I have Wordpress running on nginx which also runs gunicorn (to run django). Wordpress should be accessed on the subfolder www.mySite.de/blog/. The main page on this URL can be accessed, but when I open a link to a page (e.g. a page on www.mySite.de/blog/testpage ) then I get 404 errors.
My nginx configuration is as follows:
nginx.conf
#user nobody;
user nginx nginx;
worker_processes 4;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log debug;
#error_log logs/error.log notice;
#error_log logs/error.log info;
events {
worker_connections 1024;
accept_mutex on; # "on" if nginx worker_processes > 1
# use epoll; # enable for Linux 2.6+
# use kqueue; # enable for FreeBSD, OSX
}
http {
include mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log;
sendfile on;
tcp_nopush on;
tcp_nodelay off;
#keepalive_timeout 0;
keepalive_timeout 65;
types_hash_max_size 2048;
# Gzip Settings
gzip on;
gzip_http_version 1.0;
gzip_proxied any;
gzip_min_length 500;
gzip_disable "MSIE [1-6]\.";
gzip_types text/plain text/xml text/css
text/comma-separated-values
text/javascript application/x-javascript
application/atom+xml;
# Virtual Host Configs
include /etc/nginx/sites-enabled/*;
}
production.conf (imported from 'sites-enabled' folder)
upstream production_nginx {# fail_timeout=0 means we always retry an upstream even if it failed
# to return a good HTTP response (in case the Unicorn master nukes a
# single worker for timing out).
# for UNIX domain socket setups:
server unix:/home/mySite/production/run/gunicorn.sock fail_timeout=0;
}
upstream production_php {
server unix:/var/run/php5-fpm.sock;
}
server {
listen 80;
server_name mySite.de
www.mySite.de;
return 301 https://www.mySite.de$request_uri;
}
server {
listen 443;
server_name mySite.de;
return 301 https://www.mySite.de$request_uri;
}
server {
listen 443 ssl default_server;
client_max_body_size 4G;
server_name www.mySite.de;
ssl_certificate /etc/ssl/certs/www.mySite.de.crt;
ssl_certificate_key /etc/ssl/private/www.mySite.de.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
# ~2 seconds is often enough for most folks to parse HTML/CSS and
# retrieve needed images/icons/frames, connections are cheap in
# nginx so increasing this is generally safe...
keepalive_timeout 5;
access_log /var/log/nginx/production-access.log;
error_log /var/log/nginx/production-error.log;
location /static/ {
alias /home/mySite/production/htdocs/static/;
}
location /media/ {
alias /home/mySite/production/htdocs/media/;
}
location /blog/ {
alias /home/mySite/production/htdocs/blog/;
index index.php index.html index.htm;
# This is cool because no php is touched for static content.
# include the "?$args" part so non-default permalinks doesn't break when using query string
try_files $uri $uri/ /blog/index.php?q=$uri;
location ~ \.php$ {
#NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
fastcgi_split_path_info ^(/blog)(/.*)$;
fastcgi_intercept_errors on;
fastcgi_pass production_php;
fastcgi_index index.php;
include fastcgi.conf;
}
}
location /favicon.ico {
alias /home/mySite/production/htdocs/static/favicon.ico;
log_not_found off;
access_log off;
}
# path for static files
root /home/mySite/production/htdocs/;
location / {
# an HTTP header important enough to have its own Wikipedia entry:
# http://en.wikipedia.org/wiki/X-Forwarded-For
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# enable this if and only if you use HTTPS, this helps Rack
# set the proper protocol for doing redirects:
proxy_set_header X-Forwarded-Proto https;
# pass the Host: header from the client right along so redirects
# can be set properly within the Rack application
proxy_set_header Host $http_host;
# we don't want nginx trying to do something clever with
# redirects, we set the Host: header above already.
proxy_redirect off;
# set "proxy_buffering off" *only* for Rainbows! when doing
# Comet/long-poll stuff. It's also safe to set if you're
# using only serving fast clients with Unicorn + nginx.
# Otherwise you _want_ nginx to buffer responses to slow
# clients, really.
# proxy_buffering off;
# Try to serve static files from nginx, no point in making an
# *application* server like Unicorn/Rainbows! serve static files.
if (!-f $request_filename) {
proxy_pass http://production_nginx;
break;
}
}
# Error pages
error_page 500 502 503 504 /500.html;
location = /500.html {
root /home/mySite/production/htdocs;
}
pagespeed on;
pagespeed EnableFilters convert_meta_tags;
pagespeed EnableFilters collapse_whitespace; # Remove whitespace
pagespeed EnableFilters combine_javascript; # Merge JS files
pagespeed EnableFilters rewrite_javascript; # Minimize JS
pagespeed EnableFilters defer_javascript; # Load important JS first
pagespeed EnableFilters combine_css; # Merge CSS files
pagespeed EnableFilters rewrite_css; # Minimize CSS
pagespeed EnableFilters move_css_to_head; # Move CSS to head
pagespeed EnableFilters move_css_above_scripts; # Move CSS above JS
pagespeed EnableFilters prioritize_critical_css; # Load important CSS first
pagespeed EnableFilters fallback_rewrite_css_urls; # Fallback if CSS could not be parsed
pagespeed EnableFilters remove_comments; # Remove comments
pagespeed FileCachePath /var/ngx_pagespeed_cache; # Use tmpfs for best results.
# Ensure requests for pagespeed optimized resources go to the pagespeed
# handler and no extraneous headers get set.
location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" { add_header "" ""; }
location ~ "^/ngx_pagespeed_static/" { }
location ~ "^/ngx_pagespeed_beacon$" { }
location /ngx_pagespeed_statistics { allow 127.0.0.1; deny all; }
location /ngx_pagespeed_global_statistics { allow 127.0.0.1; deny all; }
location /ngx_pagespeed_message { allow 127.0.0.1; deny all; }
location /pagespeed_console { allow 127.0.0.1; deny all; }
location /mod_pagespeed_example {
location ~* \.(jpg|jpeg|gif|png|js|css)$ {
add_header Cache-Control "public, max-age=600";
}
}
}
nginx error log
2014/06/18 00:56:53 [error] 22133#0: *102248 open() "/home/mySite/production/htdocsindex.php" failed (2: No such file or directory), client: 92.227.135.241, server: www.mySite.de, request: "GET /blog/page1 HTTP/1.1", host: "www.mySite.de"
nginx access log
xx.xxx.135.241 - - [18/Jun/2014:01:35:02 +0200] "GET /blog/page1 HTTP/1.1" 404 200 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36"
Questions:
I don't understand, why my configuration makes nginx search for index.php in
/home/mySite/production/htdocsindex.php
instead of
/home/mySite/production/htdocs/blog/index.php
Why is there a slash missing between htdocs and index.php and/or why is the /blog part missing completely?
When i changed the trailing location block of production.conf from
location /blog/ {
alias /home/mySite/production/htdocs/blog/;
to this
location /blog {
alias /home/mySite/production/htdocs/blog/;
(removed the trailing slash) I did not get the nginx error page anymore, but then gunicorn and django kicked in an gave me a django 404 page. Why is django kicking in here?
Also using
try_files $uri $uri/ /blog/index.php?q=$uri&$args;
instead of
try_files $uri $uri/ /blog/index.php?q=$uri;
did not solve the issue. What is wrong up with my configuration and how I can get Wordpress to work with nginx, gunicorn and django?
Thanks a lot, Chris
This is correct rewrites if your wordpress in subfolder (for example blog subfolder).
location /blog/ {
index index.php index.html index.htm;
try_files $uri $uri/ /blog/index.php?$args;
}
You have root path it your config
root /home/mySite/production/htdocs/
so you can don't use alias in location (if your blog directory located in root folder).
Related
I need to redirect both www to non www and HTTP to HTTPS with nginx. I can get it to redirect but then I get a `too many redirects' error.
I'm using the Azure AppService version of WordPress. This version uses the wordpress-alpine-php docker image, running nginx version 1.20.2.
The nginx.conf file includes:
/etc/nginx/conf.d/*.conf
/etc/nginx/modules-enabled/*.conf
I don't see a modules-enabled directory.
For the HTTP to https redirect, I added the following server directive to default.conf:
server {
listen 80;
server_name ---.com www.---.com;
return 301 https://---.com$request_uri;
}
After this, I get the "too many redirects" error.
I noticed the following server block also listens on port 80, so I changed it to 443. I still get the "too many redirects".
Below are my conf files. The only change I made was adding the server directive above, and changing the port to 443 in the original server directive.
How do I get these redirects to work?
Could there be other files involved?
/etc/nginx/nginx.conf
user nginx;
worker_processes auto;
# send nginx error logs to stderr
error_log /dev/stderr error;
pid /var/run/nginx.pid;
load_module modules/ngx_http_brotli_static_module.so;
load_module modules/ngx_http_brotli_filter_module.so;
events {
worker_connections 10000;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log off;
sendfile on;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/modules-enabled/*.conf;
}
/etc/nginx/conf.d/default.conf
upstream php {
server unix:/var/run/php/php-fpm.sock;
#server 127.0.0.1:9000;
}
server {
listen 80;
server_name ---.com www.---.com;
return 301 https://---.com$request_uri;
}
server {
listen 443;
## Your website name goes here.
server_name _;
if ($http_x_forwarded_proto = "http") {
return 301 https://---.com$request_uri;
}
## Your only path reference.
root /home/site/wwwroot;
## This should be in your http block and if it is, it's not needed here.
index index.php;
location = /favicon.ico {
log_not_found off;
access_log off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Add locations of phpmyadmin here.
location /phpmyadmin {
root /home/;
index index.php index.html index.htm;
location ~ ^/phpmyadmin/(.+\.php)$ {
try_files $uri =404;
root /home/;
fastcgi_pass unix:/var/run/php/php-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include /etc/nginx/fastcgi_params;
}
location ~* ^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /home/;
}
}
location /phpMyAdmin {
rewrite ^/* /phpmyadmin last;
}
# Disable sendfile as per https://docs.vagrantup.com/v2/synced-folders/virtualbox.html
sendfile off;
set $skip_cache 0;
# POST requests and urls with a query string should always go to PHP
if ($request_method = POST) {
set $skip_cache 1;
}
if ($query_string != "") {
set $skip_cache 1;
}
# Don't cache uris containing the following segments
if ($request_uri ~* "/wp-admin/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml") {
set $skip_cache 1;
}
# Don't use the cache for logged in users or recent commenters
if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in") {
set $skip_cache 1;
}
# Don't cache WooCommerce URLs
# Cart widgets are still a problem: https://github.com/emcniece/docker-wordpress/issues/3
if ($request_uri ~* "/(cart|checkout|my-account)/*$") {
set $skip_cache 1;
}
location / {
# This is cool because no php is touched for static content.
# include the "?$args" part so non-default permalinks doesn't break when using query string
try_files $uri $uri/ /index.php?$args;
}
location ~* \.php$ {
#NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
include fastcgi.conf;
include fastcgi_params;
fastcgi_intercept_errors on;
fastcgi_pass php;
fastcgi_read_timeout 300;
fastcgi_cache_bypass $skip_cache;
fastcgi_no_cache $skip_cache;
fastcgi_cache off;
fastcgi_cache_valid 60m;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}
}
You need to add ssl flag to your listen directive if you want to use HTTPS. And specify your SSL certificate - something like this:
server {
listen 443 ssl http2;
server_name ---.com;
ssl_session_cache shared:SSL:4m; # measured in megabytes, not minutes
ssl_buffer_size 4k; # reduced from the default 16k to minimize TTFB
ssl_session_timeout 30m;
ssl_session_tickets on; # Requires nginx >= 1.5.9 (SSL labs testing leads to SSL: error:14094085:SSL routines:SSL3_READ_BYTES:ccs received early)
ssl_dhparam /etc/ssl/dhparam.pem; # Generate with "openssl dhparam -out dhparam.pem 4096"
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 valid=300s ipv6=off;
resolver_timeout 4s;
ssl_certificate /etc/ssl/fullchain.pem;
ssl_certificate_key /etc/ssl/key.pem;
.......
}
I am not very familiar with Nginx URL redirect. But I have followed some suggestions from Google search and unfortunately none of them meet my expectation.
I need to redirect at least 100 old URLs to different new URLs. I already have another server.conf file under /etc/nginx/conf.d/ for some URL redirect and other settings. But I would like to create another nginx_redirect.txt file to store those 100 URLs redirect and keep away from server.conf. Furthermore, some of the old 100 URLs are also defined in server.conf file, but I was hoping the new nginx_rewrite.txt file can override the redirect URLs defined in server.conf file.
I use multiple "include" in the nginx.conf as below:
include /etc/nginx/conf.d/*.conf;
Server {
...
include /etc/nginx/conf.d/nginx_rewrite.txt;
...
}
The existing server.conf file for some URL redirect as below:
server {
...
location ~ ^/lp/old/ {
rewrite ^(.*)$ https://currenturl.com/ permanent;
}
}
I create new nginx_redirect.txt and hope to override the redirect URL in server.conf.
location ~ ^/lp/old/ {
rewrite ^(.*)$ https://newurl.com/ permanent;
}
I used below commands to ensure those .conf and .txt can be seen by Nginx.
nginx -T
nginx -s reload
However I found those old URLs defined in nginx_rewrite.txt didn't redirect to newurl.com/ but still to currenturl.com/. Even I set up some new URL in nginx_rewrite.txt, which is not defined in server.conf. Those new URL will show 404 instead of redirecting to other URL. Unless I defined those new URL in server.conf.
My questions:
Is my setting in nginx.conf, server.conf and nginx_rewrite.txt correct?
Is there not possible to override URL in permanent redirect of .conf?
Updated on 5/10 to share the result of nginx -T. Sorry I have remove some lines since it is not suitable to share with public.
sh-4.2$ sudo nginx -T
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
# For more information on configuration, see:
# * Official English Documentation: http://nginx.org/en/docs/
# * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 4096;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
listen 80;
listen [::]:80;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
include /etc/nginx/conf.d/nginx_rewrite.txt;
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
}
# configuration file /etc/nginx/conf.d/server.conf:
upstream nginx-internal-sock {
server unix:/var/www/server/shared/tmp/unicorn.sock;
}
server {
listen 80;
server_name server.com;
location / {
root /var/www/server/current/public/;
}
}
server {
listen 80;
server_name stg.server.com;
real_ip_header X-Forwarded-For;
location / {
proxy_set_header Accept-Encoding "";
proxy_pass http://nginx-internal-sock/sales/;
}
location /sales {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Accept-Encoding "";
proxy_pass http://nginx-internal-sock/sales;
}
location ~ ^/(assets)/ {
root /var/www/server/current/public;
add_header Cache-Control no-cache;
expires 7d;
# add_header Last-Modified "";
# add_header ETag "";
}
location ~ ^/lp/old/ {
rewrite ^(.*)$ https://currenturl.com/ permanent;
}
...
}
# configuration file /etc/nginx/conf.d/nginx_rewrite.txt:
location ~ ^/lp/old/ {
rewrite ^(.*)$ https://newurl.com/ permanent;
}
}
MY ENVIRONMENT:
I am running a LEMP server which is working and running wordpress quite properly. As of now, I have my wordpress web login (www.mysite/wp-login.php) blacklisted by all IP addresses EXCEPT any IP on my LAN with the following directive:
server {
# Allow LAN only on wp-login page (www.mysite.com/wp-login.php)
location ~ /wp-login.php {
allow 192.168.1.0/24;
deny all;
}
This directive sucessfully blocks all internet traffic to "mywebsite.com/wp-login.php", which is the wordpress admin login page.
In other words, with this directive set, I can access the wordpress login page anywhere on my internal LAN, but the directive denys any outside internet traffic from seeing the "mywebsite.com/wp-login.php" page. GREAT!
WHAT I WANT TO DO,
is to whitelist the IP address of my phone, so that I can access the wordpress login page from my phone's IP address, while still blocking any other outside internet traffic. To do so, I go to www.whatsmyip.org on my phone, copy the ip address that it gives me, then modify the previous directive to look like the following:
server {
# Allow LAN and CellPhone access to to wp-login page (www.mysite.com/wp-login.php)
location ~ /wp-login.php {
allow 77.232.28.46; # my phones ip address as shown on whatsmyip.org
allow 192.168.1.0/24;
deny all;
}
HOWEVER,
after reloading nginx, I still cannot access the wp-login (wordpress login) page from my phone.
MY QUESTION IS:
Using NGINX, How can I properly whitelist my phones IP address, while blacklisting everything else access to the wordpress login page locate at www.mysite.com/wp-login.php ?
FOR REFERENCE:
Below is my NGINX.CONF file:
# This is the /etc/nginx/nginx.conf file for Danrancan's LEMP server
#
user www-data;
worker_processes 4;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
load_module /usr/share/nginx/modules/ngx_http_modsecurity_module.so;
events {
worker_connections 1024;
# multi_accept on;
}
http {
##
# Mod Security
##
modsecurity on;
#modsecurity off;
modsecurity_rules_file /etc/nginx/modsec/main.conf;
##
# Basic Settings
##
client_max_body_size 512M;
fastcgi_read_timeout 300;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
types_hash_max_size 4096;
server_tokens off;
server_names_hash_bucket_size 64;
# server_name_in_redirect off;
# Create a custom Nginx log format called netdata that includes information about request_time, and upstream_response_time, measured in seconds with millisecond resolution.
log_format netdata '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'$request_length $request_time $upstream_response_time '
'"$http_referer" "$http_user_agent"';
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_session_cache shared:SSL:10m; #SSL session cache
ssl_session_timeout 1h;
ssl_prefer_server_ciphers on;
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
##
# Gzip Settings
##
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 5;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_types
application/atom+xml
application/javascript
application/json
application/rss+xml
application/vnd.ms-fontobject
application/x-font-ttf
application/x-web-app-manifest+json
application/xhtml+xml
application/xml
font/opentype
image/svg+xml
image/x-icon
text/css
text/plain
text/x-component
text/javascript
text/xml;
# Extra Http Header response to determine whether a request is being served from the cache
#add_header Fastcgi-Cache $upstream_cache_status;
##
# Virtual Host Configs
##
upstream local_php {
server unix:/run/php/php7.4-fpm.sock;
}
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
include /etc/nginx/perfect-forward-secrecy.conf;
##
# Harden nginx against DDOS. #noted from www.pestmeester.nl
##
client_header_timeout 10;
# For good security, set client_body_timeout to 10. For uploading large files, set to higher.
client_body_timeout 10;
keepalive_timeout 10;
send_timeout 10;
}
and my VIRTUAL HOST CONFIG:
# Danrancan's Virtual host config for /etc/nginx/sites-available/mysite.com.conf
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name mysite.com www.mysite.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
###
# SSL (From Mozilla Config Generator: Modern Configuration)
###
# Add Strict Transport Security Response Header with "always Paramater", to help prevent MITM attacks.
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
## Prevent click jacking by adding an X-Frame header
# Add X-Frame-Options header to nginx with the following line:
add_header x-frame-options "SAMEORIGIN" always;
# Add a content security policy header
add_header Content-Security-Policy "frame-ancestors 'self';";
# Secure MIME Types with X-Content-Type-Options. Below line adds the X-Fram-Options header in Nginx.
add_header X-Content-Type-Options nosniff;
# Enable X-XSS-Protection header in Nginx
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "strict-origin";
add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()";
# Path to signerd certificate + Intermediate certificates
ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem; # Managed by admin
ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem; # Managed by admin
# Perfect Forward Secrecy Diffie-Hellman 4096 parameters
ssl_dhparam /etc/ssl/private/dhparams4096.pem; # Managed by admin
# Include "perfect-forward-secrecy.conf" file in this virtual host. NOTE: No need to do this, as its already included in the nginx.conf file, so you should comment this out.
#include /etc/nginx/perfect-forward-secrecy.conf; # Managed by admin
# Modern SSL configuration with OCSP stapling turned on
#ssl_protocols TLSv1.3; # commented out because its already in the nginx.conf file
ssl_prefer_server_ciphers on;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4;
# Verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /etc/letsencrypt/live/mysite.com/chain.pem; # Managed by admin
server_name mysite.com www.mysite.com;
root /var/www/mysite.com;
# Error & Access Logs
#error_log /var/www/mysite.com.logs/error.log error;
#access_log /var/www/mysite.com.logs/access.log;
access_log /var/log/nginx/mysite.com.access.log netdata;
error_log /var/log/nginx/mysite.com.error.log warn;
# This should be in your http block and if it is, it's not needed here.
index index.php index.html index.htm;
# Only allow access of /admin via internal IP
location ^~ /admin {
allow 192.168.1.0/24;
deny all;
error_page 403 =444;
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
}
# Allow local only to wp-login page
location ~ /wp-login.php {
allow 192.168.1.0/24;
deny all;
error_page 403 =444;
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
}
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ /.well-known {
allow all;
}
location = /favicon.ico {
log_not_found off;
access_log off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Cache Static Files For As Long As Possible
location ~*\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
access_log off;
log_not_found off;
expires max;
}
# Security Settings For Better Privacy Deny Hidden Files
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# Disallow PHP In Upload Folder
location /wp-content/uploads/ {
location ~ \.php$ {
deny all;
}
}
# Pass PHP scripts to FastCGI server
location ~ \.php$ {
include snippets/fastcgi-php.conf;
# With php-fpm (or other unix sockets):
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
# Below was Added from recommended by pestmeester.nl
fastcgi_intercept_errors on;
fastcgi_buffers 16 16k;
fastcgi_buffer_size 32k;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}
}
What you are doing should work.
Since it is not, it seems that for some reason nginx doesn't see your phone IP as a match to what you have configured.
It sounds like your WP box is running on a private network (because of the 192.168.1.0/ IP addresses you mentioned).
When you connect to the WP box from the internet, is it going through a router with port forwarding/NAT?
First thing I would do is just tail your nginx access log (access_log /var/log/nginx/access.log;) when trying to access with your iphone and see what is reported.
If the request is coming through a proxy/reverse-proxy you may need to make sure the proxy is adding X-Forwarded-For to pass along the remote (iphone) ip address. The request to nginx/wp would be coming from the proxy IP and there would be a header X-Forwarded-For added to the request containing the original remote address.
When nginx is used this way you need to use nginx's realip module...something like:
real_ip_header X-Forwarded-For;
set_real_ip_from 192.168.1.1; # proxy ip
http://nginx.org/en/docs/http/ngx_http_realip_module.html
I think I have a small error /mistake in my configuration. I use a server for a magento shop.
My server setting for Nginx are:
user nobody;
worker_processes 2; ## = CPU qty
error_log /var/log/nginx/error.log;
#error_log /var/log/nginx/error.log notice;
#error_log /var/log/nginx/error.log info;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
use epoll;
}
http {
index index.html index.php; ## Allow a static html file to be shown first
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
#log_format error403 '$remote_addr - $remote_user [$time_local] '
# '$status "$request" "$http_x_forwarded_for"';
server_tokens off;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
## Gzipping is an easy way to reduce page weight
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_types text/css application/x-javascript;
gzip_buffers 16 8k;
gzip_comp_level 8;
gzip_min_length 1024;
#ssl_session_cache shared:SSL:15m;
#ssl_session_timeout 15m;
keepalive_timeout 10;
## Use when Varnish in front
#set_real_ip_from 127.0.0.1;
#real_ip_header X-Forwarded-For;
## Multi domain configuration
#map $http_host $storecode {
#www.domain1.com 1store_code; ## US main
#www.domain2.net 2store_code; ## EU store
#www.domain3.de 3store_code; ## German store
#www.domain4.com 4store_code; ## different products
#}
server {
listen 80; ## change to 8080 with Varnish
#listen 443 ssl;
server_name _; ## Domain is here
root /var/www/html;
access_log /var/log/nginx/access_mydomain.log main;
## Nginx will not add the port in the url when the request is redirected.
#port_in_redirect off;
####################################################################################
## SSL CONFIGURATION
#ssl_certificate /etc/ssl/certs/www_server_com.chained.crt;
#ssl_certificate_key /etc/ssl/certs/server.key;
#ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
#http://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
#http://serverfault.com/questions/417512/disable-deflate-compression-in-nginx-ssl
#ssl_ciphers AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH;
#ssl_ciphers RC4:HIGH:!aNULL:!MD5:!kEDH;
#ssl_prefer_server_ciphers on;
####################################################################################
## Server maintenance block. insert dev ip 1.2.3.4 static address www.whatismyip.com
#if ($remote_addr !~ "^(1.2.3.4|1.2.3.4)$") {
#return 503;
#}
#error_page 503 #maintenance;
#location #maintenance {
#rewrite ^(.*)$ /error_page/503.html break;
#internal;
#access_log off;
#log_not_found off;
#}
####################################################################################
## 403 error log/page
#error_page 403 /403.html;
#location = /403.html {
#root /var/www/html/error_page;
#internal;
#access_log /var/log/nginx/403.log error403;
#}
####################################################################################
## Main Magento location
location / {
try_files $uri $uri/ #handler;
}
####################################################################################
## These locations would be hidden by .htaccess normally, protected
location ~ (/(app/|includes/|/pkginfo/|var/|errors/local.xml)|/\.svn/|/.hta.+) {
deny all;
#internal;
}
####################################################################################
## Protecting /admin/ and /downloader/ 1.2.3.4 = static ip (www.whatismyip.com)
#location /downloader/ {
#allow 1.2.3.4;
#allow 1.2.3.4;
#deny all;
#rewrite ^/downloader/(.*)$ /downloader/index.php$1;
#}
#location /admin {
#allow 1.2.3.4;
#allow 1.2.3.4;
#deny all;
#rewrite / /#handler;
#}
####################################################################################
## Images, scripts and styles set far future Expires header
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
access_log off;
}
####################################################################################
## Main Magento location
location #handler {
rewrite / /index.php;
}
location ~ .php/ { ## Forward paths like /js/index.php/x.js to relevant handler
rewrite ^(.*.php)/ $1 last;
}
####################################################################################
## Execute PHP scripts
location ~ .php$ {
try_files $uri $uri/ =404;
#try_files $uri $uri/ #handler;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
## Store code with multi domain
#fastcgi_param MAGE_RUN_CODE $storecode;
## Default Store code
fastcgi_param MAGE_RUN_CODE default;
fastcgi_param MAGE_RUN_TYPE store; ## or website;
include fastcgi_params; ## See /etc/nginx/fastcgi_params
}
}
}
For php-fpm it is (its not the whole code, just what I changed)
;listen = 127.0.0.1:9000
listen = /var/run/php-fpm/php-fpm.sock
;listen.owner = nobody
listen.owner = nginx
;listen.group = nobody
listen.group = nginx
;listen.mode = 0666
listen.mode = 0664
user = nginx
group = nginx
[...]
Then I add myself as a user via:
user add byname -d /var/www/html -m
give myself a password (I use VSFTPD), add a group wwwftp, add myself to the group via:
usermod -g wwwftp myname
make /var/www/html owned by me:
chown byname /var/www/html
and change the group (chgrp wwwftp /var/www/html)
Sometimes I have file permission issues. If Magento adds a file the file permissions are user 99 and group 99. Images can't be displayed. Files can't be opened unless I make them 777.
Maybe something in my config is wrong?
You have php-fpm set to run as user nginx and group nginx so any files created by magento will have that user and group (are those 99?).
But nginx itself is running as user 'nobody' (first line). So it can't access images that are owned by user/group 'nginx' (created by php-fpm). Setting permissions to 777 allows user 'nobody' to access files owned by 'nginx'.
But any php files written by magento would be fine, since they are created and read using user 'nginx' from php-fpm.
why do you want to set the /var/www/html to byname? what are you trying to accomplish? Are you trying to all an ftp connection to read/write those files? If so, you'd be better off adding your user to group 'nobody' and group 'nginx' so you can read/write both kinds of files.
I'm adding some https pages to my rails site. In order to test it locally, i'm running my site under one mongrel_rails instance (on 3000) and nginx.
I've managed to get my nginx config to the point where i can actually go to the https pages, and they load. Except, the javascript and css files all fail to load: looking in the Network tab in chrome web tools, i can see that it is trying to load them via an https url. Eg, one of the non-working file urls is
https://cmw-local.co.uk/stylesheets/cmw-logged-out.css?1383759216
I have these set up (or at least think i do) in my nginx config to redirect to the http versions of the static files. This seems to be working for graphics, but not for css and js files.
If i click on this in the Network tab, it takes me to the above url, which redirects to the http version. So, the redirect seems to be working in some sense, but not when they're loaded by an https page. Like i say, i thought i had this covered in the second try_files directive in my config below, but maybe not.
Can anyone see what i'm doing wrong? thanks, Max
Here's my nginx config - sorry it's a bit lengthy! I think the error is likely to be in the first (ssl) server block:
NOTE: the urls in here (elearning.dev, cmw-dev.co.uk, etc) are all just local host names, ie they're all just aliases for 127.0.0.1.
server {
listen 443 ssl;
keepalive_timeout 70;
ssl_certificate /home/max/work/charanga/elearn_container/elearn/config/nginx/certs/max-local-server.crt;
ssl_certificate_key /home/max/work/charanga/elearn_container/elearn/config/nginx/certs/max-local-server.key;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers RC4:HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
server_name elearning.dev cmw-dev.co.uk cmw-dev.com cmw-nginx.co.uk cmw-local.co.uk;
root /home/max/work/charanga/elearn_container/elearn;
# ensure that we serve css, js, other statics when requested
# as SSL, but if the files don't exist (i.e. any non /basket controller)
# then redirect to the non-https version
location / {
try_files $uri #non-ssl-redirect;
}
# securely serve everything under /basket (/basket/checkout etc)
# we need general too, because of the email/username checking
location ~ ^/(basket|general|cmw/account/check_username_availability) {
# make sure cached copies are revalidated once they're stale
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
# this serves Rails static files that exist without running
# other rewrite tests
try_files $uri #rails-ssl;
expires 1h;
}
location #non-ssl-redirect {
return 301 http://$host$request_uri;
}
location #rails-ssl {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_redirect off;
proxy_read_timeout 180;
proxy_next_upstream off;
proxy_pass http://127.0.0.1:3000;
expires 0d;
}
}
#upstream elrs {
# server 127.0.0.1:3000;
#}
server {
listen 80;
server_name elearning.dev cmw-dev.co.uk cmw-dev.com cmw-nginx.co.uk cmw-local.co.uk;
root /home/max/work/charanga/elearn_container/elearn;
access_log /home/max/work/charanga/elearn_container/elearn/log/access.log;
error_log /home/max/work/charanga/elearn_container/elearn/log/error.log debug;
client_max_body_size 50M;
index index.html index.htm;
# gzip html, css & javascript, but don't gzip javascript for pre-SP2 MSIE6 (i.e. those *without* SV1 in their user-agent string)
gzip on;
gzip_http_version 1.1;
gzip_vary on;
gzip_comp_level 6;
gzip_proxied any;
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript; #text/html
# make sure gzip does not lose large gzipped js or css files
# see http://blog.leetsoft.com/2007/7/25/nginx-gzip-ssl
gzip_buffers 16 8k;
# Disable gzip for certain browsers.
#gzip_disable "MSIE [1-6].(?!.*SV1)";
gzip_disable "MSIE [1-6]";
# blank gif like it's 1995
location = /images/blank.gif {
empty_gif;
}
# don't serve files beginning with dots
location ~ /\. { access_log off; log_not_found off; deny all; }
# we don't care if these are missing
location = /robots.txt { log_not_found off; }
location = /favicon.ico { log_not_found off; }
location ~ affiliate.xml { log_not_found off; }
location ~ copyright.xml { log_not_found off; }
# convert urls with multiple slashes to a single /
if ($request ~ /+ ) {
rewrite ^(/)+(.*) /$2 break;
}
# X-Accel-Redirect
# Don't tie up mongrels with serving the lesson zips or exes, let Nginx do it instead
location /zips {
internal;
root /var/www/apps/e_learning_resource/shared/assets;
}
location /tmp {
internal;
root /;
}
location /mnt{
root /;
}
# resource library thumbnails should be served as usual
location ~ ^/resource_library/.*/*thumbnail.jpg$ {
if (!-f $request_filename) {
rewrite ^(.*)$ /images/no-thumb.png
break;
}
expires 1m;
}
# don't make Rails generate the dynamic routes to the dcr and swf, we'll do it here
location ~ "lesson viewer.dcr" {
rewrite ^(.*)$ "/assets/players/lesson viewer.dcr" break;
}
# we need this rule so we don't serve the older lessonviewer when the rule below is matched
location = /assets/players/virgin_lesson_viewer/_cha5513/lessonViewer.swf {
rewrite ^(.*)$ /assets/players/virgin_lesson_viewer/_cha5513/lessonViewer.swf break;
}
location ~ v6lessonViewer.swf {
rewrite ^(.*)$ /assets/players/v6lessonViewer.swf break;
}
location ~ lessonViewer.swf {
rewrite ^(.*)$ /assets/players/lessonViewer.swf break;
}
location ~ lgn111.dat {
empty_gif;
}
# try to get autocomplete school names from memcache first, then
# fallback to rails when we can't
location /schools/autocomplete {
set $memcached_key $uri?q=$arg_q;
memcached_pass 127.0.0.1:11211;
default_type text/html;
error_page 404 =200 #rails; # 404 not really! Hand off to rails
}
location / {
# make sure cached copies are revalidated once they're stale
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
# this serves Rails static files that exist without running other rewrite tests
try_files $uri #rails;
expires 1h;
}
location #rails {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_redirect off;
proxy_read_timeout 180;
proxy_next_upstream off;
proxy_pass http://127.0.0.1:3000;
expires 0d;
}
}
EDIT: It just occurred to me that this might be better on superuser or serverfault, or perhaps both. I'm not sure what the cross-site posting rules are.