site brand Home موسوعة كتب شعر android apple c cpp cheat sheet firefox freebsd google chrome java javaee linux microsoft nginx orientdb pascal python rfc tutorials unix wiki
⤺⤼

By Wael

Posted :

Install nginx , ipfw , php , ssl , mariadb , postgresql , mongodb , adminer , wordpress , java , tomcat , nodejs on FreeBSD

This article will show how to install nginx , how to enable ssl and http2 for nginx , and for the web frameworks for which nginx serves as a reverse proxy . It will use the IPFW firewall to block all incoming traffic beside http , https , and ssh .

It will install php , mariadb , Wordpress , and it will also install Postgresql , mongodb and adminer . It will also install nodejs and a wiki web application for nodejs , and it will install java and the tomcat server for which it will serve two web applications .

Before starting the installation of these software , we will install the nano editor to edit configuration files . 

  1. [root]$ pkg install nano 
  2. # install nano on FreeBsd
install nginx ipfw php ssl mariadb postgresql mongodb adminer wordpress java tomcat nodejs on freebsd
Table of contents Configure The IPFW firewall Install and configure nginx Install and configure php Install and configure ssl Install and configure mariadb Install and configure postgresql Install and configure mongodb Install and configure adminer Install and configure wordpress Install and configure java Install and configure tomcat Install and configure nodejs and raneto wiki Other programming languages or web frameworks

1- Configure The IPFW firewall

Configure the IPFW firewall to disable all incoming traffic to the server besides : http , https and ssh . 

  1. [root]$ sysrc firewall_enable="YES"
  2. # Make ipfw firewall starts , when 
  3. # freebsd starts . 
  4.  
  5. [root]$ sysrc firewall_quiet="YES"
  6. # Be quite executing commands .
  7.  
  8. [root]$ sysrc firewall_type="workstation"
  9. # protect the machine using stateful rules .
  10.  
  11. [root]$ sysrc firewall_myservices="22/tcp 80/tcp 443/tcp"
  12. # allow ssh http and https only 
  13.  
  14. [root]$ sysrc firewall_allowservices="any"
  15. # any ip can access the allowed services.
  16.  
  17. [root]$ sysrc firewall_logdeny="YES"
  18. # Log only the denied requests. 
  19.  
  20. [root]$ service ipfw start
  21. # Load the firewall rules

2- Install and configure nginx

To install nginx , you can use : 

  1. [root]$ pkg install nginx-full 
  2. # install nginx freebsd

Nginx default www directory is located under /usr/local/www/nginx/ , the error logs can be found under /var/log/nginx/error.log , the access logs can be found under /var/log/nginx/access.log , the pid is found under /var/run/nginx.pid and the configuration file is found under /usr/local/etc/nginx/nginx.conf .

Make a backup of nginx.conf : 

  1. [root]$ cd /usr/local/etc/nginx
  2. [root:/usr/local/etc/nginx/]$ mv nginx.conf nginx.conf.bk

Create a new nginx.conf file : 

  1. [root:/usr/local/etc/nginx/]$  nano nginx.conf
  2. # paste the following content .
  3.  
  4.  
  5. worker_processes auto; 
  6.  
  7. events {
  8.     worker_connections 1024;
  9. }
  10.  
  11. http { 
  12.     server_tokens off;
  13.  
  14.     sendfile on; 
  15.     tcp_nopush on; 
  16.     tcp_nodelay on; 
  17.  
  18.     include mime.types; 
  19.     default_type application/octet-stream;
  20.  
  21.     gzip on;    
  22.     gzip_proxied any; 
  23.     gzip_vary on; 
  24.     gzip_http_version 1.1; 
  25.     gzip_comp_level 6; 
  26.     gzip_min_length 96; 
  27.     gzip_types text/plain; 
  28.     gzip_types text/css; 
  29.     gzip_types text/xml; 
  30.     gzip_types application/javascript; 
  31.     gzip_types application/json;
  32.     gzip_types font/woff; 
  33.     gzip_types font/woff2; 
  34.     gzip_types font/opentype; 
  35.     gzip_types image/svg+xml; 
  36.     gzip_types image/x-icon;
  37.  
  38.     ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
  39.     ssl_prefer_server_ciphers on;
  40.     ssl_session_cache shared:nginx_SSL:1m;
  41.     ssl_session_timeout 1440m;
  42.     ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";
  43.  
  44.     map $sent_http_content_type $expires {
  45.         default                         off;
  46.         application/atom+xml            max;
  47.         application/javascript          max;
  48.         application/rss+xml             max;
  49.         application/vnd.ms-fontobject   max;
  50.         audio/ogg                       max;
  51.         font/woff                       max;
  52.         font/woff2                      max;
  53.         font/opentype                   max;
  54.         image/gif                       max;
  55.         image/jpeg                      max;
  56.         image/png                       max;
  57.         image/svg+xml                   max;
  58.         image/x-icon                    max;
  59.         text/css                        max;
  60.         text/html                       epoch;
  61.         video/mp4                       max;
  62.     }
  63.  
  64.     include servers.conf.d/*.conf;
  65. }

Now create a directory in /usr/local/etc/nginx/ , named servers.conf.d : 

  1. [root:/usr/local/etc/nginx/]$ mkdir servers.conf.d

and create a configuration file for you website : 

  1. [root:/usr/local/etc/nginx/servers.conf.d/]$ nano dev-freebsd.difyel.com.conf
  2. # create a configuration file , 
  3. # name it as you like , the important
  4. # is that it ends with .conf 
  5.  
  6. # paste the following content 
  7.  
  8. server {
  9.     listen 80;
  10.     listen [::]:80;
  11.  
  12.     server_name  dev-freebsd.difyel.com;
  13.  
  14.     root /usr/local/www/nginx/;
  15.     
  16.     client_max_body_size 512M;
  17.  
  18.  
  19.     # blog 
  20.     location /blog {
  21.         expires $expires;
  22.         index  index.php index.html index.htm;
  23.         try_files $uri $uri/ /blog/index.php?$args;
  24.     }
  25.  
  26.     location ~* ^/blog/.*.php$ {
  27.         include fastcgi_params;
  28.         fastcgi_pass    unix:/var/run/php-74-fpm.sock;
  29.         fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  30.     }
  31.     # blog 
  32. }

Test the configurations for any errors using : 

  1. [root]$ nginx -t
  2. # output
  3. nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
  4. nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful

Make nginx starts when freebsd starts : 

  1. [root]$ sysrc nginx_enable="YES"

Start nginx using : 

  1. [root]$ service nginx start

You can check if nginx is running , stop it , restart it , and reload its configuration using : 

  1. [root]$ service nginx status
  2. # Check ig nginx is running . 
  3. nginx is running as pid 7218.
  4.  
  5.  
  6. [root]$ service nginx stop
  7. # Stop nginx .
  8. Stopping nginx.
  9. Waiting for PIDS: 7218.
  10.  
  11.  
  12. [root]$ service nginx start
  13. # Start nginx .
  14. Performing sanity check on nginx configuration:
  15. nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
  16. nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful
  17. Starting nginx.
  18.  
  19.  
  20. [root]$ service nginx restart
  21. # restart nginx .
  22. Performing sanity check on nginx configuration:
  23. nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
  24. nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful
  25. Stopping nginx.
  26. Waiting for PIDS: 7280.
  27. Performing sanity check on nginx configuration:
  28. nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
  29. nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful
  30. Starting nginx.
  31.  
  32.  
  33. [root]$ service nginx reload
  34. # reload nginx configuration 
  35. root@freebsd:/usr/local/etc/nginx/servers.conf.d # service nginx reload
  36. Performing sanity check on nginx configuration:
  37. nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
  38. nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful

If you are running you website locally , make your server name resolve locally by adding the following line to /etc/hosts : 

  1. [root]$ echo '127.0.0.1 dev-freebsd.difyel.com' >> /etc/hosts
  2. # Replace dev-freebsd.difyel.com with your servername

3- Install and configure php

To install php on freebsd , use : 

  1. [root]$ pkg install php74 
  2. # Install php version 7.4
  3. # you can install other versions
  4. # for example php73 php72 ...
  5.  
  6.  
  7. [root]$ pkg search "^php74.*" | less 
  8. # Search for extensions to use with php
  9. # replace 74 with your installed php version
  10. # for example , 73 72 . 
  11.  
  12.  
  13. [root]$ pkg install php74-bcmath php74-bz2 php74-curl php74-dom php74-exif php74-fileinfo php74-filter php74-gd php74-gettext php74-intl php74-json php74-mbstring php74-session php74-soap php74-pecl-mcrypt php74-openssl php74-xmlrpc php74-zip php74-zlib php74-pdo_mysql php74-pdo_pgsql php74-pdo_sqlite php74-pdo_firebird php74-sqlite3 php74-pgsql php74-mysqli php74-pecl-mongodb-1.7.4 
  14. # install extensions to be used with 
  15. # php .

Php configuration files are located under /usr/local/etc/php.ini and /usr/local/etc/php/ . php-fpm configuration files are located under /usr/local/etc/php-fpm.conf and /usr/local/etc/php-fpm.d/ . php-fpm pid is located under /var/run/php-fpm.pid.

To configure php on freebsd , first create a php.ini link : 

  1. # For production , create this link . 
  2. [root]$ ln -s /usr/local/etc/php.ini-production /usr/local/etc/php.ini
  3.  
  4. # For development , create this link 
  5. [root]$ ln -s /usr/local/etc/php.ini-development  /usr/local/etc/php.ini

Next edit /usr/local/etc/php-fpm.d/www.conf : 

  1. [root]$ nano /usr/local/etc/php-fpm.d/www.conf
  2. # Open www.conf for editing .
  3.  
  4. # search using ctrl-w for 
  5. listen = 127.0.0.1:9000
  6.     
  7. # and replace it with :
  8. listen = /var/run/php-74-fpm.sock
  9. # If you have installed another version
  10. # of php , replace 74 with your version 
  11. # for example 73 or 72 ...
  12.  
  13.  
  14. # Uncomment the following three 
  15. # lines by removing the semicolon.
  16. listen.owner = www
  17. listen.group = www
  18. listen.mode = 0660

Create a secure-php.ini file : 

  1. [root]$ nano /usr/local/etc/php/secure-phi.ini
  2. max_execution_time =  30
  3. max_input_time = 30
  4. cgi.force_redirect = 1
  5. expose_php = Off
  6. display_errors = Off
  7. display_startup_errors = Off
  8. log_errors = On
  9. allow_url_fopen = Off
  10. allow_url_include = Off
  11. disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
  12. session.use_strict_mode = 1
  13. session.cookie_secure = 1

Make the php-fpm service starts when FreeBSD boots , by issuing the following command : 

  1. [root]$ sysrc php_fpm_enable="YES"

Start the php-fpm service using : 

  1. [root]$ service php-fpm start

You can use service stop php-fpm to stop php-fpm .

Test if php is working correctly , create a blog directory under : /usr/local/www/ 

  1. [root:/usr/local/www/]$ mkdir blog 
  2. # create a blog directory under /usr/local/www/

and create a test.php file under /usr/local/www/nginx/blog/ : 

  1. [root:/usr/local/www/nginx/blog/]$ echo '<?php phpinfo();?>' > test.php

Visit http://yourdomain.com/blog/test.php , and you should have the following page .

php info

Remove the test.php file 

  1. [root:/usr/local/www/nginx/blog/]$ rm test.php

4- Install and configure ssl

Install certbot : 

  1. [root$] pkg install py37-certbot
  2. # Install certbot under freebsd
  3. # you can search for the certbot package
  4. # using pkg search certbot .

If you are running your server locally , you must manually create and add ssl certificate using certbot . 

  1. [root]$ certbot certonly --manual --preferred-challenges dns -d dev-freebsd.difyel.com
  2. # replace dev-freebsd.difyel.com with your server name .
  3.  
  4. Saving debug log to /var/log/letsencrypt/letsencrypt.log
  5. Plugins selected: Authenticator manual, Installer None
  6. Enter email address (used for urgent renewal and security notices)
  7. 	(Enter 'c' to cancel): uremail@address.com
  8.  
  9. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  10. Please read the Terms of Service at
  11. https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
  12. agree in order to register with the ACME server at
  13. https://acme-v02.api.letsencrypt.org/directory
  14. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  15. (A)gree/(C)ancel: A
  16.  
  17. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  18. Would you be willing, once your first certificate is successfully issued, to
  19. share your email address with the Electronic Frontier Foundation, a founding
  20. partner of the Let's Encrypt project and the non-profit organization that
  21. develops Certbot? We'd like to send you email about our work encrypting the web,
  22. EFF news, campaigns, and ways to support digital freedom.
  23. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  24. (Y)es/(N)o: y
  25. Obtaining a new certificate
  26. Performing the following challenges:
  27. dns-01 challenge for dev-freebsd.difyel.com
  28.  
  29. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  30. NOTE: The IP of this machine will be publicly logged as having requested this
  31. certificate. If you're running certbot in manual mode on a machine that is not
  32. your server, please ensure you're okay with that.
  33.  
  34. Are you OK with your IP being logged?
  35. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  36. (Y)es/(N)o: y
  37.  
  38. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  39. Please deploy a DNS TXT record under the name
  40. _acme-challenge.dev-freebsd.difyel.com with the following value:
  41.  
  42. qf67JA2BjjUdUsJEqjXCmTsKWHZ_KR4HZRTiNTBU33o
  43.  
  44. Before continuing, verify the record is deployed.
  45. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  46. Press Enter to Continue

If you are using namecheap you can add the text record to your domain , by going to Domain list , then select manage under your domain , and advanced .

Namecheap domain list , manage advanced dns

Select add new record , for type select text , for host select _acme-challenge.dev-freebsd if you have a subdomain you are configuring like dev-freebsd.difyel.com , or _acme-challenge if this is your root domain like difyel.com .

You can check if the record has been updated by name cheap using the command : 

  1. #replace .dev-freebsd.difyel.com with your server name 
  2.  
  3. [root]$ host -t txt  _acme-challenge.dev-freebsd.difyel.com
  4. Host _acme-challenge.dev-freebsd.difyel.com not found: 3(NXDOMAIN)
  5. # In this case , the record has not been updated .
  6.  
  7.  
  8. [root]$ host -t txt  _acme-challenge.dev-freebsd.difyel.com
  9. _acme-challenge.dev-freebsd.difyel.com descriptive text "qf67JA2BjjUdUsJEqjXCmTsKWHZ_KR4HZRTiNTBU33o"
  10. # In this case , the record has been updated .

Once the record has been updated , press enter to continue verification . 

  1. Waiting for verification...
  2. Cleaning up challenges
  3. Subscribe to the EFF mailing list (email: uremail@address.com).
  4.  
  5. IMPORTANT NOTES:
  6. 	- Congratulations! Your certificate and chain have been saved at:
  7. 	/usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/fullchain.pem
  8. 	Your key file has been saved at:
  9. 	/usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/privkey.pem
  10. 	Your cert will expire on 2021-01-14. To obtain a new or tweaked
  11. 	version of this certificate in the future, simply run certbot
  12. 	again. To non-interactively renew *all* of your certificates, run
  13. 	"certbot renew"
  14. 	- Your account credentials have been saved in your Certbot
  15. 	configuration directory at /usr/local/etc/letsencrypt. You should
  16. 	make a secure backup of this folder now. This configuration
  17. 	directory will also contain certificates and private keys obtained
  18. 	by Certbot so making regular backups of this folder is ideal.
  19. 	- If you like Certbot, please consider supporting our work by:
  20.  
  21. 	Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
  22. 	Donating to EFF:                    https://eff.org/donate-le

Now you must add the ssl configuration for your local domain , so replace your website configuration /usr/local/etc/nginx/servers.conf.d/dev-freebsd.difyel.com.conf with the following : 

  1. [root]$ nano /usr/local/etc/nginx/servers.conf.d/dev-freebsd.difyel.com.conf
  2. # edit your website configuration , replace
  3. # dev-freebsd.difyel.com.conf with your conf
  4. # file name . and past the following code 
  5.  
  6. server {
  7. 	listen [::]:443 ssl http2 ; # Certbot
  8. 	listen 443 ssl http2 ; # Certbot
  9. 	
  10. 	ssl_certificate /usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/fullchain.pem; # Certbot
  11. 	ssl_certificate_key /usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/privkey.pem; # Certbot
  12.  
  13. 	server_name  dev-freebsd.difyel.com;
  14.  
  15. 	root /usr/local/www/nginx/;
  16. 	
  17. 	client_max_body_size 512M;
  18.  
  19.  
  20. 	# blog 
  21. 	location /blog {
  22. 		expires $expires;
  23. 		index  index.php index.html index.htm;
  24. 		try_files $uri $uri/ /blog/index.php?$args;
  25. 	}
  26.  
  27. 	location ~* ^/blog/.*.php$ {
  28. 		include fastcgi_params;
  29. 		fastcgi_pass    unix:/var/run/php-74-fpm.sock;
  30. 		fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  31. 	}
  32. 	# blog 
  33. }
  34.  
  35. server {
  36. 	listen 80;
  37. 	listen [::]:80;
  38. 	server_name dev-freebsd.difyel.com;
  39. 	return 301 https://$host$request_uri;
  40. }

Test the configuration and restart nginx : 

  1. [root]$ nginx -t 
  2. [root]$ service nginx restart

If you are not running your website locally , so like on a vps and can be accessed from the outside world , you can issue the following command in order to install ssl certificate . 

  1. [root]$ sudo certbot certonly --webroot -d difyel.com www.difyel.com
  2. # generate and install certificate for difyel.com and 
  3. # www.difyel.com 
  4.  
  5. [root]$ echo "0 0,12 * * * root python -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew -q" | sudo tee -a /etc/crontab > /dev/null
  6. # automatically renew the certificates

For local website you must renew your certificates manually .

5- Install and configure mariadb

To install mariadb , issue the following command : 

  1. [root]$ pkg install mariadb105-server 
  2. # Install mariadb server , you can
  3. # install other versions by replacing
  4. # 105 by the version number , for example
  5. # 104 or 103

Configuration files for mariadb are found under /usr/local/etc/mysql/ .

After installation , make mariadb starts when freeBSD stars , by issuing the command : 

  1. [root]$ sysrc mysql_enable="YES"
  2. # make mariadb starts when 
  3. # freeBSD starts .

Start the mariadb server : 

  1. [root]$ service mysql-server start

You can stop the mariadb server by running service mysql-server stop .

Secure mariadb by running : 

  1. [root]$ mysql_secure_installation

You can choose a password for the root user , or you can use socket authentication , you can remove anonymous account , disallow root from logging remotely , remove the test database , and reload the privileges tables . 

  1. [root]$ mysql_secure_installation
  2.  
  3. NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
  4.         SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!
  5.  
  6. In order to log into MariaDB to secure it, we ll need the current
  7. password for the root user. If you ve just installed MariaDB, and
  8. haven t set the root password yet, you should just press enter here.
  9.  
  10. Enter current password for root (enter for none): 
  11. OK, successfully used password, moving on...
  12.  
  13. Setting the root password or using the unix_socket ensures that nobody
  14. can log into the MariaDB root user without the proper authorisation.
  15.  
  16. You already have your root account protected, so you can safely answer 'n'.
  17.  
  18. Switch to unix_socket authentication [Y/n] n
  19.     ... skipping.
  20.  
  21. You already have your root account protected, so you can safely answer 'n'.
  22.  
  23. Change the root password? [Y/n] n
  24.     ... skipping.
  25.  
  26. By default, a MariaDB installation has an anonymous user, allowing anyone
  27. to log into MariaDB without having to have a user account created for
  28. them.  This is intended only for testing, and to make the installation
  29. go a bit smoother.  You should remove them before moving into a
  30. production environment.
  31.  
  32. Remove anonymous users? [Y/n] y
  33.     ... Success!
  34.  
  35. Normally, root should only be allowed to connect from 'localhost'.  This
  36. ensures that someone cannot guess at the root password from the network.
  37.  
  38. Disallow root login remotely? [Y/n] y
  39.     ... Success!
  40.  
  41. By default, MariaDB comes with a database named 'test' that anyone can
  42. access.  This is also intended only for testing, and should be removed
  43. before moving into a production environment.
  44.  
  45. Remove test database and access to it? [Y/n] y
  46.     - Dropping test database...
  47.     ... Success!
  48.     - Removing privileges on test database...
  49.     ... Success!
  50.  
  51. Reloading the privilege tables will ensure that all changes made so far
  52. will take effect immediately.
  53.  
  54. Reload privilege tables now? [Y/n] y
  55.     ... Success!
  56.  
  57. Cleaning up...
  58.  
  59. All done!  If you've completed all of the above steps, your MariaDB
  60. installation should now be secure.
  61.  
  62. Thanks for using MariaDB!

Restart mariadb server using : 

  1. [root]$ service mysql-server restart

6- Install and configure postgresql

To install postgresql issue the command : 

  1. [root]$ pkg install postgresql12-server
  2. # You can install other versions of postgresql 
  3. # by changing the version number for example 
  4. # 11 or 13

Make Postgresql start , when freebsd start by issuing : 

  1. [root]$ sysrc postgresql_enable="YES"

Initialize the database by running : 

  1. [root]$ service postgresql initdb

Start postgresql by running : 

  1. [root]$ service postgresql start
  2. # start the postgresql server .

You can stop the postgresql server by running service postgresql stop

7- Install and configure mongodb

To install mongodb issue the following command : 

  1. [root]$ pkg install mongodb44
  2. # Install mongoldb version 4.4 , 
  3. # You can install other versions
  4. # like 42 36 ..

Make monogdb starts when freeBSD starts by issuing the following command : 

  1. [root]$ sysrc mongod_enable="YES"

You can start and stop mongodb by using the service command . Start mongodb by issuing : 

  1. [root]$ service mongod start

8- Install and configure adminer

To install adminer issue the commands : 

  1. [root:/usr/local/www/nginx/]$ pkg install adminer
  2. # install adminer 
  3.  
  4. [root:/usr/local/www/nginx/]$ ln -s /usr/local/www/adminer/index.php /usr/local/www/nginx/adminer.php
  5. # create a symbolic link for 
  6. # adminer inside nginx where 
  7. # we are serving our website .

Set up basic authentication on nginx , start by generating a username and a password to protect adminer.php : 

  1. [root:/usr/local/etc/nginx/]$  echo "username:`openssl passwd -apr1 password`" >> .htpasswd
  2. # replace username by your username , and password with
  3. # your password .

Edit nginx.conf and define a rate limiting zone , to protect from brute force attack : 

  1. [root:/usr/local/etc/nginx/]$ nano nginx.conf
  2. # edit nginx.conf and add 
  3.  
  4. limit_req_zone $binary_remote_addr zone=shared:brute_force_protect:10m rate=1r/s;
  5. # Create a zone named : brute_force_protect
  6. # which will limit remote ip addresses 
  7. # to only one http request per second .

Your nginx.conf should look like this as such : 

  1. worker_processes auto; 
  2.  
  3. events {
  4. 	worker_connections 1024;
  5. }
  6.  
  7. http { 
  8. 	server_tokens off;
  9.  
  10. 	sendfile on; 
  11. 	tcp_nopush on; 
  12. 	tcp_nodelay on; 
  13.  
  14. 	include mime.types; 
  15. 	default_type application/octet-stream;
  16.  
  17. 	gzip on;    
  18. 	gzip_proxied any; 
  19. 	gzip_vary on; 
  20. 	gzip_http_version 1.1; 
  21. 	gzip_comp_level 6; 
  22. 	gzip_min_length 96; 
  23. 	gzip_types text/plain; 
  24. 	gzip_types text/css; 
  25. 	gzip_types text/xml; 
  26. 	gzip_types application/javascript; 
  27. 	gzip_types application/json;
  28. 	gzip_types font/woff; 
  29. 	gzip_types font/woff2; 
  30. 	gzip_types font/opentype; 
  31. 	gzip_types image/svg+xml; 
  32. 	gzip_types image/x-icon;
  33.  
  34. 	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
  35. 	ssl_prefer_server_ciphers on;
  36. 	ssl_session_cache shared:nginx_SSL:1m;
  37. 	ssl_session_timeout 1440m;
  38. 	ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";
  39.  
  40. 	map $sent_http_content_type $expires {
  41. 		default                         off;
  42. 		application/atom+xml            max;
  43. 		application/javascript          max;
  44. 		application/rss+xml             max;
  45. 		application/vnd.ms-fontobject   max;
  46. 		audio/ogg                       max;
  47. 		font/woff                       max;
  48. 		font/woff2                      max;
  49. 		font/opentype                   max;
  50. 		image/gif                       max;
  51. 		image/jpeg                      max;
  52. 		image/png                       max;
  53. 		image/svg+xml                   max;
  54. 		image/x-icon                    max;
  55. 		text/css                        max;
  56. 		text/html                       epoch;
  57. 		video/mp4                       max;
  58. 	}
  59. 	
  60. 	limit_req_zone $binary_remote_addr zone=brute_force_protect:10m rate=1r/s;
  61.  
  62. 	include servers.conf.d/*.conf;
  63. }

Edit your website configuration file , in my case it is dev-freebsd.difyel.com.conf , and add : 

  1. [root:/usr/local/etc/nginx/servers.conf.d/]$ nano dev-freebsd.difyel.com.conf
  2. #adminer 
  3. location =/adminer.php{
  4. 	limit_req zone=brute_force_protect burst=20 nodelay;
  5. 	auth_basic  "Adminer Admin Area";
  6. 	auth_basic_user_file .htpasswd;
  7. 	include fastcgi_params;
  8. 	fastcgi_pass    unix:/var/run/php-74-fpm.sock;
  9. 	fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  10. }
  11. #adminer

So your website configuration file will look like this : 

  1. server {
  2. 	listen [::]:443 ssl http2 ; # Certbot
  3. 	listen 443 ssl http2 ; # Certbot
  4. 	
  5. 	ssl_certificate /usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/fullchain.pem; # Certbot
  6. 	ssl_certificate_key /usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/privkey.pem; # Certbot
  7.  
  8. 	server_name  dev-freebsd.difyel.com;
  9.  
  10. 	root /usr/local/www/nginx/;
  11. 	
  12. 	client_max_body_size 512M;
  13.  
  14.  
  15. 	# blog 
  16. 	location /blog {
  17. 		expires $expires;
  18. 		index  index.php index.html index.htm;
  19. 		try_files $uri $uri/ /blog/index.php?$args;
  20. 	}
  21.  
  22. 	location ~* ^/blog/.*.php$ {
  23. 		include fastcgi_params;
  24. 		fastcgi_pass    unix:/var/run/php-74-fpm.sock;
  25. 		fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  26. 	}
  27. 	# blog 
  28.  
  29. 	#adminer 
  30. 	location =/adminer.php{
  31. 		limit_req zone=brute_force_protect burst=20 nodelay;
  32. 		auth_basic  "Adminer Admin Area";
  33. 		auth_basic_user_file .htpasswd;
  34. 		include fastcgi_params;
  35. 		fastcgi_pass    unix:/var/run/php-74-fpm.sock;
  36. 		fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  37. 	}
  38. 	#adminer 
  39. }
  40.  
  41. server {
  42. 	listen 80;
  43. 	listen [::]:80;
  44. 	server_name dev-freebsd.difyel.com;
  45. 	return 301 https://$host$request_uri;
  46. }

Test nginx configuration files using nginx -t and restart nginx using service nginx restart

Now when you try to access adminer you will be asked for a username and a password .

adminer authentication required adminer login page

To be able to connect to mariadb using adminer , create the user adminer and grant all privileges . 

  1. [root]$ mysql --user=root
  2. # connect to mysql 
  3.  
  4. CREATE USER 'adminer'@'localhost' IDENTIFIED BY 'password';
  5. # replace adminer and password , by your username and password .
  6.  
  7. GRANT ALL PRIVILEGES ON *.* TO 'adminer'@'localhost' WITH GRANT OPTION;
  8. # replace adminer with your username 
  9.  
  10. FLUSH PRIVILEGES;

Now you can use adminer to connect to mysql :

adminer mysql login adminer mysql

To be able to connect to postgresql using adminer , create the user adminer . 

  1. [root]$ su - postgres
  2. $ createuser --interactive --pwprompt
  3. Enter name of role to add: adminer
  4. Enter password for new role: 
  5. Enter it again: 
  6. Shall the new role be a superuser? (y/n) y

Now you can use adminer to connect to postgresql :

adminer postgresql login adminer postgresql

9- Install and configure wordpress

Download Wordpress to the blog directory on your website : 

  1. [root:/usr/local/www/nginx/blog/]$ wget https://wordpress.org/latest.tar.gz
  2. # Download the latest version of 
  3. # wordpress using wget .
  4. # If you don't have wget installed ,
  5. # you can install it using 
  6. # pkg install wget

Extract and move the extracted files to blog : 

  1. [root:/usr/local/www/nginx/blog/]$ tar -xzf latest.tar.gz
  2. # extract Wordpress 
  3.  
  4. [root:/usr/local/www/nginx/blog/]$ mv wordpress/* .
  5. # move the content of the wordpress
  6. # folder to blog
  7.  
  8. [root:/usr/local/www/nginx/blog/]$ # rm -r wordpress/
  9. # remove the Wordpress directory
  10.  
  11. [root:/usr/local/www/nginx/blog/]$ # rm latest.tar.gz
  12. # remove the latest.tar.gz file .

Create a database using adminer , go to your http://your.web.site/adminer.php , and make a connection to mysql , next choose create database , select a name for your database and a collation , it is recommended to set the collation to utf8mb4_general_ci if you don't find you language . Then click save .

adminer connect to mysql adminer mysql create database adminer mysql create database wordpress

On the next page click on privileges , and then click on create user , and choose a username and a password , and tick the all privileges box , then click on save .

adminer mysql privileges adminer mysql privileges create user adminer mysql privileges create user wordpress adminer mysql privileges user created

Next copy wp-config-sample.php into wp-config.php : 

  1. [root:/usr/local/www/nginx/blog/]$ cp wp-config-sample.php wp-config.php

And edit it to set up the database name , username and password as set earlier on , and to enable FS_METHOD direct , to enable the download of plugins , themes and updates without having an ftp server . 

  1. [root:/usr/local/www/nginx/blog/]$ nano wp-config.php
  2.  
  3. define( 'DB_NAME', 'wordpress_blog' );
  4.  
  5. define( 'DB_USER', 'wordpress_blog' );
  6.  
  7. define( 'DB_PASSWORD', 'password' );
  8.  
  9. define( 'DB_HOST', '127.0.0.1' );
  10.  
  11. define( 'FS_METHOD', 'direct' );
  12. # save and exit

Change the ownership of wp-content/ to www : 

  1. [root:/usr/local/www/nginx/blog/]$ chown -R www wp-content/
  2. # Change the ownership of wp-content to
  3. # www

Visit http://your.web.site/blog/wp-admin/install.php to finish installing Wordpress .

wordpress information needed

10- Install and configure java

To install java , issue the following commands : 

  1. [root]$ pkg install openjdk11
  2. # install jdk under Freebsd 
  3. # You can choose to install another
  4. # version by substituting 11 , 
  5. # for the version number you want
  6. # to install . For example 
  7. # openjdk8  , or openjdk13 .
  8.  
  9.  
  10. root$ mount -t fdescfs fdesc /dev/fd
  11. # mount fdesc on /dev/fd
  12. root$ mount -t procfs proc /proc
  13. # mount proc on /proc 
  14.  
  15. root$ echo 'fdesc   /dev/fd         fdescfs         rw      0       0' >> /etc/fstab
  16. root$ echo 'proc    /proc           procfs          rw      0       0' >> /etc/fstab
  17. # auto mount fdesc and proc on boot

11- Install and configure tomcat 

  1. [root$] pkg install tomcat9
  2. # Install tomcat under FreeBSD
  3. # you can substitute 9 , for the version
  4. # of tomcat you want to install , 
  5. # for example tomcat8 .

Tomcat will be installed to /usr/local/apache-tomcat-9.0/ . Make tomcat starts when freebsd starts by issuing the following command : 

  1. [root]$ sysrc tomcat9_enable="YES"

Edit your website configuration file , in my case it is dev-freebsd.difyel.com.conf , and add : 

  1. [root:/usr/local/etc/nginx/servers.conf.d/]$ nano dev-freebsd.difyel.com.conf 
  2. # Edit website configuration , and add two locations ,
  3. # for tomcat manager and host manager applications . 
  4.  
  5.     #tomcat webapps 
  6.     location /manager {
  7.             limit_req zone=brute_force_protect burst=20 nodelay;
  8.             expires $expires;
  9.             proxy_set_header Host $host;
  10.             proxy_set_header X-Real-IP $remote_addr;
  11.             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  12.             proxy_set_header X-Forwarded-Proto $scheme;
  13.             proxy_pass http://127.0.0.1:8080/manager;
  14.     }
  15.  
  16.     location /host-manager {
  17.             limit_req zone=brute_force_protect burst=20 nodelay;
  18.             expires $expires;
  19.             proxy_set_header Host $host;
  20.             proxy_set_header X-Real-IP $remote_addr;
  21.             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  22.             proxy_set_header X-Forwarded-Proto $scheme;
  23.             proxy_pass http://127.0.0.1:8080/host-manager;
  24.     }
  25.     #tomcat webapps

Your website configuration file will look like this : 

  1. root:/usr/local/etc/nginx/servers.conf.d/]$ cat nano dev-freebsd.difyel.com.conf
  2. # cat the content of dev-freebsd.difyel.com.conf 
  3.  
  4. server {
  5.     listen [::]:443 ssl http2 ; # Certbot
  6.     listen 443 ssl http2 ; # Certbot
  7.     
  8.     ssl_certificate /usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/fullchain.pem; # Certbot
  9.     ssl_certificate_key /usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/privkey.pem; # Certbot
  10.  
  11.     server_name  dev-freebsd.difyel.com;
  12.  
  13.     root /usr/local/www/nginx/;
  14.     
  15.     client_max_body_size 512M;
  16.  
  17.  
  18.     # blog 
  19.     location /blog {
  20.         expires $expires;
  21.         index  index.php index.html index.htm;
  22.         try_files $uri $uri/ /blog/index.php?$args;
  23.     }
  24.  
  25.     location ~* ^/blog/.*.php$ {
  26.         include fastcgi_params;
  27.         fastcgi_pass    unix:/var/run/php-74-fpm.sock;
  28.         fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  29.     }
  30.     # blog 
  31.  
  32.     #adminer 
  33.     location =/adminer.php{
  34.         limit_req zone=brute_force_protect burst=20 nodelay;
  35.         auth_basic  "Adminer Admin Area";
  36.         auth_basic_user_file .htpasswd;
  37.         include fastcgi_params;
  38.         fastcgi_pass    unix:/var/run/php-74-fpm.sock;
  39.         fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  40.     }
  41.     #adminer 
  42.  
  43.     #tomcat webapps 
  44.     location /manager {
  45.             limit_req zone=brute_force_protect burst=20 nodelay;
  46.             expires $expires;
  47.             proxy_set_header Host $host;
  48.             proxy_set_header X-Real-IP $remote_addr;
  49.             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  50.             proxy_set_header X-Forwarded-Proto $scheme;
  51.             proxy_pass http://127.0.0.1:8080/manager;
  52.     }
  53.  
  54.     location /host-manager {
  55.             limit_req zone=brute_force_protect burst=20 nodelay;
  56.             expires $expires;
  57.             proxy_set_header Host $host;
  58.             proxy_set_header X-Real-IP $remote_addr;
  59.             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  60.             proxy_set_header X-Forwarded-Proto $scheme;
  61.             proxy_pass http://127.0.0.1:8080/host-manager;
  62.     }
  63.     #tomcat webapps 
  64.  
  65. }
  66.  
  67. server {
  68.     listen 80;
  69.     listen [::]:80;
  70.     server_name dev-freebsd.difyel.com;
  71.     return 301 https://$host$request_uri;
  72. }

For each tomcat web app you would like to access using nginx , you must add a location block .

Test the nginx configuration , and restart nginx . 

  1. [root]$ nginx -t
  2. [root]$ service nginx restart

Edit the tomcat-users.xml file , and add the line <user username ... , to enable access to the manager and host manager apps . 

  1. [root:/usr/local/apache-tomcat-9.0/conf/]$ nano tomcat-users.xml
  2.  
  3. <?xml version="1.0" encoding="UTF-8"?>
  4.  
  5. <tomcat-users xmlns="http://tomcat.apache.org/xml"
  6.                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  7.                 xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
  8.                 version="1.0">
  9.  
  10.     <user username="admin" password="password" roles="manager-gui , admin-gui"/>
  11. </tomcat-users>

Replace username with your username , and password with your password.

Edit both context.xml in the manager and host-manager web apps and comment out the valve part to enable remote access to the manager and host manager apps . 

  1. [root:/usr/local/apache-tomcat-9.0/webapps/manager/META-INF/]$ nano context.xml
  2. # edit manager context.xml 
  3. <?xml version="1.0" encoding="UTF-8"?>
  4. <Context antiResourceLocking="false" privileged="true" >
  5.     <!-- <Valve className="org.apache.catalina.valves.RemoteAddrValve"
  6.             allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />-->
  7.     <Manager sessionAttributeValueClassNameFilter="java\.lang\.(?:Boolean|Integer|Long|Number|String)|org\.apache\.catalina\.filters\.CsrfPreventionFilter\$LruCache(?:\$1)?|java\.util\.(?:Linked)?HashMap"/>
  8. </Context>
  1. [root:/usr/local/apache-tomcat-9.0/webapps/host-manager/META-INF/]$ nano context.xml
  2. # edit host-manager context.xml 
  3. <?xml version="1.0" encoding="UTF-8"?>
  4. <Context antiResourceLocking="false" privileged="true" >
  5.     <!-- <Valve className="org.apache.catalina.valves.RemoteAddrValve"
  6.             allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" /> -->
  7.     <Manager sessionAttributeValueClassNameFilter="java\.lang\.(?:Boolean|Integer|Long|Number|String)|org\.apache\.catalina\.filters\.CsrfPreventionFilter\$LruCache(?:\$1)?|java\.util\.(?:Linked)?HashMap"/>
  8. </Context>

Edit tomcat server.xmlfile and add a remote ip valve under host localhost , to enable correct passing of remote IP address and host information . 

  1. # Add a remote ip valve under 
  2. # <Host name="localhost"  appBase="webapps" unpackWARs="true" autoDeploy="true">
  3.  
  4.         <Valve
  5.             className="org.apache.catalina.valves.RemoteIpValve"
  6.             internalProxies="127\.0\.0\.1"
  7.             remoteIpHeader="x-forwarded-for"
  8.             protocolHeader="x-forwarded-proto"
  9.             requestAttributesEnabled="true"
  10.             />

So your server.xml file will look like this : 

  1. <?xml version="1.0" encoding="UTF-8"?>
  2.  
  3. <Server port="8005" shutdown="SHUTDOWN">
  4.     <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
  5.     <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
  6.     <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
  7.     <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
  8.     <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
  9.  
  10.     <GlobalNamingResources>
  11.     <Resource name="UserDatabase" auth="Container"
  12.                 type="org.apache.catalina.UserDatabase"
  13.                 description="User database that can be updated and saved"
  14.                 factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
  15.                 pathname="conf/tomcat-users.xml" />
  16.     </GlobalNamingResources>
  17.  
  18.  
  19.     <Service name="Catalina">
  20.     <Connector port="8080" protocol="HTTP/1.1"
  21.                 connectionTimeout="20000"
  22.                 redirectPort="8443" />
  23.     <Engine name="Catalina" defaultHost="localhost">
  24.         <Realm className="org.apache.catalina.realm.LockOutRealm">
  25.         <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
  26.                 resourceName="UserDatabase"/>
  27.         </Realm>
  28.         <Host name="localhost"  appBase="webapps"
  29.             unpackWARs="true" autoDeploy="true">
  30.             <Valve
  31.                 className="org.apache.catalina.valves.RemoteIpValve"
  32.                 internalProxies="127\.0\.0\.1"
  33.                 remoteIpHeader="x-forwarded-for"
  34.                 protocolHeader="x-forwarded-proto"
  35.                 requestAttributesEnabled="true"
  36.                 />
  37.  
  38.             <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
  39.                     prefix="localhost_access_log" suffix=".txt"
  40.                     pattern="%h %l %u %t "%r" %s %b" />
  41.         </Host>
  42.     </Engine>
  43.     </Service>
  44. </Server>

You can start , stop , restart tomcat by using the service command . Start tomcat by issuing the command : 

  1. [root]$ service tomcat9 start

Go to your manager app , by visiting the address http://your.web.site/manager/

tomcat authentication required tomcat web application manager

12- Install and configure nodejs and raneto wiki

To install nodejs and npm issue the following commands : 

  1. [root]$ pkg instal node-14.13.0 npm-6.14.8
  2. # You can substitute node version
  3. # number by another one .

To install Raneto wiki issue the following commands : 

  1. [root]$ npm install git
  2. # install git 
  3.  
  4. [root]$ npm install pm2 -g
  5. # install process manager 
  6. # to start stop and daemonize
  7. # nodejs applications or other
  8. # applications or scripts . 
  9.  
  10. [root]$ adduser
  11. # create a user named node_pm2
  12. # with home directory set to
  13. # /usr/local/www/node_apps/
  14. Username: node_pm2
  15. Full name: 
  16. Uid (Leave empty for default): 
  17. Login group [node_pm2]: 
  18. Login group is node_pm2. Invite node_pm2 into other groups? []: 
  19. Login class [default]: 
  20. Shell (sh csh tcsh bash rbash git-shell nologin) [sh]: bash
  21. Home directory [/home/node_pm2]: /usr/local/www/node_apps/
  22. Home directory permissions (Leave empty for default): 
  23. Use password-based authentication? [yes]: 
  24. Use an empty password? (yes/no) [no]: 
  25. Use a random password? (yes/no) [no]: 
  26. Enter password: 
  27. Enter password again: 
  28. Lock out the account after creation? [no]: 
  29. Username   : node_pm2
  30. Password   : *****
  31. Full Name  : 
  32. Uid        : 1002
  33. Class      : 
  34. Groups     : node_pm2 
  35. Home       : /usr/local/www/node_apps/
  36. Home Mode  : 
  37. Shell      : /usr/local/bin/bash
  38. Locked     : no
  39. OK? (yes/no): y
  40. adduser: INFO: Successfully added (node_pm2) to the user database.
  41. Add another user? (yes/no): n
  42. Goodbye!
  43.  
  44. [root]$ su - node_pm2
  45. # change to user node_pm2
  46.  
  47.  
  48. [node_pm2:/usr/local/www/]$ git clone https://github.com/gilbitron/Raneto.git && cd Raneto
  49. # clone Raneto and cd into it 
  50.  
  51. [node_pm2:/usr/local/www/Raneto/]$ npm install && npm run gulp
  52. # install the Raneto application 
  53.  
  54. [node_pm2:/usr/local/www/Raneto/]$ nano example/config.default.js  
  55. # search for base_url: '' , and 
  56. # replace it with : 
  57. #  base_url: '/wiki'
  58.  
  59.  
  60. [node_pm2:/usr/local/www/Raneto/]$ pm2 start npm --name "Raneto" -- start
  61. # start the Raneto application using
  62. # pm2 , it will be restarted if it 
  63. # crashes .
  64.  
  65. [node_pm2:/usr/local/www/Raneto/] exit
  66. # switch back to the root account 
  67.  
  68. [root]$ bash
  69. # change to the bash shell .
  70.  
  71. [root]$ env PATH=$PATH:/usr/local/bin pm2 startup rcd -u node_pm2 --hp /usr/local/www/node_apps/
  72. # execute the following command to make 
  73. # node_pm2 starts when freebsd starts , 
  74. # and startup any application.
  75.  
  76. [root]$ su - node_pm2
  77. # change to user node_pm2
  78.  
  79. [node_pm2:/usr/local/www/]$ pm2 save 
  80. # Save list of applications to 
  81. # be started when freeBSD starts .
  82.  
  83. [node_pm2:/usr/local/www/]$ exit
  84. # exit back to root

Edit nginx website configuration files , to proxy the wiki application just installed by adding the #wiki raneto block : 

  1. [root:/usr/local/etc/nginx/servers.conf.d]$ nano dev-freebsd.difyel.com.conf 
  2. # edit your website configuration 
  3. # file and add the raneto block 
  4.  
  5. server {
  6.     listen [::]:443 ssl http2 ; # Certbot
  7.     listen 443 ssl http2 ; # Certbot
  8.     
  9.     ssl_certificate /usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/fullchain.pem; # Certbot
  10.     ssl_certificate_key /usr/local/etc/letsencrypt/live/dev-freebsd.difyel.com/privkey.pem; # Certbot
  11.  
  12.     server_name  dev-freebsd.difyel.com;
  13.  
  14.     root /usr/local/www/nginx/;
  15.     
  16.     client_max_body_size 512M;
  17.  
  18.  
  19.     # blog 
  20.     location /blog {
  21.         expires $expires;
  22.         index  index.php index.html index.htm;
  23.         try_files $uri $uri/ /blog/index.php?$args;
  24.     }
  25.  
  26.     location ~* ^/blog/.*.php$ {
  27.         include fastcgi_params;
  28.         fastcgi_pass    unix:/var/run/php-74-fpm.sock;
  29.         fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  30.     }
  31.     # blog 
  32.  
  33.     #adminer 
  34.     location =/adminer.php{
  35.         limit_req zone=brute_force_protect burst=20 nodelay;
  36.         auth_basic  "Adminer Admin Area";
  37.         auth_basic_user_file .htpasswd;
  38.         include fastcgi_params;
  39.         fastcgi_pass    unix:/var/run/php-74-fpm.sock;
  40.         fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  41.     }
  42.     #adminer 
  43.  
  44.     #tomcat webapps 
  45.     location /manager {
  46.             limit_req zone=brute_force_protect burst=20 nodelay;
  47.             expires $expires;
  48.             proxy_set_header Host $host;
  49.             proxy_set_header X-Real-IP $remote_addr;
  50.             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  51.             proxy_set_header X-Forwarded-Proto $scheme;
  52.             proxy_pass http://127.0.0.1:8080/manager;
  53.     }
  54.  
  55.     location /host-manager {
  56.             limit_req zone=brute_force_protect burst=20 nodelay;
  57.             expires $expires;
  58.             proxy_set_header Host $host;
  59.             proxy_set_header X-Real-IP $remote_addr;
  60.             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  61.             proxy_set_header X-Forwarded-Proto $scheme;
  62.             proxy_pass http://127.0.0.1:8080/host-manager;
  63.     }
  64.     #tomcat webapps 
  65.  
  66.     #wiki  raneto
  67.     location /wiki {
  68.             expires $expires;
  69.             proxy_set_header Host $host;
  70.             proxy_set_header X-Real-IP $remote_addr;
  71.             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  72.             proxy_set_header X-Forwarded-Proto $scheme;
  73.             proxy_pass http://127.0.0.1:3000/wiki/;
  74.     }
  75.     #wiki raneto
  76.  
  77. }
  78.  
  79. server {
  80.     listen 80;
  81.     listen [::]:80;
  82.     server_name dev-freebsd.difyel.com;
  83.     return 301 https://$host$request_uri;
  84. }

Test the configuration and restart nginx : 

  1. [root]$ nginx -t
  2. # Test the configuration 
  3.  
  4. [root]$ service nginx restart
  5. # Restart the nginx server .

Visit the wiki at the address your.website.com/wiki , and you will see the following page .

raneto wiki

13- Other programming languages or web frameworks

Can be added using the same method , by using nginx as reverse proxy .