Differences

This shows you the differences between two versions of the page.

--- servers:bsd:freenginx_php_php-fpm [2025/09/11 06:43] – created - external edit 127.0.0.1
+++ servers:bsd:freenginx_php_php-fpm [2025/10/30 23:42] (current) – Sean Rhone
@@ Line 2: / Line 2: @@
   * freenginx ((https://freenginx.org/))
-  * PHP 8.4
   * PHP-FPM
   * [[Information:Realm of Espionage]]
-  * :!: WIP
 ===== Prerequisites =====
-  * [[bsd:server:freebsd_14.2|FreeBSD 14.2]]
+  * [[bsd:server:freebsd_15.0|FreeBSD 15.0]]
-===== Resources =====
-  * [[https://cipherli.st/|Cipherli.st]]
-  * [[https://securityheaders.com/?q=wiki.realmofespionage.xyz&followRedirects=on|Security Headers]]
-  * [[https://www.ssllabs.com/ssltest/analyze.html?d=wiki.realmofespionage.xyz|Qualys SSL Test]]
-  * [[https://dev.ssllabs.com/ssltest/analyze.html?d=wiki.realmofespionage.xyz|Qualys SSL Test (dev)]]
-  * https://cs.chromium.org/chromium/src/third_party/blink/renderer/platform/feature_policy/feature_policy.cc?l=138&rcl=ab90b51c5b60de15054a32b0bd18e4839536a1c9
-  * https://infosec.mozilla.org
-  * https://gist.github.com/plentz/6737338
-  * https://scotthelme.co.uk
-  * https://mozilla.github.io/server-side-tls/ssl-config-generator
 ====== Dependencies ======
@@ Line 28: / Line 13: @@
   su -
-  pkg install freenginx php84
+  pkg install freenginx-devel php85
-===== PHP Extensions =====
+===== PHP Modules =====
-==== Verify Modules ====
 ****
   php -m
-====== Firewall ======
-  * 80/tcp is HTTP
-  * 443/tcp is HTTPS
-  * TODO
-  sudo firewall-cmd --add-service='http' --permanent && sudo firewall-cmd --add-service='https' --permanent && sudo firewall-cmd --reload
 ====== Services ======
@@ Line 60: / Line 35: @@
 ===== Backup =====
-  sudo mv '/etc/nginx/default.d/php.conf' '/etc/nginx/default.d/php.conf~'
+  su -
-  sudo mv '/etc/nginx/conf.d/php-fpm.conf' '/etc/nginx/conf.d/php-fpm.conf~'
+  mv -v '/usr/local/etc/freenginx/nginx.conf' '/usr/local/etc/freenginx/nginx.conf~'
-  sudo mv '/etc/php-fpm.d/www.conf' '/etc/php-fpm.d/www.conf~'
+  mv -v '/usr/local/etc/php-fpm.d/www.conf' '/usr/local/etc/php-fpm.d/www.conf~'
-  mv -v '/usr/local/etc/nginx/nginx.conf' '/usr/local/etc/nginx/nginx.conf~'
-===== View =====
-  nano '/etc/nginx/default.d/php.conf~'
-  nano '/etc/nginx/conf.d/php-fpm.conf~'
-  nano '/etc/php-fpm.d/www.conf~'
-  ee '/usr/local/etc/nginx/nginx.conf~'
-  nano '/etc/php.ini'
 ====== nginx Settings ======
-===== Notes =====
-  * ''conf.d'' contains **server-wide** modular configuration files
-  * ''default.d'' contains **site-specific** modular configuration files
-  * ''vhosts.d'' contains enabled websites
 ===== Defaults =====
@@ Line 92: / Line 47: @@
   su -
-  mkdir -p '/usr/local/etc/nginx/conf.d' '/usr/local/etc/nginx/default.d' '/usr/local/etc/nginx/vhosts.d'
+  mkdir -p -m '0644' '/usr/local/etc/freenginx/conf.d' '/usr/local/etc/freenginx/default.d' '/usr/local/etc/freenginx/vhosts.d'
 ===== HTTPS Redirect =====
@@ Line 100: / Line 55: @@
   su -
-  ee '/usr/local/etc/nginx/conf.d/http-redirect.conf'
+  ee '/usr/local/etc/freenginx/conf.d/http-redirect.conf'
 <code>
 server {
-    listen '80' 'default_server';
+    listen 80 default_server;
-    listen '[::]:80' 'default_server';
+    listen [::]:80 default_server;
-    return '301' 'https://$host$request_uri';
+    return 301 https://$host$request_uri;
-}</code>
+}
+# End</code>
 ===== Non-existent 404 =====
@@ Line 116: / Line 73: @@
   su -
-  ee '/usr/local/etc/nginx/conf.d/non-existent.conf'
+  ee '/usr/local/etc/freenginx/conf.d/non-existent.conf'
 <code>
 server {
-    listen '443' 'ssl' default_server;
+    listen 443 ssl default_server;
-    http2 'on';
+    http2 on;
-    server_name '_';
+    server_name _;
-    return '404';
+    return 404;
-}</code>
+}
-===== Headers =====
+# End</code>
-  * Add to individual site configs as an ''include''
+===== Headers =====
   su -
-  ee '/usr/local/etc/nginx/default.d/headers.conf'
+  ee '/usr/local/etc/freenginx/default.d/headers.conf'
 <code>
@@ Line 143: / Line 100: @@
 add_header Referrer-Policy "same-origin" always;
 add_header Expect-CT "max-age=0" always;
-add_header Permissions-Policy "geolocation=(), microphone=(), payment=(), usb=(), vr=(), magnetometer=(), midi=(), camera=(), ambient-light-sensor=(), accelerometer=()" always;</code>
+add_header Permissions-Policy "geolocation=(), microphone=(), payment=(), usb=(), vr=(), magnetometer=(), midi=(), camera=(), ambient-light-sensor=(), accelerometer=()" always;
-===== nginx =====
+# End</code>
-  * Last updated: 2024/11/30
+===== nginx =====
   su -
-  ee '/usr/local/etc/nginx/nginx.conf'
+  ee '/usr/local/etc/freenginx/nginx.conf'
 <code>
@@ Line 171: / Line 128: @@
     # Includes
-    include /usr/local/etc/nginx/conf.d/*.conf;
+    include /usr/local/etc/freenginx/conf.d/*.conf;
-    include /usr/local/etc/nginx/vhosts.d/*.conf;
+    include /usr/local/etc/freenginx/vhosts.d/*.conf;
-    include /usr/local/etc/nginx/mime.types;
+    include /usr/local/etc/freenginx/mime.types;
     default_type application/octet-stream;
@@ Line 192: / Line 149: @@
 # End</code>
-==== CSP Headers ====
-  * The empty CSP allows all and can be useful for new site bring-ups, and should be placed in site-specific configs underneath the ''include'' line(s)
-<code>    add_header Content-Security-Policy "default-src 'self'" always;</code>
-<code>    add_header Content-Security-Policy "" always;</code>
 ====== SSL Certs ======
@@ Line 209: / Line 158: @@
   su -
-  ee '/usr/local/etc/nginx/conf.d/ssl.conf'
+  ee '/usr/local/etc/freenginx/conf.d/ssl.conf'
 <code>
@@ Line 225: / Line 174: @@
 ssl_prefer_server_ciphers 'on';
 ssl_ecdh_curve 'secp384r1';
-ssl_stapling 'on';
-ssl_stapling_verify 'on';
 # End</code>
+====== Resources ======
+===== Original confs =====
+  ee '/usr/local/etc/freenginx/nginx.conf~'
+  ee '/usr/local/etc/php-fpm.d/www.conf~'