diff options
| -rw-r--r-- | doc/install/sample-nginx.conf | 131 |
1 files changed, 108 insertions, 23 deletions
diff --git a/doc/install/sample-nginx.conf b/doc/install/sample-nginx.conf index 3f33044fb..718524ee3 100644 --- a/doc/install/sample-nginx.conf +++ b/doc/install/sample-nginx.conf @@ -1,29 +1,114 @@ -# A sample configuration for The Red Matrix on Nginx. One should also take care to block access to dot files, etc, in their standard.conf. +## +# Red Nginx configuration +# by Olaf Conradi +# +# On Debian based distributions you can add this file to +# /etc/nginx/sites-available +# +# Then customize to your needs. To enable the configuration +# symlink it to /etc/nginx/sites-enabled and reload Nginx +# using /etc/init.d/nginx reload +## +## +# You should look at the following URL's in order to grasp a solid understanding +# of Nginx configuration files in order to fully unleash the power of Nginx. +# +# http://wiki.nginx.org/Pitfalls +# http://wiki.nginx.org/QuickStart +# http://wiki.nginx.org/Configuration +## + +## +# This configuration assumes your domain is example.net +# You have a separate subdomain red.example.net +# You want all red traffic to be https +# You have an SSL certificate and key for your subdomain +# You have PHP FastCGI Process Manager (php5-fpm) running on localhost +# You have Red installed in /var/www/red +## server { -listen 80; -listen 443 ssl; -server_name example.com; -ssl_certificate /path/to/ssl.crt; -ssl_certificate_key /path/to/ssl.key; - -root /var/www/example.com; - index index.php; - access_log /var/log/nginx/example.com.log; - include standard.conf; - location ~ \.php$ { + server_name red.example.net; + index index.php; + root /var/www/red; + rewrite ^ https://red.example.net$request_uri? permanent; +} + +## +# Configure Red with SSL +# +# All requests are routed to the front controller +# except for certain known file types like images, css, etc. +# Those are served statically whenever possible with a +# fall back to the front controller (needed for avatars, for example) +## + +server { + listen 80; + listen 443 ssl; + ssl on; + server_name red.example.net; + ssl_certificate /etc/nginx/ssl/red.example.net.chain.pem; + ssl_certificate_key /etc/nginx/ssl/example.net.key; + ssl_session_timeout 5m; + ssl_protocols SSLv3 TLSv1; + ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP; + ssl_prefer_server_ciphers on; + + + index index.php; + charset utf-8; + root /var/www/red; + access_log /var/log/nginx/red.log main; + #Uncomment the following line to include a standard configuration file + #include standard.conf + # allow uploads up to 20MB in size + client_max_body_size 20m; + client_body_buffer_size 128k; + + # rewrite to front controller as default rule + location / { + rewrite ^/(.*) /index.php?q=$uri&$args last; + } + + # make sure webfinger and other well known services aren't blocked + # by denying dot files and rewrite request to the front controller + location ^~ /.well-known/ { + allow all; + rewrite ^/(.*) /index.php?q=$uri&$args last; + } + + # statically serve these file types when possible + # otherwise fall back to front controller + # allow browser to cache them + # added .htm for advanced source code editor library + location ~* \.(jpg|jpeg|gif|png|ico|css|js|htm|html|ttf|svg)$ { + expires 30d; + try_files $uri /index.php?q=$uri&$args; + } + + # block these file types + location ~* \.(tpl|md|tgz|log|out)$ { + deny all; + } + + # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 + location ~* \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; + # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini + + # With php5-cgi alone: + # fastcgi_pass 127.0.0.1:9000; + + # With php5-fpm: + fastcgi_pass unix:/var/run/php5-fpm.sock; + fastcgi_index index.php; include fastcgi_params; - fastcgi_intercept_errors on; - fastcgi_pass php; - fastcgi_read_timeout 300; - } - if (!-e $request_filename){ - rewrite ^(.*)$ /index.php?q=$1 last; - } - location / { - try_files $uri $uri/ /index.php; - } -} + } + # deny access to all dot files + location ~ /\. { + deny all; + } +} |