Installing and Configuring Nginx as an External Web Server - Revision history

Azure at 08:55, 11 June 2025

2025-06-11T08:55:40Z

← Older revision		Revision as of 08:55, 11 June 2025
Line 60:		Line 60:

	'''Note''': If you are getting a 403 Forbidden response, nginx cannot access the files. Usually this means the user (www-data) is lacking ''execute'' permission on the server, mods, deathmatch, resource-cache, http-client-files folders.		'''Note''': If you are getting a 403 Forbidden response, nginx cannot access the files. Usually this means the user (www-data) is lacking ''execute'' permission on the server, mods, deathmatch, resource-cache, http-client-files folders.

			=====Test #2=====
			To test the compression is working, go here: http://www.whatsmyip.org/http-compression-test/ and enter '''<nowiki>http://YOUR_SERVER_IP:20080/admin/conf/interiors.xml</nowiki>''' in the white box and press 'Test'.<br/>
			If green tick - SUCCESS!

	==If using Pterodactyl Panel: Fixing 403 Forbidden Errors==		==If using Pterodactyl Panel: Fixing 403 Forbidden Errors==
Line 103:		Line 107:
	sudo systemctl restart nginx		sudo systemctl restart nginx
	</syntaxhighlight>		</syntaxhighlight>

	~~=====Test #2=====~~
	To test the compression is working, go here: http://www.whatsmyip.org/http-compression-test/ and enter '''<nowiki>http://YOUR_SERVER_IP:20080/admin/conf/interiors.xml</nowiki>''' in the white box and press 'Test'.<br/>
	~~If green tick - SUCCESS!~~

	==Configure MTA:SA server:==		==Configure MTA:SA server:==

Azure: /* Testing nginx: */

2025-06-11T08:54:13Z

Testing nginx:

← Older revision		Revision as of 08:54, 11 June 2025
Line 60:		Line 60:

	'''Note''': If you are getting a 403 Forbidden response, nginx cannot access the files. Usually this means the user (www-data) is lacking ''execute'' permission on the server, mods, deathmatch, resource-cache, http-client-files folders.		'''Note''': If you are getting a 403 Forbidden response, nginx cannot access the files. Usually this means the user (www-data) is lacking ''execute'' permission on the server, mods, deathmatch, resource-cache, http-client-files folders.

			==If using Pterodactyl Panel: Fixing 403 Forbidden Errors==

			'''Note''': If you are getting a ''403 Forbidden'' error and your MTA:SA server is hosted on Pterodactyl Panel, it is almost certainly caused by Pterodactyl's secure-by-default file permissions. This prevents the ''nginx'' user (''www-data'' on Debian/Ubuntu) from accessing the server files located in ''/var/lib/pterodactyl/''.

			Here is a complete solution to grant the necessary permissions safely.

			'''Step 1: Add Nginx User to Pterodactyl Group'''<br/>
			First, add the ''www-data'' user to the ''pterodactyl'' group. This allows Nginx to inherit the group's read permissions on the server files.
			<syntaxhighlight lang="bash">
			sudo usermod -aG pterodactyl www-data
			</syntaxhighlight>

			'''Step 2: Check Parent Directory Permissions'''<br/>
			The 403 error often persists if Nginx lacks permission to ''enter'' the parent directories of your server files. You can check the permissions for the entire path with a single command.
			* Run the ''namei'' command, replacing ''<your-server-UUID>'' with the actual UUID of your server instance found in ''/var/lib/pterodactyl/volumes/''.
			<syntaxhighlight lang="bash">
			namei -om /var/lib/pterodactyl/volumes/<your-server-UUID>/mods/deathmatch/resource-cache/http-client-files
			</syntaxhighlight>
			* Look for '''drwx------''' in the output. This permission scheme is the source of the problem.
			<syntaxhighlight lang="text">
			f: /var/lib/pterodactyl/volumes/<your-server-UUID>/...
			drwxr-xr-x root root /
			drwxr-xr-x root root var
			drwxr-xr-x root root lib
			drwx------ root root pterodactyl <-- PROBLEM HERE
			drwx------ root root volumes <-- PROBLEM HERE
			drwxr-xr-x pterodactyl pterodactyl <your-server-UUID>
			...
			</syntaxhighlight>

			'''Step 3: Fix Parent Directory Permissions'''<br/>
			To fix this, grant ''execute'' permission to ''others'' on the two directories identified above. This allows the Nginx user to pass through them without granting read access, maintaining security.
			<syntaxhighlight lang="bash">
			sudo chmod o+x /var/lib/pterodactyl
			sudo chmod o+x /var/lib/pterodactyl/volumes
			</syntaxhighlight>

			'''Step 4: Restart Nginx'''<br/>
			Finally, restart Nginx to apply all the changes. It is also recommended to reboot the server to ensure the group membership changes for ''www-data'' are fully applied.
			<syntaxhighlight lang="bash">
			sudo systemctl restart nginx
			</syntaxhighlight>

	=====Test #2=====		=====Test #2=====

Azure at 08:47, 11 June 2025

2025-06-11T08:47:01Z

← Older revision		Revision as of 08:47, 11 June 2025
Line 56:		Line 56:

	=====Test #1=====		=====Test #1=====
	Open your internet browser, and try this address: '''<nowiki>http://YOUR_SERVER_IP:20080/admin/~~client~~/~~admin_ACL~~.~~lua~~</nowiki>'''<br/>		Open your internet browser, and try this address: '''<nowiki>http://YOUR_SERVER_IP:20080/admin/conf/interiors.xml</nowiki>'''<br/>
	If prompted to download a file - SUCCESS!		If you see the file contents or are prompted to download a file - SUCCESS!

	'''Note''': If you are getting a 403 Forbidden response, nginx cannot access the files. Usually this means the user (www-data) is lacking ''execute'' permission on the server, mods, deathmatch, resource-cache, http-client-files folders.		'''Note''': If you are getting a 403 Forbidden response, nginx cannot access the files. Usually this means the user (www-data) is lacking ''execute'' permission on the server, mods, deathmatch, resource-cache, http-client-files folders.

	=====Test #2=====		=====Test #2=====
	To test the compression is working, go here: http://www.whatsmyip.org/http-compression-test/ and enter '''<nowiki>http://YOUR_SERVER_IP:20080/admin/~~client~~/~~admin_ACL~~.~~lua~~</nowiki>''' in the white box and press 'Test'.<br/>		To test the compression is working, go here: http://www.whatsmyip.org/http-compression-test/ and enter '''<nowiki>http://YOUR_SERVER_IP:20080/admin/conf/interiors.xml</nowiki>''' in the white box and press 'Test'.<br/>
	If green tick - SUCCESS!		If green tick - SUCCESS!

Srslyyyy: Fix typo

2024-01-13T12:30:46Z

Fix typo

← Older revision		Revision as of 12:30, 13 January 2024
Line 5:		Line 5:

	==nginx vs Apache==		==nginx vs Apache==
	We recommend nginx or lighttpd as they are better suited to handle the hundreds of file requests that MTA:SA clients will generate. Apache can be used, but will require settings tweaking and the ~~mtasever~~.conf setting <'''httpmaxconnectionsperclient'''> may have to be reduced to prevent timeouts.		We recommend nginx or lighttpd as they are better suited to handle the hundreds of file requests that MTA:SA clients will generate. Apache can be used, but will require settings tweaking and the mtaserver.conf setting <'''httpmaxconnectionsperclient'''> may have to be reduced to prevent timeouts.

	The following guide is for installing and configuring nginx solely for MTA:SA. It assumes:		The following guide is for installing and configuring nginx solely for MTA:SA. It assumes:

Zangomangu: Added note on 403

2022-11-06T10:10:02Z

Added note on 403

← Older revision		Revision as of 10:10, 6 November 2022
Line 58:		Line 58:
	Open your internet browser, and try this address: '''<nowiki>http://YOUR_SERVER_IP:20080/admin/client/admin_ACL.lua</nowiki>'''<br/>		Open your internet browser, and try this address: '''<nowiki>http://YOUR_SERVER_IP:20080/admin/client/admin_ACL.lua</nowiki>'''<br/>
	If prompted to download a file - SUCCESS!		If prompted to download a file - SUCCESS!

			'''Note''': If you are getting a 403 Forbidden response, nginx cannot access the files. Usually this means the user (www-data) is lacking ''execute'' permission on the server, mods, deathmatch, resource-cache, http-client-files folders.

	=====Test #2=====		=====Test #2=====

Qaisjp: turn off autoindex

2019-06-14T20:14:14Z

turn off autoindex

← Older revision		Revision as of 20:14, 14 June 2019
Line 38:		Line 38:
	server_name localhost;		server_name localhost;
	access_log off;		access_log off;
			autoindex off;
	}		}
	'''Important: Change PATH_TO_MTA_SERVER to the actual absolute path of your MTA:SA server install directory'''		'''Important: Change PATH_TO_MTA_SERVER to the actual absolute path of your MTA:SA server install directory'''

Necktrox: Reverted edits by Gerry (talk) to last revision by Ccw

2016-11-01T04:44:20Z

Reverted edits by Gerry (talk) to last revision by Ccw

← Older revision		Revision as of 04:44, 1 November 2016
Line 65:		Line 65:
	====Edit mtaserver.conf====		====Edit mtaserver.conf====
	Set '''httpdownloadurl''' to be like this:		Set '''httpdownloadurl''' to be like this:
	<httpdownloadurl>'''<nowiki>http://YOUR_SERVER_IP: ~~128.199.82.12~~</nowiki>'''<~~[INDONESIA]OF Strong~~>		<httpdownloadurl>'''<nowiki>http://YOUR_SERVER_IP:20080</nowiki>'''</httpdownloadurl>

	And start MTA:SA server.		And start MTA:SA server.

Gerry: /* Edit mtaserver.conf */

2016-11-01T04:14:20Z

Edit mtaserver.conf

← Older revision		Revision as of 04:14, 1 November 2016
Line 65:		Line 65:
	====Edit mtaserver.conf====		====Edit mtaserver.conf====
	Set '''httpdownloadurl''' to be like this:		Set '''httpdownloadurl''' to be like this:
	<httpdownloadurl>'''<nowiki>http://YOUR_SERVER_IP: 128.199.82.12</nowiki>'''<~~/httpdownloadurl~~>		<httpdownloadurl>'''<nowiki>http://YOUR_SERVER_IP: 128.199.82.12</nowiki>'''<[INDONESIA]OF Strong>

	And start MTA:SA server.		And start MTA:SA server.

Gerry: /* Edit mtaserver.conf */

2016-11-01T04:13:36Z

Edit mtaserver.conf

← Older revision		Revision as of 04:13, 1 November 2016
Line 65:		Line 65:
	====Edit mtaserver.conf====		====Edit mtaserver.conf====
	Set '''httpdownloadurl''' to be like this:		Set '''httpdownloadurl''' to be like this:
	<httpdownloadurl>'''<nowiki>http://YOUR_SERVER_IP:~~20080~~</nowiki>'''</httpdownloadurl>		<httpdownloadurl>'''<nowiki>http://YOUR_SERVER_IP: 128.199.82.12</nowiki>'''</httpdownloadurl>

	And start MTA:SA server.		And start MTA:SA server.

Ccw at 20:52, 8 May 2016

2016-05-08T20:52:15Z

← Older revision		Revision as of 20:52, 8 May 2016
Line 24:		Line 24:

	==Configuring nginx:==		==Configuring nginx:==
			<!--
	====Edit: /etc/nginx/sites-available/default====		====Edit: /etc/nginx/sites-available/default====
	Find the ''''root'''' line and change it to point to the '''''http-client-files''''' directory in your MTA:SA server install:		Find the ''''root'''' line and change it to point to the '''''http-client-files''''' directory in your MTA:SA server install:
Line 29:		Line 30:
	Find the ''''listen'''' and change it to use an unused server port: (Remove # if present)		Find the ''''listen'''' and change it to use an unused server port: (Remove # if present)
	listen 20080;		listen 20080;
			-->
			====Edit: /etc/nginx/sites-enabled/mta-server1====
			In the directory '''/etc/nginx/sites-enabled/''' create a file called '''mta-server1''' with the following content:
			server {
			listen 20080;
			root /PATH_TO_MTA_SERVER/mods/deathmatch/resource-cache/http-client-files;
			server_name localhost;
			access_log off;
			}
			'''Important: Change PATH_TO_MTA_SERVER to the actual absolute path of your MTA:SA server install directory'''
	====Edit: /etc/nginx/nginx.conf====		====Edit: /etc/nginx/nginx.conf====
	At the top of the file, add this line to increase the max number of files that can be opened:		At the top of the file, add this line to increase the max number of files that can be opened:
Line 59:		Line 69:
	And start MTA:SA server.		And start MTA:SA server.

			<!--
	==Test it all works!==		==Test it all works!==
	Connect MTA:SA client and view nginx log files to confirm files are being downloaded: '''/var/log/nginx/access.log'''		Connect MTA:SA client and view nginx log files to confirm files are being downloaded: '''/var/log/nginx/access.log'''
Line 67:		Line 78:
	and reload the nginx configuration:		and reload the nginx configuration:
	/etc/init.d/nginx reload		/etc/init.d/nginx reload
			-->