- Modifié
Bonsoir à tous,
Je me permets de faire appel à vous car, tout comme remonté par fabb24, je ne parviens pas à la relancer le service nginx après avoir modifié la conf.
Job for nginx.service failed. See 'systemctl status nginx.service' and 'journalctl -xn' for details.
# systemctl status nginx -l
● nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled)
Active: failed (Result: exit-code) since Mon 2017-01-16 23:01:29 CET; 5s ago
Docs: man:nginx(8)
Process: 29245 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
Main PID: 1297 (code=exited, status=0/SUCCESS)
Jan 16 23:01:29 yoz nginx[29245]: nginx: [emerg] BIO_new_file("/etc/nginx/ssl/dhparams.pem") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/nginx/ssl/dhparams.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
Jan 16 23:01:29 yoz nginx[29245]: nginx: configuration file /etc/nginx/nginx.conf test failed
Jan 16 23:01:29 yoz systemd[1]: nginx.service: control process exited, code=exited status=1
Jan 16 23:01:29 yoz systemd[1]: Failed to start A high performance web server and a reverse proxy server.
Jan 16 23:01:29 yoz systemd[1]: Unit nginx.service entered failed state.Mes fichiers de conf sont édités de la manière suivante:
/etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
use epoll; # gestionnaire d'évènements epoll (kernel 2.6+)
}
http {
#Requete maximun par ip
limit_req_zone $binary_remote_addr zone=flood:10m rate=100r/s;
limit_req zone=flood burst=100 nodelay;
#Connexions maximum par ip
limit_conn_zone $binary_remote_addr zone=ddos:10m;
limit_conn ddos 100;
include /etc/nginx/mime.types;
default_type application/octet-stream;
access_log /var/log/nginx/access.log combined;
error_log /var/log/nginx/error.log error;
sendfile on;
keepalive_timeout 15;
keepalive_disable msie6;
keepalive_requests 100;
tcp_nopush on;
tcp_nodelay off;
server_tokens off;
gzip on;
gzip_comp_level 5;
gzip_min_length 512;
gzip_buffers 4 8k;
gzip_proxied any;
gzip_vary on;
gzip_disable "msie6";
gzip_types
text/css
text/javascript
text/xml
text/plain
text/x-component
application/javascript
application/x-javascript
application/json
application/xml
application/rss+xml
application/vnd.ms-fontobject
font/truetype
font/opentype
image/svg+xml;
include /etc/nginx/sites-enabled/*.conf;
include /etc/nginx/ssl/params.conf;
}/etc/nginx/sites-enabled/rutorrent.conf
server {
listen 80 default_server;
listen 443 default_server ssl http2;
server_name mydomain.ovh;
charset utf-8;
index index.html index.php;
client_max_body_size 10M;
ssl_certificate /etc/letsencrypt/live/mydomain.ovh/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.ovh/privkey.pem;
include /etc/nginx/conf.d/ciphers.conf;
access_log /var/log/nginx/rutorrent-access.log combined;
error_log /var/log/nginx/rutorrent-error.log error;
error_page 500 502 503 504 /50x.html;
location = /50x.html { root /usr/share/nginx/html; }
auth_basic "seedbox";
auth_basic_user_file "/etc/nginx/passwd/rutorrent_passwd";
location = /favicon.ico {
access_log off;
log_not_found off;
}
## début config accueil serveur ##
location ^~ / {
root /var/www/base;
include /etc/nginx/conf.d/php.conf;
include /etc/nginx/conf.d/cache.conf;
satisfy any;
allow all;
}
## fin config accueil serveur ##
## debut config rutorrent ##
location ^~ /rutorrent {
root /var/www;
include /etc/nginx/conf.d/php.conf;
include /etc/nginx/conf.d/cache.conf;
}
location ~ /\.svn {
deny all;
}
location ~ /\.ht {
deny all;
}
location ^~ /rutorrent/conf/ {
deny all;
}
location ^~ /rutorrent/share/ {
deny all;
}
## fin config rutorrent ##
## config utilisateurs ##
location /YOZ {
include scgi_params;
scgi_pass 127.0.0.1:5001;
auth_basic "seedbox";
auth_basic_user_file "/etc/nginx/passwd/rutorrent_passwd_yoz";
}
location /cakebox/ {
rewrite ^/cakebox(/.*)$ $1 break;
proxy_pass http://127.0.0.1:81;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect off;
}
location /cakebox/yoz/ {
alias /home/yoz/torrents/;
add_header Content-Disposition "attachment";
satisfy any;
allow all;
}
}/etc/nginx/ssl/params.conf
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_ecdh_curve secp384r1;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA";
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/mydomain.ovh/fullchain.pem;
resolver 8.8.8.8;Avez-vous une idée de ce qui a pu m'échapper ? Quels doivent être les droits associés au dossier /etc/letsencrypt ?
Merci d'avance
