From b38b62f759547a36cc6dc3ce8dc002ad7efc2032 Mon Sep 17 00:00:00 2001 From: Olaf Conradi Date: Sat, 15 Dec 2012 16:01:20 +0100 Subject: [PATCH 1/3] Modify nginx sample to a real config file --- mods/sample-nginx.config | 63 ++++++++++++++++++++++------------------ 1 file changed, 34 insertions(+), 29 deletions(-) diff --git a/mods/sample-nginx.config b/mods/sample-nginx.config index 37ad5ed269..811be404dd 100644 --- a/mods/sample-nginx.config +++ b/mods/sample-nginx.config @@ -1,19 +1,31 @@ -From: Olaf Conradi -Hey @Friendica Support, +## +# Friendica Nginx configuration +# by Olaf Conradi +# +# On debian based distributions you can add this file to +# /etc/nginx/sites-available +# +# Then customize to your needs. To enable the configuration +# symlink it to /etc/nginx/sites-enabled and reload Nginx +# using /etc/init.d/nginx reload +## -Just wanted to share my #nginx configuration for #friendica with you guys. +## +# You should look at the following URL's in order to grasp a solid understanding +# of Nginx configuration files in order to fully unleash the power of Nginx. +# +# http://wiki.nginx.org/Pitfalls +# http://wiki.nginx.org/QuickStart +# http://wiki.nginx.org/Configuration +## -I noticed most of the existing configurations that are floating on the web for #nginx do not deny access to local files. Most of them use the following construct. - -location / { - try_files $uri $uri/ index.php?q=$request_uri -} - -This serves files like images statically, but also gives everyone access to the source code of your ~friendica ~friendica installation (tpl templates, sql files, etc). One should deny all locations except for images, javascript and css files. Setting these deny rules is tedious and needs maintenance when new directories are added. - -It's easier to route everything through the front controller except those known file types. - -Below is my configuration. First I forward non-SSL traffic to SSL. +## +# This configuration assumes your domain is example.net +# You have a seperate subdomain friendica.example.net +# You want all friendica traffic to be https +# You have an SSL certificate and key for your subdomain +# You have PHP FastCGI Process Manager (php5-fpm) running on localhost +## server { server_name friendica.example.net; @@ -22,7 +34,14 @@ server { rewrite ^ https://friendica.example.net$request_uri? permanent; } -Next is the SSL server part. +## +# Configure Friendica with SSL +# +# All requests are routed to the front controller +# except for certain known file types like images, css, etc. +# Those are served statically whenever possible with a +# fall back to the front controller (needed for avatars, for example) +## server { listen 443 ssl; @@ -88,17 +107,3 @@ server { } } -That's it. -#nginx #friendica @Friendica Support - - -I found one bug after posting when I noticed 404's coming in for certain image files. Avatars need a fallback to go through the front controller. -# statically serve these file types when possible -# otherwise fall back to front controller -# allow browser to cache them -# added .htm for advanced source code editor library -location ~* \.(jpg|jpeg|gif|png|css|js|ico|htm)$ { -expires 30d; -try_files $uri /index.php?q=$request_uri?; -} - From 30b5e08eb6594a8e4cc0300d875ee46fbd004f67 Mon Sep 17 00:00:00 2001 From: Olaf Conradi Date: Sat, 15 Dec 2012 16:21:50 +0100 Subject: [PATCH 2/3] Fix rewrite rules to pass arguments Fix location regex for extensions to end with $ Add more comments --- mods/sample-nginx.config | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/mods/sample-nginx.config b/mods/sample-nginx.config index 811be404dd..2383b6a447 100644 --- a/mods/sample-nginx.config +++ b/mods/sample-nginx.config @@ -25,6 +25,7 @@ # You want all friendica traffic to be https # You have an SSL certificate and key for your subdomain # You have PHP FastCGI Process Manager (php5-fpm) running on localhost +# You have Friendica installed in /mnt/friendica/www ## server { @@ -64,44 +65,45 @@ server { # rewrite to front controller as default rule location / { - rewrite ^/(.*) /index.php?q=$1 last; + rewrite ^/(.*) /index.php?q=$uri&$args last; } - # make sure webfinger isn't blocked by denying dot files - # and rewrite to front controller - location = /.well-known/host-meta { + # make sure webfinger and other well known services aren't blocked + # by denying dot files and rewrite request to the front controller + location ^~ /.well-known/ { allow all; - rewrite ^/(.*) /index.php?q=$1 last; + rewrite ^/(.*) /index.php?q=$uri&$args last; } # statically serve these file types when possible # otherwise fall back to front controller # allow browser to cache them # added .htm for advanced source code editor library - location ~* \.(jpg|jpeg|gif|png|css|js|ico|htm|html)$ { + location ~* \.(jpg|jpeg|gif|png|css|js|htm|html)$ { expires 30d; try_files $uri /index.php?q=$uri&$args; } - # block these file types - location ~* \.(tpl|md|git|tgz|log|out) { + location ~* \.(tpl|md|tgz|log|out)$ { deny all; } # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 location ~* \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; - # # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini - # # With php5-cgi alone: + # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini + + # With php5-cgi alone: # fastcgi_pass 127.0.0.1:9000; + # With php5-fpm: fastcgi_pass unix:/var/run/php5-fpm.sock; fastcgi_index index.php; include fastcgi_params; } - # deny access to all dot files (including .htaccess) + # deny access to all dot files location ~ /\. { deny all; } From c4900745899283f59b11e502026dcd9c95f21cc3 Mon Sep 17 00:00:00 2001 From: Olaf Conradi Date: Sat, 15 Dec 2012 16:43:24 +0100 Subject: [PATCH 3/3] Typos --- mods/sample-nginx.config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mods/sample-nginx.config b/mods/sample-nginx.config index 2383b6a447..0fb31efffc 100644 --- a/mods/sample-nginx.config +++ b/mods/sample-nginx.config @@ -2,7 +2,7 @@ # Friendica Nginx configuration # by Olaf Conradi # -# On debian based distributions you can add this file to +# On Debian based distributions you can add this file to # /etc/nginx/sites-available # # Then customize to your needs. To enable the configuration @@ -21,7 +21,7 @@ ## # This configuration assumes your domain is example.net -# You have a seperate subdomain friendica.example.net +# You have a separate subdomain friendica.example.net # You want all friendica traffic to be https # You have an SSL certificate and key for your subdomain # You have PHP FastCGI Process Manager (php5-fpm) running on localhost