guidance.
    • 





Begin Configuration




Steps to Configure NGINX as a Front-End Proxy on Asustor NAS


1. Install and Enable NGINX App


    

  1. Open the Asustor ADM interface.
    

    2. 

  2. Go to App Central and search for “NGINX”.
    

    3. 

  3. Install the NGINX app.
    

    4. 

  4. Ensure it is running:
    

      

    • Navigate to App Central > Installed Apps > NGINX and click Start.
      • 

    

    5. 




SSL https:// updates



Your provided httpd-ssl.conf file is the default SSL configuration for Apache, and it will require adjustments to work alongside NGINX as a reverse proxy. Here are the key changes needed:


 


Proposed Adjustments for Reverse Proxy with NGINX


	1.	Change Listening Port


	•	Since NGINX will handle ports 80 and 443, Apache must be configured to use alternative ports (e.g., 8080 and 8443).


	•	Replace Listen 443 with Listen 8443.


	2.	Update VirtualHost Port


	•	Change  to .


	3.	Ensure Proper SSL Certificate Paths


	•	If Apache still serves SSL on its new port (8443), ensure the paths to the SSL certificates are correct. For instance:


SSLCertificateKeyFile "/usr/builtin/etc/apache2/server.key"


 


	4.	Optional: Disable SSL in Apache


	•	If Apache doesn’t need to serve SSL (because NGINX handles it), you can disable SSL entirely:




 


	5.	Restart Apache


	•	After making changes, restart Apache to apply the updates:




Updated httpd-ssl.conf File


 


Here’s the modified version of your httpd-ssl.conf:


# listen on port 8443 for https
Listen 8443

<VirtualHost _default_:8443>
DocumentRoot "/volume1/Web"
ServerName www.example.com:8443
ServerAdmin you@example.com
ErrorLog "/usr/builtin/var/log/apache2/error_log"
TransferLog "/usr/builtin/var/log/apache2/access_log"

# SSL Engine Switch
SSLEngine on

# SSL Protocol support
SSLProtocol all -SSLv2

# SSL Cipher Suite
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5

# Server Certificate and Key
SSLCertificateFile "/usr/builtin/etc/apache2/server.crt"
SSLCertificateKeyFile "/usr/builtin/etc/apache2/server.key"

# Enable StdEnvVars for CGI and SSI
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/usr/builtin/cgi-bin">
SSLOptions +StdEnvVars
</Directory>

# Logging
CustomLog "/usr/builtin/var/log/apache2/ssl_request_log" \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>


Restart and Test


	1.	Restart Apache to apply the configuration:




 


	2.	Test the Apache service on the new ports:


	•	For HTTP: http://your-nas-ip:8080


	•	For HTTPS: https://your-nas-ip:8443


	3.	Confirm that NGINX successfully proxies requests to the updated Apache ports.


 



set up apache


From the content of the provided script, it appears to be an initialization or maintenance script for Apache on your Asustor NAS. This script is responsible for applying various configurations and patches, such as:


	1.	Fixing Apache Permissions:


	•	It modifies /usr/builtin/etc/apache2/apache2.conf to change the user and group to admin and administrators:


/bin/sed -i -e "s;^User root;User admin;" -e "s;^Group root;Group administrators;" /usr/builtin/etc/apache2/apache2.conf


 


	2.	Adjusting AllowOverride:


	•	Updates .htaccess permissions by replacing AllowOverride None with AllowOverride All.


	3.	Restoring Default Configurations:


	•	Copies default configuration and website files from /usr/builtin/etc.default/apache2/ to /usr/builtin/etc/apache2/:


cp -af /usr/builtin/etc.default/apache2/website/* /usr/builtin/etc/apache2/website/.


 


	4.	Updating the Apache Version Configuration:


	•	It checks the Apache version (confutil -get) and applies necessary changes if upgrading to Apache 2.4.


	5.	Patching Security and Performance Settings:


	•	Modifies SSLCipherSuite to strengthen SSL security.


	•	Hides server headers (ServerTokens Prod and Header always unset “X-Powered-By”).


	6.	PHP Configuration:


	•	Sets the timezone for PHP and adjusts APC-related settings.


Key Observations


	•	The script modifies /usr/builtin/etc/apache2/apache2.conf as part of its tasks.


	•	If the file /usr/builtin/etc/apache2/apache2.conf is blank, it might be because:


	•	The script failed to copy or initialize the default configuration.


	•	The file was emptied during a manual or automatic operation.


Steps to Restore or Investigate


	1.	Check for Default Configurations:


	•	Verify if a default apache2.conf exists in /usr/builtin/etc.default/apache2/:


ls -l /usr/builtin/etc.default/apache2/apache2.conf


 


	•	If it exists, copy it to /usr/builtin/etc/apache2/:


sudo cp /usr/builtin/etc.default/apache2/apache2.conf /usr/builtin/etc/apache2/apache2.conf


 


	2.	Run the Script:


	•	Since the script re-applies configurations, you can re-run it to see if it restores the file:


sudo /volume0/usr/builtin/etc/script/FU54apache2


 


	3.	Manually Recreate apache2.conf:


	•	If no default file exists, manually create /usr/builtin/etc/apache2/apache2.conf with basic content:


sudo nano /usr/builtin/etc/apache2/apache2.conf


Example:


language-serverroot "/usr/builtin"
Listen 8080
Include /usr/builtin/etc/apache2/mods-enabled/*.conf
Include /usr/builtin/etc/apache2/sites-enabled/*.conf


 


	4.	Check Script Logs:


	•	Review logs to determine if the script is failing to initialize apache2.conf. Look for logs in /var/log or custom paths:




 


	5.	Restart Apache:


	•	After restoring the configuration file, restart Apache:




Conclusion


 


The provided script is designed to manage the Apache setup and configurations. If /usr/builtin/etc/apache2/apache2.conf is blank, restoring it from /usr/builtin/etc.default/apache2/apache2.conf or recreating it manually should resolve the issue.


 


If the default apache2.conf file does not exist in /usr/builtin/etc.default/apache2/, you can recreate it manually using the minimal required configuration for Apache. Here’s how you can proceed:


Steps to Recreate apache2.conf


	1.	Create the apache2.conf File:


	•	Open the file for editing:




 


	•	Add the following minimal configuration:


ServerRoot "/usr/builtin"
Listen 8080

# Load required modules
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf

# Include configuration for sites
IncludeOptional sites-enabled/*.conf

# Logging
ErrorLog "/usr/builtin/var/log/apache2/error_log"
LogLevel warn
CustomLog "/usr/builtin/var/log/apache2/access_log" combined

# DocumentRoot
DocumentRoot "/volume1/Web"
<Directory "/volume1/Web">
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>


 


	•	Save and exit the editor (Ctrl+O, Enter, Ctrl+X).


	2.	Check for Required Directories:


	•	Ensure the following directories exist, as referenced in the configuration:


sudo mkdir -p /usr/builtin/etc/apache2/mods-enabled
sudo mkdir -p /usr/builtin/etc/apache2/sites-enabled
sudo mkdir -p /volume1/Web


 


	•	If these directories don’t exist, Apache may fail to start.


	3.	Optional: Add a Default Website:


	•	If /volume1/Web/ is empty, create an index.html to verify Apache is working:




	4.	Restart Apache:


	•	Restart the Apache service to apply the changes:




 


	•	Check the status to confirm it’s running:




	5.	Test the Configuration:


	•	Verify that Apache is listening on the correct port (8080):




 


	•	Access the default site in your browser or with curl:




Next Steps


	•	If this configuration works, you can further customize it based on your requirements (e.g., enabling SSL, setting up virtual hosts).


	•	If Apache still doesn’t start or you encounter errors, review the error log for details:







Using /volume1/Web for sites-enabled etc.


If /volume1/Web already exists on your NAS and serves as the directory for all web-accessible apps (essentially acting like sites-enabled), then we can simplify the Apache configuration. Here’s how to set it up:


Updated Configuration for /usr/builtin/etc/apache2/apache2.conf


Since /volume1/Web is the main directory for web-accessible apps, you can adjust the apache2.conf file to treat it as the primary document root.


	1.	Edit or Create apache2.conf:


	•	Open the configuration file for editing:


sudo nano /usr/builtin/etc/apache2/apache2.conf


 


	•	Use this configuration:



    # global configuration
    ServerRoot "/usr/builtin"
Listen 8080

# Load required modules
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf

# Set /volume1/Web as the main DocumentRoot
DocumentRoot "/volume1/Web"
<Directory "/volume1/Web">
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>

# Logging
ErrorLog "/usr/builtin/var/log/apache2/error_log"
LogLevel warn
CustomLog "/usr/builtin/var/log/apache2/access_log" combined


 


	2.	No Need for sites-enabled:


	•	Since /volume1/Web already acts as your application folder, you don’t need sites-enabled. Instead, you can place all web-accessible files (e.g., app folders, index.html, etc.) directly in /volume1/Web.


	3.	Restart Apache:


	•	Restart Apache to apply the configuration:




 


	4.	Verify Setup:


	•	Confirm Apache is listening on port 8080:




 


	•	Test access to your NAS in a browser or with curl:


sudo systemctl restart apache


Optional: SSL Setup


 


If you want to enable SSL in Apache, you can add a  block for HTTPS (port 8443). Let me know if you’d like assistance with that.


Considerations for Multiple Apps


If /volume1/Web contains multiple apps and you want separate configurations for them:


	•	Create subdirectories for each app (e.g., /volume1/Web/app1, /volume1/Web/app2).


	•	Use .htaccess files in each app directory for app-specific settings.


	•	Alternatively, switch back to a sites-enabled structure for more flexibility.






back to original conifg




2. Configure Apache to Use Non-Standard Ports


Since Apache is still required for the NAS’s internal web services, you need to free up 80 (HTTP) and 443 (HTTPS) for NGINX.


    

  1. SSH into your NAS.
    

    2. 

  2. Edit the Apache configuration file:
    

    sudo nano 	/volume0/usr/builtin/etc/apache2/apache2.conf
    

    3. 

  3. Change the 
    

    

     directives to use non-standard ports, e.g.:
    

    Listen 8080
Listen 8443
    

    4. 

  4. Restart Apache:
    

    sudo systemctl restart apache
    

    5. 



3. Configure NGINX as the Front-End Proxy


    

  1. Locate the NGINX configuration directory:
    

    /usr/local/AppCentral/nginx/conf/
    

    2. 

  2. Create or edit a configuration file, e.g., spiffynasty.com.conf:
    

    sudo nano /usr/local/AppCentral/nginx/conf/spiffynasty.com.conf
    

    3. 

  3. Add the following content to configure NGINX as a reverse proxy:
    

    server {
listen 80;
server_name spiffynasty.com;
return 301 https://$host$request_uri;
}

server {
listen 443 ssl;
server_name spiffynasty.com;

# SSL Configuration (Certbot can manage this for Let's Encrypt)
ssl_certificate /etc/letsencrypt/live/spiffynasty.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/spiffynasty.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;

# Reverse Proxy to Apache
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}

# Reverse Proxy for Port-Based Services
location /22300/ {
proxy_pass http://192.168.1.30:22300;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
    

    4. 

  4. Test the NGINX configuration:
    

    sudo /usr/local/AppCentral/nginx/sbin/nginx -t
    

    5. 

  5. Reload NGINX to apply the changes:
    

    sudo /usr/local/AppCentral/nginx/sbin/nginx -s reload
    

    6. 





4. Configure DNS and Verify


Ensure your DDNS provider (e.g., Afraid.org) points spiffynasty.com to the public IP of your NAS. Test access to:


    

  • https://spiffynasty.com/
    • 

  • https://spiffynasty.com/22300/
    • 





5. (Optional) Automate SSL with Certbot


If Certbot isn’t already installed on your NAS, you can set it up to automatically manage SSL certificates:


    

  1. Install Certbot using the command line.
    

    2. 

  2. Obtain a certificate:
    

    sudo certbot certonly --nginx -d spiffynasty.com
    

    3. 

  3. Automate renewal with a cron job:
    

    sudo crontab -e
    

    Add:
    

    0 3 * * * certbot renew --quiet && /usr/local/AppCentral/nginx/sbin/nginx -s reload
    

    4. 





Advantages of Switching to NGINX


    

  • Performance: NGINX handles static content and concurrent connections more efficiently than Apache.
    • 

  • Ease of Use: Its reverse proxy and caching capabilities are straightforward to configure.
    • 

  • Centralized Control: You can manage all domains and port-based services under one configuration.
    • 







more …




		
		
			




	




	        			

			
		
	



	

	

		
		


	





	
 
	


		
			




		Scroll to Top