Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to generate an IP firewall list for nginx through PHP. PHP generates the firewall.conf and this I want to include in nginx.

The problem is that nginx doesn't check changes in .conf-files, so I need to run "nginx reload". As our security settings doesn't allow exec() I'm not able to access the command line.

So my question is: Is it possible to reload nginx confs by a http request?

The idea is to call "http://example.org/?secret=key" by using PHP and this fires "nginx reload".

share|improve this question

closed as not constructive by mgorven, Ward, Khaled, mdpc, mailq Feb 26 '13 at 21:59

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Creating a firewall in PHP sounds like a Bad Idea™... You could solve this in several ways, including, but not limited to, using any of the modules that integrate different programming languages into nginx (Lua, Perl, ...), writing your own nginx module... Also you don't really want to "run" "nginx reload" (whatever that means). You just want to send nginx SIGHUP. –  Gnarfoz Jul 27 '12 at 9:24
    
A firewall inside PHP is a bad idea, but not if you combine it with nginx. Its much easier to implement filters inside of PHP (hidden forms, bad word filter, filters based of incorrect data in registration forms, etc.). By the way: SIGHUP results a downtime. This is the reason why I said reload. Look here: serverfault.com/a/378585/44086 –  mgutt Jul 27 '12 at 12:11
    
I guess I misunderstood what you meant by "generate an IP firewall through PHP". Regarding nginx: "reload" is SIGHUP, and it spawns the new workers first, then shuts down the old. There should be no downtime. nginx.org/en/docs/control.html –  Gnarfoz Jul 27 '12 at 12:33
add comment

1 Answer

up vote 0 down vote accepted

This is surely not possible out of the box. Some ideas as to how you could do it:

  1. If you are able to send signals to the nginx process, you could try to send the HUP signal: posix_kill($pid_of_nginx, SIGHUP). Of course, this requires the POSIX functions in PHP.
  2. Write a program which listens for a reload command on a named pipe and which reacts by reloading nginx. With PHP, you then simply write the necessary command into the named pipe and you are done.
  3. Same as 2. with a program which regularly checks for a specific file at a given location (e.g. /tmp/reload-nginx). In PHP you then create that file and nginx will be reloaded.

EDIT: The "pipe thing" isn't so difficult:

#!/bin/bash
pipe=/tmp/mypipe
trap "rm -f $pipe" EXIT

if [ ! -p "$pipe" ]; then
  mkfifo $pipe
fi

while true; do
  if read line <$pipe; then
    if [ "$line" == "reload" ]; then
      ...do the reload here...
    fi
  fi
done

Now, echo reload >/tmp/mypipe will wake up that script and lets you do what you want.

share|improve this answer
    
1.) posix_kill results a downtime :( 2.) how difficult is it writing a nginx module? –  mgutt Jul 27 '12 at 12:28
1  
See above, SIGHUP is the signal to initiate a reload of the configuration and should not result in downtime. nginx.org/en/docs/control.html –  Gnarfoz Jul 27 '12 at 12:35
1  
@mgutt writing a nginx module is for sure more difficult than implementing all the ideas I have proposed... –  Oliver Jul 27 '12 at 13:12
    
Ok thank you. I tried. Apache runs in its own sandbox, so I don't have access to the nginx process. The pipe thing looks difficult. –  mgutt Jul 27 '12 at 13:27
    
@mgutt see my edit. –  Oliver Jul 27 '12 at 14:06
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.