diff options
Diffstat (limited to 'doc/install')
| -rw-r--r-- | doc/install/sample-lighttpd.conf | 85 | ||||
| -rw-r--r-- | doc/install/sample-nginx.conf | 137 |
2 files changed, 222 insertions, 0 deletions
diff --git a/doc/install/sample-lighttpd.conf b/doc/install/sample-lighttpd.conf new file mode 100644 index 000000000..721fa25ea --- /dev/null +++ b/doc/install/sample-lighttpd.conf @@ -0,0 +1,85 @@ +# See http://redmine.lighttpd.net/projects/lighttpd/wiki/Docs:ConfigurationOptions + +### LOAD MODULES +server.modules = ( + "mod_access", + "mod_accesslog", + "mod_fastcgi", + "mod_redirect", + "mod_rewrite" +) + +### BASIC STUFF +server.port = 80 + +server.username = "http" + +server.groupname = "http" + +server.document-root = "/path/to/your/www/files" #adjust to your setup + +server.errorlog = "/var/log/lighttpd/error.log" + +accesslog.filename = "/var/log/lighttpd/access.log" + +### DISABLE DIR LISTING +dir-listing.activate = "disable" + +### DISABLE REJECT EXPECT HEADER +### (needed for curl POST requests - otherwise they fail with error 417) +server.reject-expect-100-with-417 = "disable" + +### DEFINE SUPPORTED INDEX FILENAMES +index-file.names = ( + "index.html", + "index.htm", + "index.php" +) + +### DEFINE SUPPORTED MIME TYPES +mimetype.assign = ( + ".html" => "text/html", + ".htm" => "text/html", + ".css" => "text/css", + ".txt" => "text/plain", + ".svg" => "image/svg+xml", + ".jpg" => "image/jpeg", + ".png" => "image/png" +) + +### DONT EVER SERVE FILES WITH EXTENSION +static-file.exclude-extensions = ( ".php" ) + +### PHP WITH PHP-FPM +### (needs php-fpm installed and running) +fastcgi.server = ( + ".php" => ( + "localhost" => ( + "socket" => "/run/php-fpm/php-fpm.sock", + "broken-scriptfilename" => "enable", + "allow-x-sendfile" => "enable" + ) + ) +) + +### ENABLE SSL +$SERVER["socket"] == ":443" { + ssl.engine = "enable" + ssl.ca-file = "/etc/lighttpd/certs/ca-certs.crt" #adjust to your needs + ssl.pemfile = "/etc/lighttpd/certs/red-ssl.crt" #adjust to your needs +} + +### RISTRICT ACCESS TO DIRECTORYS AND FILES +$HTTP["url"] =~ "\.(out|log|htaccess)$" { + url.access-deny = ("") +} + +$HTTP["url"] =~ "(^|/)\.git|(^|/)store" { + url.access-deny = ("") +} + +### URL REWRITE RULES +url.rewrite-if-not-file = ( + "^\/([^\?]*)\?(.*)$" => "/index.php?q=$1&$2", + "^\/(.*)$" => "/index.php?q=$1" +) diff --git a/doc/install/sample-nginx.conf b/doc/install/sample-nginx.conf new file mode 100644 index 000000000..ade323a4f --- /dev/null +++ b/doc/install/sample-nginx.conf @@ -0,0 +1,137 @@ +## +# Red Nginx configuration +# by Olaf Conradi +# +# On Debian based distributions you can add this file to +# /etc/nginx/sites-available +# +# Then customize to your needs. To enable the configuration +# symlink it to /etc/nginx/sites-enabled and reload Nginx using +# +# service nginx reload +## + +## +# You should look at the following URL's in order to grasp a solid understanding +# of Nginx configuration files in order to fully unleash the power of Nginx. +# +# http://wiki.nginx.org/Pitfalls +# http://wiki.nginx.org/QuickStart +# http://wiki.nginx.org/Configuration +## + +## +# This configuration assumes your domain is example.net +# You have a separate subdomain red.example.net +# You want all red traffic to be https +# You have an SSL certificate and key for your subdomain +# You have PHP FastCGI Process Manager (php5-fpm) running on localhost +# You have Red installed in /var/www/red +## + +server { + listen 80; + server_name red.example.net; + + index index.php; + root /var/www/red; + rewrite ^ https://red.example.net$request_uri? permanent; +} + +## +# Configure Red with SSL +# +# All requests are routed to the front controller +# except for certain known file types like images, css, etc. +# Those are served statically whenever possible with a +# fall back to the front controller (needed for avatars, for example) +## + +server { + listen 443 ssl; + server_name red.example.net; + + ssl on; + ssl_certificate /etc/nginx/ssl/red.example.net.chain.pem; + ssl_certificate_key /etc/nginx/ssl/example.net.key; + ssl_session_timeout 5m; + ssl_protocols SSLv3 TLSv1; + ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP; + ssl_prefer_server_ciphers on; + + fastcgi_param HTTPS on; + + index index.php; + charset utf-8; + root /var/www/red; + access_log /var/log/nginx/red.log; + #Uncomment the following line to include a standard configuration file + #include standard.conf + # allow uploads up to 20MB in size + client_max_body_size 20m; + client_body_buffer_size 128k; + + # rewrite to front controller as default rule + location / { + rewrite ^/(.*) /index.php?q=$uri&$args last; + } + + # make sure webfinger and other well known services aren't blocked + # by denying dot files and rewrite request to the front controller + location ^~ /.well-known/ { + allow all; + rewrite ^/(.*) /index.php?q=$uri&$args last; + } + + # statically serve these file types when possible + # otherwise fall back to front controller + # allow browser to cache them + # added .htm for advanced source code editor library + location ~* \.(jpg|jpeg|gif|png|ico|css|js|htm|html|ttf|woff|svg)$ { + expires 30d; + try_files $uri /index.php?q=$uri&$args; + } + + # block these file types + location ~* \.(tpl|md|tgz|log|out)$ { + deny all; + } + + # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 + # or a unix socket + location ~* \.php$ { + # Zero-day exploit defense. + # http://forum.nginx.org/read.php?2,88845,page=3 + # Won't work properly (404 error) if the file is not stored on this + # server, which is entirely possible with php-fpm/php-fcgi. + # Comment the 'try_files' line out if you set up php-fpm/php-fcgi on + # another machine. And then cross your fingers that you won't get hacked. + try_files $uri =404; + + # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini + fastcgi_split_path_info ^(.+\.php)(/.+)$; + + # With php5-cgi alone: + # fastcgi_pass 127.0.0.1:9000; + + # With php5-fpm: + fastcgi_pass unix:/var/run/php5-fpm.sock; + + include fastcgi_params; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + } + + # deny access to all dot files + location ~ /\. { + deny all; + } + +#deny access to store + + location ~ /store { + deny all; + } + + +} |