Web server

Reqad serves sites with nginx, and PHP runs in each account's own PHP-FPM pool. Sites written for Apache need their .htaccess files: for them, a server can run Apache behind nginx instead.

The two setups

In both, PHP runs as the account, in its own pool, with the PHP version chosen for the site. The files, the pools and the certificates are the same, so a server can switch from one setup to the other and back.

How Apache behind nginx works

• Apache listens on 127.0.0.1:8080 and 127.0.0.1:8443 only. Visitors always reach nginx, which passes the requests on.
• An HTTPS visit reaches Apache over HTTPS too, so .htaccess rules that test %{HTTPS} and PHP's $_SERVER['HTTPS'] and port see what the visitor used. "Force HTTPS" rules do not loop.
• PHP and the logs see the visitor's address. nginx sends it, and Apache accepts it only from nginx.
• nginx serves files with common static extensions (images, CSS, JavaScript, fonts, media, PDF, archives, .txt, .xml) straight from disk. A .htaccess rule cannot protect those files: put them outside the document root, or use password protection. A static file that does not exist goes to Apache, so rewrites that build images or sitemaps keep working.
• Hosting accounts cannot connect to Apache's ports directly; they go through nginx like any visitor.
• Symbolic links in a site are followed only to files of the same owner. .htaccess files cannot turn on FollowSymLinks (that folder answers 500, and the Needs attention card says which file); Options +SymLinksIfOwnerMatch works the same for rewrite rules, and Reqad changes existing files to it.
• The access logs (and so the bandwidth count), suspended and slowed-down sites, an account's own IP address, Let's Encrypt and the WordPress Toolkit's security rules stay with nginx and work the same way.
• Node.js and Python apps run as before. When an app is removed, the domain goes back to Apache.

Switching

On Accounts & Domains > Web server, choose Switch to Apache behind nginx (or back to nginx alone). The panel asks for your password again, and the switch runs in the background while the page shows its progress. It takes a minute or two, and the sites keep answering.

To Apache behind nginx:

1. Apache (httpd and mod_ssl) is installed if needed and set up for loopback only. Apache joins the nginx group, so it reads the document roots and PHP sockets without any permission changes.
2. Every site (main and addon domains) gets an Apache vhost, and its nginx vhost passes everything but static files to Apache. The nginx vhost's location / is written fresh from the template, so nginx rules you added there by hand do not carry over; put them in the site's .htaccess.
3. The WordPress nginx cache is turned off where it was on.

Back to nginx alone, the nginx vhosts hand PHP to the pools again, the Apache vhosts are removed and Apache is stopped (it stays installed). From then on .htaccess files no longer count. Sites that need their rewrite rules may show "not found" pages until the rules are in their nginx vhost.

Before changing anything, Reqad checks that it can convert every site. A vhost that was changed too much by hand (for example a second PHP handler outside location /) stops the switch, and nothing is changed. The old files are copied to /var/lib/reqad/webstack/<date>/. If Apache's or nginx's configuration test fails, every file is put back. Afterwards, the log lists any site whose home page answers differently than before.

New accounts and addon domains created later follow the setup in use. Aliases, PHP version changes and turning PHP off or on change both vhosts.

Needs attention

With Apache behind nginx, the dashboard's Needs attention card shows an error when Apache is not running, because the sites then answer 502. systemctl start httpd brings them back.

On the command line

reqad webserver status                                 # the setup in use, Apache's state
reqad webserver switch nginx_apache_php-fpm --dry-run  # which sites would be converted
reqad webserver switch nginx_apache_php-fpm            # Apache behind nginx
reqad webserver switch nginx_php-fpm                   # back to nginx alone

Removing the reqad-hosting-pro package switches the server back to nginx alone first.

Need a hand? Create a free account or contact us.