\u0130nternet d\u00fcnyas\u0131nda web sitelerinin h\u0131z\u0131 ve performans\u0131, kullan\u0131c\u0131 deneyimi ve arama motoru optimizasyonu (SEO) a\u00e7\u0131s\u0131ndan kritik bir \u00f6neme sahiptir. Bu ba\u011flamda, HTTP\/2 protokol\u00fc, web trafi\u011fini daha verimli hale getirerek \u00f6nemli performans iyile\u015ftirmeleri sunar. Nginx ise, y\u00fcksek performansl\u0131, kararl\u0131 ve kaynak dostu yap\u0131s\u0131yla modern web sunucular\u0131 aras\u0131nda pop\u00fcler bir tercihtir. Bu makalede, Ubuntu 16.04 i\u015fletim sistemi \u00fczerinde Nginx web sunucusunu HTTP\/2 deste\u011fiyle nas\u0131l kuraca\u011f\u0131n\u0131z\u0131 ve yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m detayl\u0131 bir \u015fekilde inceleyece\u011fiz. Ubuntu 16.04, uzun s\u00fcreli destek (LTS) sunan eski bir s\u00fcr\u00fcm olsa da, bir\u00e7ok sunucuda hala kullan\u0131lmaktad\u0131r ve bu yap\u0131land\u0131rman\u0131n nas\u0131l yap\u0131laca\u011f\u0131n\u0131 anlamak \u00f6nemlidir.<\/p>\n
HTTP\/2, Hypertext Transfer Protocol’\u00fcn ikinci b\u00fcy\u00fck s\u00fcr\u00fcm\u00fcd\u00fcr ve HTTP\/1.1’in baz\u0131 temel s\u0131n\u0131rlamalar\u0131n\u0131 a\u015fmak i\u00e7in tasarlanm\u0131\u015ft\u0131r. Temel amac\u0131, web sayfalar\u0131n\u0131n y\u00fcklenme s\u00fcrelerini azaltarak kullan\u0131c\u0131 deneyimini iyile\u015ftirmektir. HTTP\/2’nin getirdi\u011fi ba\u015fl\u0131ca yenilikler \u015funlard\u0131r:<\/p>\n
* \u00c7oklama (Multiplexing):<\/strong> HTTP\/1.1’de her istek i\u00e7in ayr\u0131 bir TCP ba\u011flant\u0131s\u0131 kurulmas\u0131 gerekirken, HTTP\/2 tek bir TCP ba\u011flant\u0131s\u0131 \u00fczerinden birden fazla e\u015fzamanl\u0131 iste\u011fi ve yan\u0131t\u0131 y\u00f6netebilir. Bu, ba\u011flant\u0131 say\u0131s\u0131n\u0131 azaltarak performans\u0131 art\u0131r\u0131r. Nginx ise, bu performans iyile\u015ftirmelerini sunmak i\u00e7in ideal bir platformdur. \u00d6zellikle statik i\u00e7erik sunumu ve ters proxy (reverse proxy) g\u00f6revlerinde \u00fcst\u00fcn performans g\u00f6sterir. Nginx’in mod\u00fcler yap\u0131s\u0131 ve d\u00fc\u015f\u00fck kaynak t\u00fcketimi, onu yo\u011fun trafikli web siteleri i\u00e7in tercih edilen bir se\u00e7enek haline getirir. HTTP\/2 deste\u011fi, Nginx 1.9.5 s\u00fcr\u00fcm\u00fcnden itibaren mevcuttur ve Ubuntu 16.04’\u00fcn varsay\u0131lan depolar\u0131nda gelen Nginx s\u00fcr\u00fcm\u00fc (genellikle 1.10.x) bu deste\u011fi i\u00e7erir. HTTP\/2, pratik olarak her zaman SSL\/TLS ile birlikte kullan\u0131ld\u0131\u011f\u0131ndan, bu kurulum rehberi ayn\u0131 zamanda Nginx \u00fczerinde SSL\/TLS yap\u0131land\u0131rmas\u0131n\u0131 da kapsayacakt\u0131r.<\/p>\n Bu rehbere ba\u015flamadan \u00f6nce a\u015fa\u011f\u0131daki \u00f6n ko\u015fullar\u0131n yerine getirildi\u011finden emin olun:<\/p>\n * Ubuntu 16.04 Sunucusu:<\/strong> Temiz bir Ubuntu 16.04 sunucusu (VPS veya fiziksel sunucu). \u0130lk ad\u0131m, Nginx web sunucusunu Ubuntu 16.04 sunucunuza kurmakt\u0131r.<\/p>\n Kuruluma ba\u015flamadan \u00f6nce, sistemdeki paket listesini g\u00fcncellemek ve mevcut paketleri y\u00fckseltmek iyi bir uygulamad\u0131r:<\/p>\n G\u00fcncelleme i\u015fleminden sonra Nginx’i kurabiliriz:<\/p>\n Kurulum tamamland\u0131ktan sonra, Nginx servisi otomatik olarak ba\u015flayacakt\u0131r. Durumunu kontrol etmek i\u00e7in a\u015fa\u011f\u0131daki komutu kullanabilirsiniz:<\/p>\n \u00c7\u0131kt\u0131da Ubuntu sunucular\u0131nda varsay\u0131lan olarak gelen UFW (Uncomplicated Firewall) g\u00fcvenlik duvar\u0131n\u0131 yap\u0131land\u0131rman\u0131z gerekebilir. Nginx, UFW ile entegre olacak \u015fekilde baz\u0131 profil tan\u0131mlamalar\u0131 yapar.<\/p>\n Mevcut uygulama profillerini listelemek i\u00e7in:<\/p>\n Bu komutun \u00e7\u0131kt\u0131s\u0131 Nginx ile ilgili \u015fu profilleri i\u00e7erecektir:<\/p>\n * HTTP\/2’yi SSL ile kullanaca\u011f\u0131m\u0131z ve t\u00fcm trafi\u011fi HTTPS’ye y\u00f6nlendirece\u011fimiz i\u00e7in Ard\u0131ndan, UFW’nin etkin oldu\u011fundan emin olun:<\/p>\n Bu komutun ard\u0131ndan bir onay istenecektir. \u00c7\u0131kt\u0131da 80 ve 443 portlar\u0131n\u0131n Nginx taraf\u0131ndan izin verildi\u011fini g\u00f6rmelisiniz. Art\u0131k taray\u0131c\u0131n\u0131zdan sunucunuzun IP adresine giderek varsay\u0131lan Nginx kar\u015f\u0131lama sayfas\u0131n\u0131 g\u00f6rebilirsiniz.<\/p>\n HTTP\/2’nin modern taray\u0131c\u0131lar taraf\u0131ndan kullan\u0131labilmesi i\u00e7in SSL\/TLS sertifikas\u0131 zorunludur. Bu b\u00f6l\u00fcmde, Let’s Encrypt ile \u00fccretsiz bir sertifika almay\u0131 ve Nginx ile kullanmay\u0131 ele alaca\u011f\u0131z.<\/p>\n Let’s Encrypt, Certbot arac\u0131 arac\u0131l\u0131\u011f\u0131yla kolayca sertifika alman\u0131z\u0131 sa\u011flar. Ubuntu 16.04 i\u00e7in Certbot’u PPA (Personal Package Archive) \u00fczerinden kurmak en iyi y\u00f6ntemdir.<\/p>\n \u00d6ncelikle PPA deposunu ekleyin:<\/p>\n Ard\u0131ndan Certbot’un Nginx eklentisini kurun:<\/p>\n Certbot, Nginx yap\u0131land\u0131rman\u0131z\u0131 otomatik olarak alg\u0131lay\u0131p d\u00fczenleyebilir ve sertifikay\u0131 kurabilir. Sertifika almak i\u00e7in a\u015fa\u011f\u0131daki komutu kullan\u0131n:<\/p>\n Bu komutta Certbot, sertifika alma s\u00fcrecinde size baz\u0131 sorular soracakt\u0131r:<\/p>\n 1. E-posta Adresi:<\/strong> Bildirimler ve kay\u0131p anahtar kurtarma i\u00e7in bir e-posta adresi girin. T\u00fcm ad\u0131mlar\u0131 tamamlad\u0131ktan sonra, Certbot sertifikan\u0131z\u0131 ba\u015far\u0131yla kuracak ve Nginx yap\u0131land\u0131rman\u0131z\u0131 g\u00fcncelleyecektir. \u00c7\u0131kt\u0131da sertifikan\u0131z\u0131n ba\u015far\u0131yla al\u0131nd\u0131\u011f\u0131n\u0131 ve ne zaman sona erece\u011fini belirten bir mesaj g\u00f6rmelisiniz.<\/p>\n Let’s Encrypt sertifikalar\u0131 90 g\u00fcn ge\u00e7erlidir. Certbot paketi, sertifikalar\u0131 otomatik olarak yenilemek i\u00e7in bir cron job veya systemd zamanlay\u0131c\u0131 kurar. Bu yenileme mekanizmas\u0131n\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in a\u015fa\u011f\u0131daki komutu kullanarak yenileme i\u015flemini sim\u00fcle edebilirsiniz:<\/p>\n E\u011fer bu komut herhangi bir hata vermeden \u00e7al\u0131\u015f\u0131rsa, sertifikalar\u0131n\u0131z\u0131n otomatik olarak yenilenece\u011fi anlam\u0131na gelir.<\/p>\n Certbot, Nginx yap\u0131land\u0131rman\u0131z\u0131 temel SSL ayarlar\u0131yla g\u00fcncelledi, ancak HTTP\/2’yi tam olarak etkinle\u015ftirmek ve baz\u0131 g\u00fcvenlik iyile\u015ftirmelerini eklemek i\u00e7in manuel d\u00fczenlemeler yapmam\u0131z gerekecek.<\/p>\n Certbot, genellikle Dosyan\u0131n i\u00e7eri\u011fi a\u015fa\u011f\u0131daki gibi g\u00f6r\u00fcnmelidir (sertifika yollar\u0131 ve alan adlar\u0131 sizin durumunuza g\u00f6re farkl\u0131l\u0131k g\u00f6sterecektir):<\/p>\n \u015eimdi G\u00fcncellenmi\u015f \u00d6nemli Not:<\/strong> Ubuntu 16.04’\u00fcn varsay\u0131lan depolar\u0131nda gelen Nginx 1.10.x s\u00fcr\u00fcm\u00fc genellikle TLSv1.3 deste\u011fi ile gelmez. E\u011fer De\u011fi\u015fiklikleri kaydetmek i\u00e7in Yap\u0131land\u0131rma dosyas\u0131n\u0131 d\u00fczenledikten sonra, de\u011fi\u015fiklikleri etkinle\u015ftirmek i\u00e7in Nginx’i yeniden ba\u015flatman\u0131z gerekir.<\/p>\n Nginx yap\u0131land\u0131rman\u0131zda herhangi bir hata olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in a\u015fa\u011f\u0131daki komutu kullan\u0131n:<\/p>\n E\u011fer her \u015fey yolundaysa, Yap\u0131land\u0131rma testinden sonra, de\u011fi\u015fiklikleri uygulamak i\u00e7in Nginx servisini yeniden y\u00fckleyin veya yeniden ba\u015flat\u0131n:<\/p>\n veya<\/p>\n Nginx’i HTTP\/2 ile ba\u015far\u0131yla yap\u0131land\u0131rd\u0131ktan sonra, bu deste\u011fin ger\u00e7ekten etkin olup olmad\u0131\u011f\u0131n\u0131 do\u011frulamak \u00f6nemlidir.<\/p>\n Web sitenizi modern bir taray\u0131c\u0131da (Chrome, Firefox, Edge) a\u00e7\u0131n. Geli\u015ftirici ara\u00e7lar\u0131n\u0131 a\u00e7\u0131n (F12 veya sa\u011f t\u0131klay\u0131p “\u0130ncele”). “Network” (A\u011f) sekmesine gidin. Sayfay\u0131 yeniden y\u00fckleyin. Kaynak listesinde, “Protocol” (Protokol) s\u00fctununda \u00c7e\u015fitli online ara\u00e7lar, web sitenizin HTTP\/2 deste\u011fini ve SSL\/TLS yap\u0131land\u0131rmas\u0131n\u0131n g\u00fcvenli\u011fini kontrol etmenize olanak tan\u0131r:<\/p>\n * KeyCDN HTTP\/2 Test:<\/strong> Sunucunuzdan veya ba\u015fka bir Linux makinesinden \u00c7\u0131kt\u0131da HTTP\/2 ba\u015fl\u0131klar\u0131n\u0131 g\u00f6rmelisiniz. \u00d6rne\u011fin:<\/p>\n E\u011fer Nginx ve HTTP\/2 kurulumunuzu tamamlad\u0131ktan sonra, web sitenizin performans\u0131n\u0131 ve g\u00fcvenli\u011fini daha da art\u0131rmak i\u00e7in baz\u0131 ek optimizasyonlar yapabilirsiniz.<\/p>\n Nginx’in ana yap\u0131land\u0131rma dosyas\u0131 olan * * * * * Bu de\u011fi\u015fiklikleri yapt\u0131ktan sonra Daha \u00f6nce ekledi\u011fimiz * * * * * Bu ba\u015fl\u0131\u011f\u0131 eklerken dikkatli olun ve sitenizin t\u00fcm kaynaklar\u0131n\u0131 do\u011fru bir \u015fekilde listeledi\u011finizden emin olun.<\/p>\n Kurulum s\u0131ras\u0131nda veya sonras\u0131nda kar\u015f\u0131la\u015fabilece\u011finiz baz\u0131 yayg\u0131n sorunlar ve \u00e7\u00f6z\u00fcmleri:<\/p>\n * Sorun:<\/strong> * Sorun:<\/strong> Taray\u0131c\u0131n\u0131zda “Ba\u011flant\u0131n\u0131z g\u00fcvenli de\u011fil” veya benzeri bir uyar\u0131 al\u0131yorsunuz. * Sorun:<\/strong> HTTP\/2’yi etkinle\u015ftirdi\u011finizden eminsiniz, ancak taray\u0131c\u0131 veya * Sorun:<\/strong> Nginx yeniden ba\u015flat\u0131l\u0131rken Bu kapsaml\u0131 rehberde, Ubuntu 16.04 i\u015fletim sistemi \u00fczerinde Nginx web sunucusunu HTTP\/2 deste\u011fiyle nas\u0131l kuraca\u011f\u0131n\u0131z\u0131 ve yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m \u00f6\u011frendiniz. Nginx’i kurmaktan, Let’s Encrypt ile \u00fccretsiz SSL\/TLS sertifikas\u0131 almaya ve HTTP\/2’yi etkinle\u015ftirmeye kadar t\u00fcm s\u00fcreci detayl\u0131ca inceledik. Ayr\u0131ca, web sitenizin performans\u0131n\u0131 ve g\u00fcvenli\u011fini art\u0131rmak i\u00e7in ek optimizasyonlar ve yayg\u0131n sorun giderme y\u00f6ntemleri hakk\u0131nda bilgi edindiniz.<\/p>\n HTTP\/2’nin sundu\u011fu h\u0131z ve verimlilik avantajlar\u0131 ile Nginx’in kararl\u0131 ve y\u00fcksek performansl\u0131 yap\u0131s\u0131n\u0131 birle\u015ftirmek, modern web uygulamalar\u0131 i\u00e7in g\u00fc\u00e7l\u00fc bir temel olu\u015fturur. Bu kurulum, kullan\u0131c\u0131 deneyimini iyile\u015ftirecek, SEO puan\u0131n\u0131z\u0131 art\u0131racak ve web sitenizin gelece\u011fe haz\u0131r olmas\u0131n\u0131 sa\u011flayacakt\u0131r. Unutmay\u0131n ki sunucu bak\u0131m\u0131 ve g\u00fcvenlik g\u00fcncellemeleri, herhangi bir web uygulamas\u0131n\u0131n uzun \u00f6m\u00fcrl\u00fcl\u00fc\u011f\u00fc ve g\u00fcvenli\u011fi i\u00e7in hayati \u00f6neme sahiptir. D\u00fczenli olarak sisteminizi ve Nginx’i g\u00fcncel tutmay\u0131 ihmal etmeyin.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Nginx’i HTTP\/2 Deste\u011fi ile Ubuntu 16.04 \u00dczerine Kurulum Rehberi\n\u0130nternet d\u00fcnyas\u0131nda web sitelerinin h\u0131z\u0131 ve performans\u0131, kullan\u0131c\u0131 deneyimi","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-32874","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n
\n* Sunucu \u0130tme (Server Push):<\/strong> Sunucu, taray\u0131c\u0131n\u0131n hen\u00fcz istemedi\u011fi kaynaklar\u0131 (CSS, JavaScript dosyalar\u0131 gibi) tahmin edip \u00f6nceden g\u00f6nderebilir. Bu, taray\u0131c\u0131n\u0131n ek isteklerde bulunma ihtiyac\u0131n\u0131 ortadan kald\u0131r\u0131r.
\n* Ba\u015fl\u0131k S\u0131k\u0131\u015ft\u0131rma (Header Compression):<\/strong> HTTP ba\u015fl\u0131klar\u0131, HPACK s\u0131k\u0131\u015ft\u0131rma algoritmas\u0131 kullan\u0131larak s\u0131k\u0131\u015ft\u0131r\u0131l\u0131r, bu da bant geni\u015fli\u011fi kullan\u0131m\u0131n\u0131 azalt\u0131r.
\n* \u0130kili \u00c7er\u00e7eveleme (Binary Framing):<\/strong> HTTP\/2, metin tabanl\u0131 HTTP\/1.1’in aksine ikili bir protokold\u00fcr. Bu, ayr\u0131\u015ft\u0131rmay\u0131 daha verimli ve hataya daha az e\u011filimli hale getirir.<\/p>\n\u00d6n Ko\u015fullar<\/h3>\n
\n* Sudo Yetkileri:<\/strong> Sudo yetkilerine sahip, root olmayan bir kullan\u0131c\u0131 hesab\u0131. G\u00fcvenlik nedeniyle root kullan\u0131c\u0131s\u0131 ile do\u011frudan i\u015flem yapmaktan ka\u00e7\u0131n\u0131lmal\u0131d\u0131r.
\n* Alan Ad\u0131 (Domain Name):<\/strong> Sunucunuzla ili\u015fkilendirilmi\u015f, DNS kay\u0131tlar\u0131 do\u011fru \u015fekilde yap\u0131land\u0131r\u0131lm\u0131\u015f bir alan ad\u0131. \u00d6rne\u011fin, ornekalanadi.com<\/code>.
\n* SSL\/TLS Sertifikas\u0131:<\/strong> HTTP\/2’nin \u00e7o\u011fu taray\u0131c\u0131 taraf\u0131ndan kabul edilmesi i\u00e7in SSL\/TLS sertifikas\u0131 gereklidir. Bu rehberde, \u00fccretsiz ve otomatik bir sertifika sa\u011flayan Let’s Encrypt’i kullanaca\u011f\u0131z.<\/p>\nNginx Kurulumu<\/h3>\n
Sistem Paketlerini G\u00fcncelleme<\/h4>\n
sudo apt update\nsudo apt upgrade<\/code><\/pre>\nNginx Paketini Kurma<\/h4>\n
sudo apt install nginx<\/code><\/pre>\nsystemctl status nginx<\/code><\/pre>\nactive (running)<\/code> ifadesini g\u00f6rmelisiniz. E\u011fer Nginx \u00e7al\u0131\u015fm\u0131yorsa, sudo systemctl start nginx<\/code> komutuyla ba\u015flatabilirsiniz.<\/p>\nG\u00fcvenlik Duvar\u0131n\u0131 Yap\u0131land\u0131rma (UFW)<\/h4>\n
sudo ufw app list<\/code><\/pre>\nNginx HTTP<\/code>: Yaln\u0131zca 80 portu (HTTP) \u00fczerinden gelen trafi\u011fe izin verir.
\n* Nginx HTTPS<\/code>: Yaln\u0131zca 443 portu (HTTPS) \u00fczerinden gelen trafi\u011fe izin verir.
\n* Nginx Full<\/code>: Hem 80 (HTTP) hem de 443 (HTTPS) portlar\u0131 \u00fczerinden gelen trafi\u011fe izin verir.<\/p>\nNginx Full<\/code> profilini etkinle\u015ftirmek en uygunudur. Ancak, Let’s Encrypt sertifikas\u0131n\u0131 al\u0131rken ge\u00e7ici olarak Nginx HTTP<\/code>‘ye ihtiyac\u0131m\u0131z olabilir veya sadece Nginx Full<\/code> a\u00e7\u0131p otomatik y\u00f6nlendirmeyi daha sonra yap\u0131land\u0131rabiliriz. \u015eimdilik Nginx Full<\/code>‘u a\u00e7al\u0131m:<\/p>\nsudo ufw allow 'Nginx Full'<\/code><\/pre>\nsudo ufw enable<\/code><\/pre>\ny<\/code> yaz\u0131p Enter tu\u015funa bas\u0131n. G\u00fcvenlik duvar\u0131n\u0131n durumunu kontrol etmek i\u00e7in:<\/p>\nsudo ufw status<\/code><\/pre>\nSSL\/TLS Sertifikas\u0131 Edinme<\/h3>\n
Let’s Encrypt ve Certbot Kurulumu<\/h4>\n
sudo apt install software-properties-common\nsudo add-apt-repository ppa:certbot\/certbot\nsudo apt update<\/code><\/pre>\nsudo apt install python-certbot-nginx<\/code><\/pre>\nNginx ile Sertifika Alma<\/h4>\n
sudo certbot --nginx -d ornekalanadi.com -d www.ornekalanadi.com<\/code><\/pre>\nornekalanadi.com<\/code> ve www.ornekalanadi.com<\/code> yerine kendi alan adlar\u0131n\u0131z\u0131 yazmal\u0131s\u0131n\u0131z.<\/p>\n
\n2. Hizmet \u015eartlar\u0131:<\/strong> Let’s Encrypt hizmet \u015fartlar\u0131n\u0131 kabul etmeniz istenecektir. A<\/code> tu\u015funa basarak kabul edin.
\n3. Payla\u015f\u0131m \u0130ste\u011fi:<\/strong> EFF (Electronic Frontier Foundation) ile e-posta adresinizi payla\u015fma iste\u011fi. Y<\/code> veya N<\/code> se\u00e7ene\u011fini tercih edebilirsiniz.
\n4. HTTP’den HTTPS’ye Y\u00f6nlendirme:<\/strong> Certbot, HTTP trafi\u011fini otomatik olarak HTTPS’ye y\u00f6nlendirip y\u00f6nlendirmeyece\u011finizi soracakt\u0131r. 2: Redirect<\/code> se\u00e7ene\u011fini se\u00e7meniz \u00f6nerilir. Bu, Nginx yap\u0131land\u0131rman\u0131za otomatik olarak bir y\u00f6nlendirme ekleyecektir.<\/p>\nSertifika Otomatik Yenilemesini Test Etme<\/h4>\n
sudo certbot renew --dry-run<\/code><\/pre>\nNginx Yap\u0131land\u0131rmas\u0131n\u0131 HTTP\/2 \u0130\u00e7in Haz\u0131rlama<\/h3>\n
Sunucu Blo\u011fu Dosyas\u0131n\u0131 D\u00fczenleme<\/h4>\n
\/etc\/nginx\/sites-available\/your_domain<\/code> ad\u0131nda bir yap\u0131land\u0131rma dosyas\u0131 olu\u015fturur. Bu dosyay\u0131 d\u00fczenleyelim:<\/p>\nsudo nano \/etc\/nginx\/sites-available\/ornekalanadi.com<\/code><\/pre>\nserver {\n listen 80;\n listen [::]:80;\n server_name ornekalanadi.com www.ornekalanadi.com;\n return 301 https:\/\/$host$request_uri; # Certbot taraf\u0131ndan eklenen y\u00f6nlendirme\n}\n\nserver {\n listen 443 ssl; # Buray\u0131 de\u011fi\u015ftirece\u011fiz\n listen [::]:443 ssl; # Buray\u0131 de\u011fi\u015ftirece\u011fiz\n server_name ornekalanadi.com www.ornekalanadi.com;\n\n ssl_certificate \/etc\/letsencrypt\/live\/ornekalanadi.com\/fullchain.pem;\n ssl_certificate_key \/etc\/letsencrypt\/live\/ornekalanadi.com\/privkey.pem;\n include \/etc\/letsencrypt\/options-ssl-nginx.conf; # Certbot taraf\u0131ndan eklenen ek ayarlar\n ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem; # Certbot taraf\u0131ndan eklenen DH parametreleri\n\n root \/var\/www\/html; # Web sitenizin k\u00f6k dizini\n index index.html index.htm index.nginx-debian.html;\n\n location \/ {\n try_files $uri $uri\/ =404;\n }\n}<\/code><\/pre>\nHTTP\/2 ve G\u00fcvenlik Ayarlar\u0131n\u0131 Ekleme<\/h4>\n
server<\/code> blo\u011funu HTTP\/2 deste\u011fi ve ek g\u00fcvenlik iyile\u015ftirmeleriyle g\u00fcncelleyelim. \u00d6zellikle listen<\/code> y\u00f6nergelerine http2<\/code> anahtar kelimesini eklememiz gerekiyor. Ayr\u0131ca modern SSL\/TLS protokollerini ve g\u00fcvenli \u015fifreleri belirleyece\u011fiz.<\/p>\nserver<\/code> blo\u011fu a\u015fa\u011f\u0131daki gibi g\u00f6r\u00fcnecektir:<\/p>\nserver {\n listen 80;\n listen [::]:80;\n server_name ornekalanadi.com www.ornekalanadi.com;\n return 301 https:\/\/$host$request_uri;\n}\n\nserver {\n # HTTP\/2 deste\u011fini etkinle\u015ftirmek i\u00e7in \"http2\" ekleyin\n listen 443 ssl http2;\n listen [::]:443 ssl http2;\n server_name ornekalanadi.com www.ornekalanadi.com;\n\n # SSL Sertifikas\u0131 Yollar\u0131 (Certbot taraf\u0131ndan otomatik olarak ayarlan\u0131r)\n ssl_certificate \/etc\/letsencrypt\/live\/ornekalanadi.com\/fullchain.pem;\n ssl_certificate_key \/etc\/letsencrypt\/live\/ornekalanadi.com\/privkey.pem;\n\n # Certbot taraf\u0131ndan sa\u011flanan SSL ayarlar\u0131n\u0131 dahil et (g\u00fcvenli protokoller, \u015fifreler vb.)\n include \/etc\/letsencrypt\/options-ssl-nginx.conf;\n ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem;\n\n # Ek SSL\/TLS G\u00fcvenlik ve Performans Ayarlar\u0131 (iste\u011fe ba\u011fl\u0131 ama \u00f6nerilir)\n # Ubuntu 16.04'teki Nginx s\u00fcr\u00fcm\u00fc (genellikle 1.10.x) TLSv1.3 deste\u011fine sahip olmayabilir.\n # Bu durumda TLSv1.3'\u00fc kald\u0131rman\u0131z gerekebilir.\n ssl_protocols TLSv1.2 TLSv1.3;\n ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';\n ssl_prefer_server_ciphers on;\n ssl_session_cache shared:SSL:10m;\n ssl_session_timeout 1h;\n ssl_session_tickets off; # G\u00fcvenlik i\u00e7in kapat\u0131lmas\u0131 \u00f6nerilir\n\n # HSTS (HTTP Strict Transport Security) ba\u015fl\u0131\u011f\u0131\n # Taray\u0131c\u0131lara sitenize her zaman HTTPS \u00fczerinden eri\u015fmelerini s\u00f6yler\n add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\" always;\n\n # Ek G\u00fcvenlik Ba\u015fl\u0131klar\u0131 (iste\u011fe ba\u011fl\u0131)\n add_header X-Frame-Options \"SAMEORIGIN\";\n add_header X-Content-Type-Options \"nosniff\";\n add_header X-XSS-Protection \"1; mode=block\";\n add_header Referrer-Policy \"no-referrer-when-downgrade\";\n\n # Web sitenizin k\u00f6k dizini ve varsay\u0131lan dosyalar\n root \/var\/www\/html;\n index index.html index.htm index.nginx-debian.html;\n\n location \/ {\n try_files $uri $uri\/ =404;\n }\n}<\/code><\/pre>\nssl_protocols TLSv1.2 TLSv1.3;<\/code> sat\u0131r\u0131 Nginx’i ba\u015flat\u0131rken hataya neden olursa, TLSv1.3<\/code> k\u0131sm\u0131n\u0131 kald\u0131rman\u0131z ve sadece ssl_protocols TLSv1.2;<\/code> olarak b\u0131rakman\u0131z gerekebilir. Nginx’in daha yeni s\u00fcr\u00fcmleri TLSv1.3 deste\u011fi sunar, ancak 16.04’teki varsay\u0131lan s\u00fcr\u00fcm i\u00e7in bu bir s\u0131n\u0131rlama olabilir.<\/p>\ninclude \/etc\/letsencrypt\/options-ssl-nginx.conf;<\/code> dosyas\u0131 zaten g\u00fcvenli SSL ayarlar\u0131 i\u00e7erir, ancak yukar\u0131daki gibi ek y\u00f6nergelerle bu ayarlar\u0131 daha da \u00f6zelle\u015ftirebilirsiniz. ssl_dhparam<\/code> dosyas\u0131, Certbot taraf\u0131ndan Diffie-Hellman parametreleri i\u00e7in olu\u015fturulur ve ileriye d\u00f6n\u00fck gizlili\u011fi (Perfect Forward Secrecy) sa\u011flar.<\/p>\nCTRL+X<\/code>, ard\u0131ndan Y<\/code> ve Enter<\/code> tu\u015flar\u0131na bas\u0131n.<\/p>\nNginx Yap\u0131land\u0131rmas\u0131n\u0131 Etkinle\u015ftirme ve Test Etme<\/h3>\n
Yap\u0131land\u0131rmay\u0131 Test Etme<\/h4>\n
sudo nginx -t<\/code><\/pre>\nsyntax is ok<\/code> ve test is successful<\/code> mesajlar\u0131n\u0131 g\u00f6rmelisiniz. Herhangi bir hata durumunda, belirtilen sat\u0131r numaras\u0131n\u0131 kontrol ederek hatay\u0131 d\u00fczeltmeniz gerekir.<\/p>\nNginx’i Yeniden Ba\u015flatma<\/h4>\n
sudo systemctl reload nginx<\/code><\/pre>\nsudo systemctl restart nginx<\/code><\/pre>\nreload<\/code> komutu, Nginx’i kesintisiz hizmet vermeye devam ederken yap\u0131land\u0131rmay\u0131 yeniden y\u00fckler. restart<\/code> komutu ise Nginx’i tamamen durdurup yeniden ba\u015flat\u0131r, bu da k\u0131sa bir kesintiye neden olabilir. Genellikle reload<\/code> yeterlidir.<\/p>\nHTTP\/2 Deste\u011fini Do\u011frulama<\/h3>\n
Taray\u0131c\u0131 Geli\u015ftirici Ara\u00e7lar\u0131 ile Kontrol<\/h4>\n
h2<\/code> (HTTP\/2) ifadesini g\u00f6rmelisiniz. E\u011fer http\/1.1<\/code> g\u00f6r\u00fcyorsan\u0131z, yap\u0131land\u0131rman\u0131zda bir sorun olabilir.<\/p>\nOnline Ara\u00e7lar ile Kontrol<\/h4>\n
https:\/\/tools.keycdn.com\/http2-test<\/code> adresine giderek alan ad\u0131n\u0131z\u0131 girin.
\n* SSL Labs SSL Server Test:<\/strong> https:\/\/www.ssllabs.com\/ssltest\/<\/code> adresine giderek alan ad\u0131n\u0131z\u0131 girin. Bu ara\u00e7, SSL\/TLS yap\u0131land\u0131rman\u0131z\u0131n g\u00fcvenli\u011fini derinlemesine analiz eder ve bir derecelendirme (A+, A, B vb.) verir.<\/p>\nCurl Komutu ile Kontrol<\/h4>\n
curl<\/code> komutunu kullanarak da HTTP\/2 deste\u011fini kontrol edebilirsiniz:<\/p>\ncurl -I --http2 -s https:\/\/ornekalanadi.com<\/code><\/pre>\nHTTP\/2 200\nserver: nginx\/1.10.3 (Ubuntu)\ndate: ...\ncontent-type: text\/html\n...<\/code><\/pre>\nHTTP\/2<\/code> yerine HTTP\/1.1<\/code> g\u00f6r\u00fcyorsan\u0131z veya --http2<\/code> se\u00e7ene\u011fi hata veriyorsa, curl<\/code> s\u00fcr\u00fcm\u00fcn\u00fcz\u00fcn HTTP\/2 deste\u011fi olmayabilir veya Nginx yap\u0131land\u0131rman\u0131zda bir sorun olabilir.<\/p>\nEk G\u00fcvenlik ve Performans \u0130yile\u015ftirmeleri<\/h3>\n
Nginx Optimizasyonlar\u0131<\/h4>\n
\/etc\/nginx\/nginx.conf<\/code> \u00fczerinde baz\u0131 genel performans ayarlar\u0131 yap\u0131labilir.<\/p>\nsudo nano \/etc\/nginx\/nginx.conf<\/code><\/pre>\nhttp<\/code> blo\u011funun i\u00e7ine veya d\u0131\u015f\u0131na a\u015fa\u011f\u0131daki y\u00f6nergeleri ekleyebilir veya d\u00fczenleyebilirsiniz:<\/p>\nworker_processes<\/code>:<\/strong> Nginx’in \u00e7al\u0131\u015ft\u0131raca\u011f\u0131 worker process say\u0131s\u0131n\u0131 belirler. Genellikle sunucunuzdaki CPU \u00e7ekirde\u011fi say\u0131s\u0131na e\u015fit veya bu say\u0131n\u0131n iki kat\u0131 olarak ayarlan\u0131r. auto<\/code> olarak ayarlamak da bir se\u00e7enektir.<\/p>\nworker_processes auto;<\/code><\/pre>\nworker_connections<\/code>:<\/strong> Her bir worker process’in ayn\u0131 anda i\u015fleyebilece\u011fi maksimum ba\u011flant\u0131 say\u0131s\u0131n\u0131 belirler. Y\u00fcksek trafikli siteler i\u00e7in bu de\u011feri art\u0131rmak gerekebilir.<\/p>\nevents {\n worker_connections 1024; # Varsay\u0131lan olarak 768 olabilir\n }<\/code><\/pre>\nkeepalive_timeout<\/code>:<\/strong> \u0130stemci ba\u011flant\u0131s\u0131n\u0131n ne kadar s\u00fcre a\u00e7\u0131k kalaca\u011f\u0131n\u0131 belirler. HTTP\/2 ile bu de\u011ferin \u00f6nemi azal\u0131r, ancak HTTP\/1.1 istemcileri i\u00e7in hala faydal\u0131d\u0131r.<\/p>\nkeepalive_timeout 65;<\/code><\/pre>\nsendfile on;<\/code> ve tcp_nopush on;<\/code>:<\/strong> Dosya transferini optimize eder.<\/p>\nsendfile on;\n tcp_nopush on;<\/code><\/pre>\ngzip on;<\/code>:<\/strong> \u0130\u00e7erik s\u0131k\u0131\u015ft\u0131rmas\u0131n\u0131 etkinle\u015ftirir. HTTP\/2 ba\u015fl\u0131k s\u0131k\u0131\u015ft\u0131rmas\u0131 sunsa da, i\u00e7erik s\u0131k\u0131\u015ft\u0131rmas\u0131 (gzip) hala faydal\u0131d\u0131r.<\/p>\ngzip on;\n gzip_vary on;\n gzip_proxied any;\n gzip_comp_level 6;\n gzip_buffers 16 8k;\n gzip_http_version 1.1;\n gzip_types text\/plain text\/css application\/json application\/javascript text\/xml application\/xml application\/xml+rss text\/javascript;<\/code><\/pre>\nsudo nginx -t<\/code> ile kontrol edip sudo systemctl reload nginx<\/code> ile Nginx’i yeniden ba\u015flatmay\u0131 unutmay\u0131n.<\/p>\nG\u00fcvenlik Ba\u015fl\u0131klar\u0131<\/h4>\n
Strict-Transport-Security<\/code> d\u0131\u015f\u0131ndaki baz\u0131 g\u00fcvenlik ba\u015fl\u0131klar\u0131 da sitenizin g\u00fcvenli\u011fini art\u0131rabilir. Bunlar\u0131 server<\/code> blo\u011funuza ekleyebilirsiniz:<\/p>\nX-Frame-Options<\/code>:<\/strong> Sitenizin ba\u015fka bir sitede iframe i\u00e7inde g\u00f6sterilip g\u00f6sterilemeyece\u011fini kontrol eder. SAMEORIGIN<\/code> veya DENY<\/code> en g\u00fcvenli se\u00e7eneklerdir.<\/p>\nadd_header X-Frame-Options \"SAMEORIGIN\";<\/code><\/pre>\nX-Content-Type-Options<\/code>:<\/strong> Taray\u0131c\u0131lar\u0131n MIME t\u00fcr\u00fc koklamas\u0131n\u0131 (sniffing) \u00f6nler.<\/p>\nadd_header X-Content-Type-Options \"nosniff\";<\/code><\/pre>\nX-XSS-Protection<\/code>:<\/strong> Taray\u0131c\u0131lar\u0131n XSS (Cross-Site Scripting) sald\u0131r\u0131lar\u0131n\u0131 tespit etmesi ve engellemesi i\u00e7in bir mekanizma sa\u011flar.<\/p>\nadd_header X-XSS-Protection \"1; mode=block\";<\/code><\/pre>\nReferrer-Policy<\/code>:<\/strong> Referans bilgilerinin nas\u0131l g\u00f6nderilece\u011fini kontrol eder.<\/p>\nadd_header Referrer-Policy \"no-referrer-when-downgrade\";<\/code><\/pre>\nContent-Security-Policy<\/code> (CSP):<\/strong> XSS ve veri enjeksiyonu sald\u0131r\u0131lar\u0131n\u0131 hafifletmek i\u00e7in g\u00fc\u00e7l\u00fc bir g\u00fcvenlik politikas\u0131d\u0131r. Ancak do\u011fru yap\u0131land\u0131rmak karma\u015f\u0131k olabilir ve dikkatli olunmazsa sitenizi bozabilir. Ba\u015flang\u0131\u00e7ta eklenmesi iste\u011fe ba\u011fl\u0131d\u0131r ve kapsaml\u0131 bir test gerektirir.<\/p>\n# add_header Content-Security-Policy \"default-src 'self'; script-src 'self' https:\/\/trusted.cdn.com; style-src 'self' 'unsafe-inline';\" always;<\/code><\/pre>\nS\u0131k\u00e7a Sorulan Sorular ve Sorun Giderme<\/h3>\n
Nginx Ba\u015flat\u0131lam\u0131yor veya Yeniden Y\u00fcklenemiyor<\/h4>\n
systemctl reload nginx<\/code> veya systemctl restart nginx<\/code> komutlar\u0131 hata veriyor.
\n* \u00c7\u00f6z\u00fcm:<\/strong> Nginx yap\u0131land\u0131rma dosyas\u0131nda bir hata olmas\u0131 muhtemeldir. sudo nginx -t<\/code> komutunu \u00e7al\u0131\u015ft\u0131rarak hatan\u0131n nerede oldu\u011funu kontrol edin. \u00c7\u0131kt\u0131daki hata mesaj\u0131 ve sat\u0131r numaras\u0131 size yard\u0131mc\u0131 olacakt\u0131r. Genellikle noktal\u0131 virg\u00fcl eksikli\u011fi, yanl\u0131\u015f y\u00f6nerge veya dosya yolu hatalar\u0131 bu t\u00fcr sorunlara neden olur.<\/p>\nSertifika Hatas\u0131 veya Ge\u00e7ersiz Sertifika Uyar\u0131s\u0131<\/h4>\n
\n* \u00c7\u00f6z\u00fcm:<\/strong>
\n * Sertifika yollar\u0131n\u0131n Nginx yap\u0131land\u0131rman\u0131zda do\u011fru oldu\u011fundan emin olun (ssl_certificate<\/code> ve ssl_certificate_key<\/code>).
\n * Certbot’un sertifikay\u0131 ba\u015far\u0131yla ald\u0131\u011f\u0131ndan emin olun. \/etc\/letsencrypt\/live\/your_domain\/<\/code> dizinindeki dosyalar\u0131n varl\u0131\u011f\u0131n\u0131 kontrol edin.
\n * DNS kay\u0131tlar\u0131n\u0131z\u0131n do\u011fru oldu\u011fundan ve alan ad\u0131n\u0131z\u0131n sunucunuzun IP adresine i\u015faret etti\u011finden emin olun. Certbot, sertifika al\u0131rken alan ad\u0131n\u0131z\u0131n \u00e7\u00f6z\u00fcmlenebilir olmas\u0131n\u0131 gerektirir.
\n * G\u00fcvenlik duvar\u0131n\u0131z\u0131n 443 portuna (HTTPS) izin verdi\u011finden emin olun (sudo ufw status<\/code>).<\/p>\nHTTP\/2 \u00c7al\u0131\u015fm\u0131yor (Taray\u0131c\u0131da h2 yerine http\/1.1 g\u00f6r\u00fcn\u00fcyor)<\/h4>\n
curl<\/code> hala HTTP\/1.1 g\u00f6steriyor.
\n* \u00c7\u00f6z\u00fcm:<\/strong>
\n * Nginx yap\u0131land\u0131rman\u0131zdaki listen 443 ssl http2;<\/code> y\u00f6nergesini dikkatlice kontrol edin. http2<\/code> anahtar kelimesinin eksiksiz ve do\u011fru oldu\u011fundan emin olun.
\n * Nginx’i yeniden ba\u015flatt\u0131\u011f\u0131n\u0131zdan emin olun (sudo systemctl reload nginx<\/code>).
\n * Taray\u0131c\u0131n\u0131z\u0131n \u00f6nbelle\u011fini temizleyin veya gizli pencerede deneyin.
\n * SSL\/TLS sertifikan\u0131z\u0131n ge\u00e7erli ve do\u011fru \u015fekilde y\u00fckl\u00fc oldu\u011fundan emin olun. HTTP\/2, SSL\/TLS olmadan modern taray\u0131c\u0131larda \u00e7al\u0131\u015fmaz.
\n * Ubuntu 16.04’te kulland\u0131\u011f\u0131n\u0131z Nginx s\u00fcr\u00fcm\u00fcn\u00fcn HTTP\/2’yi destekledi\u011finden emin olun (Nginx 1.9.5 ve \u00fczeri). Varsay\u0131lan 1.10.x s\u00fcr\u00fcm\u00fc destekler.<\/p>\nssl_protocols TLSv1.2 TLSv1.3;<\/code> Hatas\u0131<\/h4>\nunknown protocol \"TLSv1.3\"<\/code> gibi bir hata al\u0131yorsunuz.
\n* \u00c7\u00f6z\u00fcm:<\/strong> Ubuntu 16.04’\u00fcn varsay\u0131lan Nginx s\u00fcr\u00fcm\u00fc (genellikle 1.10.x), TLSv1.3 deste\u011fine sahip olmayabilir. Bu durumda, ssl_protocols<\/code> y\u00f6nergesini ssl_protocols TLSv1.2;<\/code> olarak de\u011fi\u015ftirmeniz veya sadece include \/etc\/letsencrypt\/options-ssl-nginx.conf;<\/code> sat\u0131r\u0131n\u0131 kullanman\u0131z yeterli olacakt\u0131r, \u00e7\u00fcnk\u00fc bu dosya genellikle uyumlu ve g\u00fcvenli protokolleri zaten i\u00e7erir.<\/p>\nSonu\u00e7<\/h3>\n