lighttpd - ArchWiki

Jump to content

# lighttpd

5 languages

- Deutsch
- Español
- 日本語
- Русский
- 中文（简体）

From ArchWiki

"lighttpd (pronounced /lighty/) is a secure, fast, standards compliant, and very flexible web server that has been optimized for high-performance environments. lighttpd supports a wide variety of features while using memory and CPU efficiently, making lighttpd an ideal web server for all systems, small and large."

## Installation

Install the lighttpd package.

## Configuration

### Basic setup

The lighttpd configuration file is: `/etc/lighttpd/lighttpd.conf`. By default it should produce a working test page.

To check your `lighttpd.conf` for bugs you can use this command (helps finding misconfigurations very quickly):

    $ lighttpd -tt -f /etc/lighttpd/lighttpd.conf

The default configuration file specifies `/srv/http/` as the document directory served. To test the installation, create a dummy file:

    /srv/http/index.html

    Hello world!

Then start/enable the `lighttpd.service` and point your browser to `localhost`, where you should see the test page.

Example configuration files are available in `/usr/share/doc/lighttpd/`.

#### Basic logging

lighttpd can write out both errors and access to log files. The error log is enabled by default (controlled by the `server.errorlog` option). To enable the access log, edit `/etc/lighttpd/lighttpd.conf` as follows:

    server.modules += (
       "mod_accesslog",
    )

    accesslog.filename = "/var/log/lighttpd/access.log"

#### Enabling https via SSL

Warning: Users planning to implement SSL/TLS should know that some variations and implementations are vulnerable to attacks. See the OpenSSL article for details.
Tip:

- Mozilla has an SSL configuration generator that can be used with lighttpd.
- After setting up SSL, you can use Qualys SSL Labs SSL Server Check to check your configuration.

##### Self-signed

Self-signed SSL Certificates can be generated assuming openssl is installed on the system as follows:

    # mkdir /etc/lighttpd/certs
    # openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -sha256 -keyout /etc/lighttpd/certs/server.pem -out /etc/lighttpd/certs/server.pem
    # chmod 600 /etc/lighttpd/certs/server.pem

Modify `/etc/lighttpd/lighttpd.conf` adding the following lines to enable https:

    server.modules += ( "mod_openssl" )

    $SERVER["socket"] == ":443" {
       ssl.engine                  = "enable"
       ssl.pemfile                 = "/etc/lighttpd/certs/server.pem"
    }

See lighttpd TLS configuration for details.

##### Let's Encrypt

Alternatively, generate a certificate signed by Let's Encrypt.

Edit `/etc/lighttpd/lighttpd.conf` by adding the following lines:

    $SERVER["socket"] == ":443" {
        ssl.engine                  = "enable"
        ssl.privkey                 = "/etc/letsencrypt/live/domain/privkey.pem"
        ssl.pemfile                 = "/etc/letsencrypt/live/domain/fullchain.pem"
    }

See bootstrap Let's Encrypt in the lighttpd documentation for details.

#### Redirect http requests to https

You should add `"mod_redirect"` in server.modules array in `/etc/lighttpd/lighttpd.conf`:

    server.modules += ( "mod_redirect" )

    $HTTP["scheme"] == "http" {
      url.redirect = ("" => "https://${url.authority}${url.path}${qsa}")
    }

    $SERVER["socket"] == ":443" {
      ssl.engine = "enable"
      ssl.pemfile = "/etc/lighttpd/certs/server.pem"
      server.document-root = "..."
    }

To redirect all hosts for part of the site (e.g. secure or phpmyadmin):

    $HTTP["url"] =~ "^/secure" {
      $HTTP["scheme"] == "http" {
        url.redirect = ("" => "https://${url.authority}${url.path}${qsa}")
      }
    }

#### Password protecting a directory

A passwd file which is lighttpd's equivalent to the system's `/etc/passwd` is needed for user authentication. The setup requires a specific format and md5sum hashed password but users can quickly and easily create an entry using the following as an example:

    $ user=foo
    $ password=b@R102
    $ realm='Password Required'
    $ hash=`echo -n "$user:$realm:$password" | md5sum | cut -b -32`

    # echo "$user:$realm:$hash" >> /etc/lighttpd/lighttpd.user

Modify `/etc/lighttpd/lighttpd.conf` adding the following lines to enable the directory protection:

    server.modules += ( "mod_auth", "mod_authn_file" )

    auth.backend = "htdigest"
    auth.backend.htdigest.userfile = "/etc/lighttpd/lighttpd.user"

    # note this entry is relative to the server.document-root
    auth.require = ( "/secret" =>
       (
        "method" => "basic",
        "realm" => "Password Required",
        "require" => "valid-user"
       )
    )

Note: The realm entered into `/etc/lighttpd/lighttpd.conf` must match the value chosen in `/etc/lighttpd/lighttpd.user` for authentication to work.

### CGI

Common Gateway Interface (CGI) scripts just need to enable the CGI module; include the configuration file and make sure your chosen programming language interpreter is installed. (i.e. for python you would install python)

Create the file `/etc/lighttpd/conf.d/cgi.conf` and add the following to it:

    server.modules += ( "mod_cgi" )

    cgi.assign                 = ( ".pl"  => "/usr/bin/perl",
                                   ".cgi" => "/usr/bin/perl",
                                   ".rb"  => "/usr/bin/ruby",
                                   ".erb" => "/usr/bin/eruby",
                                   ".py"  => "/usr/bin/python",
                                   ".php" => "/usr/bin/php-cgi" )

    index-file.names           +=( "index.pl",   "default.pl",
                                   "index.rb",   "default.rb",
                                   "index.erb",  "default.erb",
                                   "index.py",   "default.py",
                                   "index.php",  "default.php" )

For PHP scripts, you will need to make sure the following is set in `/etc/php/php.ini`

    cgi.fix_pathinfo = 1

In your lighttpd configuration file, `/etc/lighttpd/lighttpd.conf` add:

    include "conf.d/cgi.conf"

### FastCGI

Install fcgi. Now you have lighttpd with fcgi support. If that was what you wanted, you are all set. People that want Ruby on Rails, PHP or Python should continue.

Note: New default user and group: Instead of group `nobody` lighttpd now runs as user/group `http` by default.

First, copy the example configuration file from `/usr/share/doc/lighttpd/config/conf.d/fastcgi.conf` to `/etc/lighttpd/conf.d`

The following needs adding to the configuration file, `/etc/lighttpd/conf.d/fastcgi.conf`

    server.modules += ( "mod_fastcgi" )

    index-file.names += ( "dispatch.fcgi" ) #dispatch.fcgi if rails specified

    server.error-handler-404   = "/dispatch.fcgi" #too
    fastcgi.server = (
        ".fcgi" => (
          "localhost" => (
            "socket" => "/run/lighttpd/rails-fastcgi.sock",
            "bin-path" => "/path/to/rails/application/public/dispatch.fcgi"
          )
        )
    )

Then in `/etc/lighttpd/lighttpd.conf`:

    include "conf.d/fastcgi.conf"

For PHP or Ruby on Rails, see the next sections.

#### PHP

##### Using php-cgi

Install php and php-cgi (see also PHP and LAMP).

Check that php-cgi is working `php-cgi --version`

    PHP 5.4.3 (cgi-fcgi) (built: May  8 2012 17:10:17)
    Copyright (c) 1997-2012 The PHP Group
    Zend Engine v2.4.0, Copyright (c) 1998-2012 Zend Technologies

If you get a similar output, php is installed correctly.

Create a new configuration file:

    /etc/lighttpd/conf.d/fastcgi.conf

    # Make sure to install php and php-cgi. See:
    # https://wiki.archlinux.org/index.php/Fastcgi_and_lighttpd#PHP

    server.modules += ("mod_fastcgi")

    # FCGI server
    # ===========
    #
    # Configure a FastCGI server which handles PHP requests.
    #
    index-file.names += ("index.php")
    fastcgi.server = (
        # Load-balance requests for this path...
        ".php" => (
            # ... among the following FastCGI servers. The string naming each
            # server is just a label used in the logs to identify the server.
            "localhost" => (
                "bin-path" => "/usr/bin/php-cgi",
                "socket" => "/tmp/php-fastcgi.sock",
                # breaks SCRIPT_FILENAME in a way that PHP can extract PATH_INFO
                # from it
                "broken-scriptfilename" => "enable",
                # Launch (max-procs + (max-procs * PHP_FCGI_CHILDREN)) procs, where
                # max-procs are "watchers" and the rest are "workers". See:
                # https://wiki.lighttpd.net/frequentlyaskedquestions#How-many-php-CGI-processes-will-lighttpd-spawn
                "max-procs" => "4", # default value
                "bin-environment" => (
                    "PHP_FCGI_CHILDREN" => "1" # default value
                )
            )
        )
    )

Make lighttpd use the new configuration file by appending the following line to your lighttpd configuration file:

    /etc/lighttpd/lighttpd.conf

    include = "conf.d/fastcgi.conf"

Note: Remember that the order in which the modules are loaded is important. The correct order is listed in `/usr/share/doc/lighttpd/config/modules.conf`.

Reload lighttpd.

Note:

- If you receive errors like No input file found when attempting to access php files, there are several possible explanations. See this FAQ for more information.
- Make sure that no other module (e.g. `mod_cgi`) will try to handle the .php extension.

##### Using php-fpm

For dynamic management of PHP processes, you can install php-fpm and then start and enable `php-fpm.service`.

Note: You can configure the number of servers in the pool and tweak other configuration options by editing the file `/etc/php/php-fpm.conf`. More details on php-fpm can be found on the php-fpm website. Remember that when you make changes to `/etc/php/php.ini`, you will need to restart `php-fpm.service`.

In `/etc/lighttpd/conf.d/fastcgi.conf` add:

    server.modules += ( "mod_fastcgi" )

    index-file.names += ( "index.php" )

    fastcgi.server = (
        ".php" => (
          "localhost" => (
            "socket" => "/run/php-fpm/php-fpm.sock",
            "broken-scriptfilename" => "enable"
          ))
    )

### uWSGI

In `/etc/lighttpd/lighttpd.conf` add

    server.modules += ("mod_scgi")

    $HTTP["url"] =~ "^/uwsgi/" {
        scgi.protocol = "uwsgi"
        scgi.server   = (
            "/uwsgi/foo" => ((
                "socket"            => "/path/to/socket",
                "check-local"       => "disable"
            )),
            "/uwsgi/bar" => ((
                "host"              => "127.0.0.1",
                "port"              => "8080",
                "check-local"       => "disable"
            ))
        )
    }

You can than start the uwsgi application either as a systemd unit or direct. Here is a neat guide from digitalocean on how to setup a flask application from the scratch.

### Output compression

Copy example configuration file:

    # mkdir /etc/lighttpd/conf.d
    # cp /usr/share/doc/lighttpd/config/conf.d/deflate.conf /etc/lighttpd/conf.d/

Add following in `/etc/lighttpd/lighttpd.conf`:

    include "conf.d/deflate.conf"

Finally, reload `lighttpd.service`, and it will dynamically compress plain text and html content.

Note: You can not do this (copy `deflate.conf`) and add a needed content in `/etc/lighttpd/lighttpd.conf` instead.

It is also possible to select the type of content that should be compressed. Modify `/etc/lighttpd/conf.d/deflate.conf` on the parameter `deflate.mimetypes`:

    deflate.mimetypes = ("text/plain", "text/html", "text/javascript", "text/css", "text/xml")

You can also create a cache directory to store compressed files:

    # mkdir /var/cache/lighttpd/compress
    # chown http:http /var/cache/lighttpd/compress

Then uncomment and modify the `deflate.cache-dir` option in `/etc/lighttpd/conf.d/deflate.conf`:

    deflate.cache-dir = "/var/cache/lighttpd/compress"

## See also

- lighttpd wiki

Category:

- Web server