RoE | Wiki

User Tools

Site Tools

Trace: • openvpn • openssh_server • distcc • mariadb • nginx_php_php-fpm
servers:linux:nginx_php_php-fpm

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
servers:linux:nginx_php_php-fpm [2025/01/22 16:59] – Sean Rhoneservers:linux:nginx_php_php-fpm [2025/07/13 23:02] (current) – Sean Rhone
Line 1: Line 1:
 ====== Information ====== ====== Information ======
  
-  * nginx ((https://nginx.org/en))+  * nginx
   * PHP   * PHP
   * PHP-FPM   * PHP-FPM
Line 8: Line 8:
 ===== Prerequisites ===== ===== Prerequisites =====
  
-  * [[linux;distros;server;fedora_server|Fedora Server]] +  * [[linux:distros:server:opensuse_tumbleweed_server|openSUSE Tumbleweed (Server)]]
- +
-===== Resources ===== +
- +
-  * [[https://www.ssllabs.com/ssltest/analyze.html?d=wiki.realmofespionage.xyz|Qualys SSL Test]] +
-  * https://fedoraproject.org/wiki/Nginx +
- +
-==== Old ==== +
- +
-  * [[https://cipherli.st/|Cipherli.st]] +
-  * [[https://securityheaders.com/?q=wiki.realmofespionage.xyz&followRedirects=on|Security Headers]] +
-  * [[https://dev.ssllabs.com/ssltest/analyze.html?d=wiki.realmofespionage.xyz|Qualys SSL Test (dev)]] +
-  * https://cs.chromium.org/chromium/src/third_party/blink/renderer/platform/feature_policy/feature_policy.cc?l=138&rcl=ab90b51c5b60de15054a32b0bd18e4839536a1c9 +
-  * https://infosec.mozilla.org +
-  * https://gist.github.com/plentz/6737338 +
-  * https://scotthelme.co.uk +
-  * https://mozilla.github.io/server-side-tls/ssl-config-generator+
  
 ====== Dependencies ====== ====== Dependencies ======
Line 30: Line 14:
 **** ****
  
-  sudo dnf install git nginx php-fpm php-cli+  sudo zypper install git-core nginx php8-cli php8-fpm php8-opcache
  
 ====== Information ====== ====== Information ======
Line 40: Line 24:
 ====== Firewall ====== ====== Firewall ======
  
-  * 80/tcp is HTTP +****
-  * 443/tcp is HTTPS+
  
   sudo firewall-cmd --add-service='http' --permanent && sudo firewall-cmd --add-service='https' --permanent && sudo firewall-cmd --reload   sudo firewall-cmd --add-service='http' --permanent && sudo firewall-cmd --add-service='https' --permanent && sudo firewall-cmd --reload
- 
-====== SELinux ====== 
- 
-===== DokuWiki ===== 
- 
-  * 2023/09/12 
- 
-  sudo setsebool -P 'httpd_graceful_shutdown' '1' 
- 
-  sudo setsebool -P 'nis_enabled' '1' 
- 
-  sudo setsebool -P 'httpd_can_network_connect' '1' 
- 
-  sudo setsebool -P 'httpd_can_network_relay' '1' 
  
 ====== Services ====== ====== Services ======
Line 66: Line 35:
  
   sudo systemctl enable 'nginx' 'php-fpm' --now   sudo systemctl enable 'nginx' 'php-fpm' --now
- 
-====== Permissions ====== 
- 
-**** 
- 
-  sudo chown --recursive 'nginx':'nginx' '/var/lib/php/opcache' '/var/lib/php/session' '/var/lib/php/wsdlcache' '/var/lib/php/peclxml' 
  
 ====== Config Defaults ====== ====== Config Defaults ======
  
-===== Backup =====+===== php-fpm Default Pool =====
  
-  sudo mv '/etc/nginx/default.d/php.conf' '/etc/nginx/default.d/php.conf~'+  sudo mv '/etc/php8/fpm/php-fpm.d/www.conf' '/etc/php8/fpm/php-fpm.d/www.conf~'
  
-  sudo mv '/etc/nginx/conf.d/php-fpm.conf' '/etc/nginx/conf.d/php-fpm.conf~'+  nano '/etc/php8/fpm/php-fpm.d/www.conf~'
  
-  sudo mv '/etc/php-fpm.d/www.conf' '/etc/php-fpm.d/www.conf~'+===== nginx.conf =====
  
   sudo mv '/etc/nginx/nginx.conf' '/etc/nginx/nginx.conf~'   sudo mv '/etc/nginx/nginx.conf' '/etc/nginx/nginx.conf~'
  
-===== View =====+  nano '/etc/nginx/nginx.conf~'
  
-  nano '/etc/nginx/default.d/php.conf~' +===== php.ini =====
- +
-  nano '/etc/nginx/conf.d/php-fpm.conf~' +
- +
-  nano '/etc/php-fpm.d/www.conf~' +
- +
-  nano '/etc/nginx/nginx.conf~'+
  
-  nano '/etc/php.ini'+  nano '/etc/php8/cli/php.ini'
  
 ====== nginx Settings ====== ====== nginx Settings ======
Line 148: Line 105:
 ===== Headers ===== ===== Headers =====
  
-  * Last updated: 2024/02/07 
   * Add to individual site configs as an ''include''   * Add to individual site configs as an ''include''
  
Line 166: Line 122:
  
 ===== nginx ===== ===== nginx =====
- 
-  * Last updated: 2023/09/12 
  
   sudo -e '/etc/nginx/nginx.conf'   sudo -e '/etc/nginx/nginx.conf'
  
 <code> <code>
-user nginx; 
-worker_processes auto; 
-error_log /var/log/nginx/error.log notice; 
-pid /run/nginx.pid; 
- 
-include /usr/share/nginx/modules/*.conf; 
- 
 events { events {
-    worker_connections 1024;+ multi_accept 'on'; 
 + worker_connections '1024';
 } }
 +
 +#error_log /var/log/nginx/error.log;
  
 http { http {
  
-    # Logging + # Logging 
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" ' + #log_format main '$time_local - $http_host - $remote_addr - $status "$request" $body_bytes_sent - $http_referer - "$http_user_agent"'; 
-                      '$status $body_bytes_sent "$http_referer" ' + #access_log '/var/log/nginx/access.log main';
-                      '"$http_user_agent" "$http_x_forwarded_for"'; +
- +
-    access_log  /var/log/nginx/access.log  main;+
  
-    # Includes + # Includes 
-    include /etc/nginx/conf.d/*.conf; + include '/etc/nginx/conf.d/*.conf'; 
-    include /etc/nginx/vhosts.d/*.conf; + include '/etc/nginx/vhosts.d/*.conf'; 
-    include /etc/nginx/mime.types; + include '/etc/nginx/mime.types'; 
-    default_type application/octet-stream;+ default_type 'application/octet-stream';
  
-    # Config + # Config 
-    sendfile on; + sendfile 'on'; 
-    tcp_nopush on; + tcp_nopush 'on'; 
-    tcp_nodelay on; + tcp_nodelay 'on'; 
-    keepalive_timeout 65; + keepalive_timeout '65'; 
-    types_hash_max_size 4096;+ types_hash_max_size '4096';
  
-    # gzip + # gzip 
-    gzip on; + gzip 'on'; 
-    gzip_vary on; + gzip_vary 'on'; 
-    gzip_proxied any; + gzip_proxied 'any'; 
-    gzip_comp_level 9; + gzip_comp_level '9'; 
-    gzip_types *;+ gzip_types '*';
 } }
  
Line 245: Line 192:
 ssl_prefer_server_ciphers 'on'; ssl_prefer_server_ciphers 'on';
 ssl_ecdh_curve 'secp384r1'; ssl_ecdh_curve 'secp384r1';
- 
-ssl_stapling 'on'; 
-ssl_stapling_verify 'on'; 
  
 # End</code> # End</code>
 +
 +====== TODOs ======
 +
 +===== Resources =====
 +
 +  * https://nginx.org/en/docs/windows.html
 +  * https://gist.github.com/odan/b5f7de8dfbdbf76bef089776c868fea1
 +  * https://certbot.eff.org/instructions?ws=other&os=pip
 +  * https://community.letsencrypt.org/t/using-certbot-in-windows-the-pragmatic-way/173929
 +  * https://www.php.net/manual/en/image.installation.php
 +  * [[https://www.ssllabs.com/ssltest/analyze.html?d=wiki.realmofespionage.xyz|Qualys SSL Test]]
 +
 +==== Old ====
 +
 +  * [[https://cipherli.st/|Cipherli.st]]
 +  * [[https://securityheaders.com/?q=wiki.realmofespionage.xyz&followRedirects=on|Security Headers]]
 +  * [[https://dev.ssllabs.com/ssltest/analyze.html?d=wiki.realmofespionage.xyz|Qualys SSL Test (dev)]]
 +  * https://cs.chromium.org/chromium/src/third_party/blink/renderer/platform/feature_policy/feature_policy.cc?l=138&rcl=ab90b51c5b60de15054a32b0bd18e4839536a1c9
 +  * https://infosec.mozilla.org
 +  * https://gist.github.com/plentz/6737338
 +  * https://scotthelme.co.uk
 +  * https://mozilla.github.io/server-side-tls/ssl-config-generator
 +  * [[https://www.ssllabs.com/ssltest/analyze.html?d=wiki.realmofespionage.xyz|Qualys SSL Test]]
 +  * https://fedoraproject.org/wiki/Nginx
  
/usr/local/www/wiki/data/attic/servers/linux/nginx_php_php-fpm.1737583184.txt.gz · Last modified: by Sean Rhone