Skip to main content How-to: Nginx-UI on OpenWRT without Building : r/linux
r/linux icon
Go to linux
•

How-to: Nginx-UI on OpenWRT without Building

Tips and Tricks

Background:

So there's another nginx manager known as nginx-ui. You can check it out here: https://nginxui.com/. It seems to be a bit more comprehensive than Nginx Proxy Manager, especially since you can edit the nginx config files directly from the browser.

I have been wanting to setup OpenWRT as a lightweight consolidated ingress controller on proxmox, since my proxmox server has low resources (it's an old recycled laptop).

Nginx-UI does support OpenWRT, however only by building it. This is because the nginx-ui installation script relies on 4 things not available on OpenWRT by default: bash, /usr/lib/bin, the "install" command, and systemd.

However, (from the source code) that looks like those are the only 4 limitations, so not too bad. Those are easy to fix.

Nginx Setup

Install the nginx package and disable UCI integration: 

opkg update
opkg install nginx

uci set nginx.global.uci_enable='false'
uci commit

service nginx restart # or /etc/init.d/nginx restart

For setting up the nginx config, go here:

Re-implementing nginx-ui/install.sh

The first limitation (no bash) is a no brainer. We will just install the package manually or just use sh instead.

For the rest of it, let's start with breaking the install script down starting with the main() function.

This is the actual installer. The first 3 lines of this function does the following in order:

  1. check if running under root (root is the default user on OpenWRT, so not applicable)

  2. check the system requirements, which are mainly:

    1. is this docker or does this system have systemd?

      1. From the looks of it, systemd is only required for service scheduling. We can just translate the service files from systemd-compliant to /etc/init.d-compliant

    2. which of the supported package managers does this system have for dependency installation? - we don't care, we will install any dependencies with opkg manually

  3. sanitizes the script's parameters

The script then spends the next block downloading and extracting the release file (tar.gz) to a temp directory (mktemp -d)

This should be easy to replicate with the curl/wget and tar commands.

Then the script installs the software using the install_bin function:

Which is just a wrapper for: 

install -m 755 "${TMP_DIRECTORY}/nginx-ui" "/usr/local/bin/nginx-ui"

This install invocation contains 2 of the limitations: install not included with openwrt and the usage of /usr/local/bin. install is just a wrapper for cp then chmod, and any files installed to /usr/local/bin can also be installed to /usr/bin. So this can be rewritten as: 

cp "${TMP_DIRECTORY}/nginx-ui" "/usr/bin/nginx-ui"
chmod 755 "/usr/bin/nginx-ui"

Nice! Now, let's move on to the next limitation in the installation script: installing nginx-ui as a systemd service. OpenWRT does not support systemd services, so we have to translate the service file defined by the install_service() function to /etc/init.d

Here is what the resultant /etc/init.d service script will look like. 

#!/bin/sh /etc/rc.common

START=99
STOP=10

USE_PROCD=1
PROG="/usr/bin/nginx-ui"
ARGS="-config /etc/nginx-ui/app.ini"

start_service() {
    procd_open_instance
    procd_set_param command "\$PROG" \$ARGS
    procd_set_param stdout 1
    procd_set_param stderr 1
    procd_set_param respawn
    procd_close_instance
}

stop_service() {
    killall nginx-ui
}

restart() {
    stop
    start
}

Then we make the service script executable and enable it with: 

chmod +x /etc/init.d/nginxui
/etc/init.d/nginxui enable

So then we get to the last step which is to install the default configuration

  • https://github.com/0xJacky/nginx-ui/blob/dev/install.sh#L288-L303cat > "/etc/nginx-ui/app.ini" << EOF [server] RunMode = releaseHttpPort = 9000 HTTPChallengePort = 9180 EOFrecommend setting this to a different interface than what LuCi is listening to you can change LuCi's listening address as well by changing uHTTPd's listening address HttpHost = 0.0.0.0 set these to whatever port you like

TL;DR:

Download and install: 

cd $(mktemp -d)

# Update this as needed
wget  -O nginx-ui-linux-64.tar.gz

tar -zxf nginx-ui-linux-64.tar.gz -C ./

cp "nginx-ui" "/usr/bin/nginx-ui"
chmod 755 "/usr/bin/nginx-ui"https://github.com/0xJacky/nginx-ui/releases/download/v2.0.0-beta.18-patch.2/nginx-ui-linux-64.tar.gz

Setup the service file: 

cat > "/etc/init.d/nginxui" << EOF
#!/bin/sh /etc/rc.common

START=99
STOP=10

USE_PROCD=1
PROG="/usr/bin/nginx-ui"
ARGS="-config /etc/nginx-ui/app.ini"

start_service() {
    procd_open_instance
    procd_set_param command "$PROG" $ARGS
    procd_set_param stdout 1
    procd_set_param stderr 1
    procd_set_param respawn
    procd_close_instance
}

stop_service() {
    killall nginx-ui
}

restart() {
    stop
    start
}
EOF

chmod +x /etc/init.d/nginxui

Configure the initial settings: 

cat > "/etc/nginx-ui/app.ini" << EOF
[server]
RunMode = release
# recommend setting this to a different interface than what LuCi is listening to
# you can change LuCi's listening address as well by changing uHTTPd's listening address
# HttpHost = 

# set these to whatever port you like
HttpPort = 9000
HTTPChallengePort = 9180

[cert]
# Highly recommended to bypass OpenWRT's system resolver (which can cause bugs)
# - see 
RecursiveNameservers=8.8.8.8:53,1.1.1.1:53
EOF0.0.0.0https://nginxui.com/guide/config-cert.html#recursivenameservers

Enable and start the service: 

/etc/init.d/nginxui enable
service nginxui start # or /etc/init.d/nginxui start

EDIT (DEC 2024): Added RecursiveNameservers setting to workaround OpenWRT's buggy internal DNS resolution and added nginx setup step.

• • Edited

/etc/nginx/nginx.conf: 

user root;
worker_processes auto;
pid /var/run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	# server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}

Make sure to create the directories /etc/nginx/sites-available and /etc/nginx/sites-enabled

Not sure yet how to change the user to www or www-data, but I suspect it has something to do with file permissions of the content of /etc/nginx