Code Monkey home page Code Monkey logo

wordpress-nginx's Introduction

WordPress Nginx

This config kit contains the Nginx configurations used in the Install WordPress on Ubuntu 22.04 guide. It contains best practices from various sources, including the WordPress Codex and H5BP. The following example sites are included:

Usage

Site configuration

You can use these sample configurations as reference or directly by replacing your existing nginx directory. Follow the steps below to replace your existing Nginx configuration.

Backup any existing config:

sudo mv /etc/nginx /etc/nginx.backup

Copy these configs to /etc/nginx.

Symlink the default file from sites-available to sites-enabled, which will setup a catch-all server block. This will ensure unrecognised domains return a 444 response.

sudo ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default

Copy one of the example configurations from sites-available to sites-available/yourdomain.com:

sudo cp /etc/nginx/sites-available/single-site.com /etc/nginx/sites-available/yourdomain.com

Edit the site accordingly, paying close attention to the server name and paths.

To enable the site, symlink the configuration into the sites-enabled directory:

sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/yourdomain.com

Test the configuration:

sudo nginx -t

If the configuration passes, restart Nginx:

sudo service nginx reload

PHP configuration

The php-fpm pool configuration is located in global/php-pool.conf and defaults to PHP 7.4. It will need modifying if you want the default php-fpm pool service to be a different PHP version. Additional PHP version upstream definitions can be added to the /upstreams folder (a PHP 8.3 sample is provided there). You can either use the default pool using $upstream in your nginx configurations or the specific upstream definition (i.e. php83, php82) setup by your custom upstream definitions.

For example, currently the nginx configuration for single-site.com has the following set for php requests:

fastcgi_pass    $upstream

You could change that to the following to use the php 8.3 PHP service instead (assuming that php8.3-fpm service is running).

fastcgi_pass    php83

This effectively allows you to have different server blocks execute different versions of PHP if needed.

Directory Structure

This config kit has the following structure, which is based on the conventions used by a default Nginx install on Debian:

.
├── conf.d
├── global
    └── server
├── sites-available
├── sites-enabled

conf.d - configurations for additional modules.

global - configurations within the http block.

global/server - configurations within the server block. The defaults.conf file should be included on the majority of sites, which contains sensible defaults for caching, file exclusions and security. Additional .conf files can be included as needed on a per-site basis.

sites-available - configurations for individual sites (virtual hosts).

sites-enabled - symlinks to configurations within the sites-available directory. Only sites which have been symlinked are loaded.

Recommended Site Structure

The following site structure is used throughout these configs:

.
├── yourdomain1.com
    └── cache
    └── logs
    └── public
├── yourdomain2.com
    └── cache
    └── logs
    └── public

wordpress-nginx's People

Contributors

a5hleyrich avatar boyetdgte avatar bradt avatar nerrad avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

wordpress-nginx's Issues

global/server/exclusions.conf causing issues with certbot auto renewal (Lets encrypt)

# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)

location ~ /\. {
	deny all;
}

above rule is causing issues with certbot , Is there a way to exclude single hidden folder eg: .well-known ?

Nginx error
2018/01/28 17:06:25 [error] 3290#3290: *1316 access forbidden by rule,
certbot error
The client lacks sufficient authorization :: Invalid response from http://www.blog.com/**.well-known**/acme-challenge/8nYiIsdsdsd2cfLZwsdsdPxNhCA: "

FastCGI Questions

Hi!

Thanks for the awesome configuration kit and the the WordPress server setup tutorial! I must say, this is the most complete guide I've found anywhere so far to set-up a full Linux server for WordPress!

I have a concern about the FastCGI cache purging. Before discovering your tutorial, I was following this tutorial to setup FastCGI cache: https://www.linuxbabe.com/nginx/setup-nginx-fastcgi-cache

It says to install http-cache-purge module to purge cache. My question is, does the nginx version in your tutorial includes this module. I assume it is, as you've not instructed to install it on the tutorial. But want to make sure. From this tutorial, it looks like cache purging with the Nginx Helper plugin will not work.

Also it says to add the following code to the server block for cache purging, which I do not see in this kit (probably I've missed it somehow!):

location ~ /purge(/.*) {
      fastcgi_cache_purge phpcache "$scheme$request_method$host$1";
}

I've also found this comment on the Nginx website regarding FastCGI: https://www.nginx.com/blog/9-tips-for-improving-wordpress-performance-with-nginx/#comment-2804093220

Using $host in fastcgi_cache_key can result in infinite redirect loops with WordPress.

WordPress has this silly little thing called redirect_canonical, which will attempt to strip the port number (:80, :443) from the Host header by redirecting to the same URL without the port number. Many web crawlers and especially monitoring systems explicitly provide the port number in the Host header, so they get a redirect.

But the $host variable in Nginx does not contain the port number, even if explicitly set in the Host header, resulting in the same cache keys for requests with and without the port. So if somebody is lucky enough (and monitoring systems are very persistent) they'll eventually hit a redirect, which will cause Nginx to cache that redirect and serve it to regular visitors requesting the same cache key, i.e. an infinite redirect loop for the duration of the cache.

Example:

$ curl -v https://example.org/ -H "Host: example.org:443" -o /dev/null
Location: https://example.org/
X-Cache: MISS

$ curl -v https://example.org/ -H "Host: example.org" -o /dev/null
Location: https://example.org/
X-Cache: HIT

This is a bit of an edge case because the :443 hit must arrive during a time where the cache is missing or has expired. But when it happens it's very hard to catch and debug.

The workaround is to use $http_host in the cache key instead, which is the original value of the Host header.

I can see $host is used on the kit configuration in key. Is it alright?

Thanks a lot for the clarification!

Regards

Only the index is cached, any other page are BYPASSED

Hello,

I followed your tutorial to setup fast-cgi caching, and right now the

if ($query_string != "") {
       set $skip_cache 1;
}

test makes caching to always fails for anything but the index.

The reason seems to be that when a post is loaded, the $query_string contains the path of the post q=/2018/07/28/never-cached/& (I use a header to see that:
add_header X-query-string "$query_string";)

Thus, the page always return "BYPASS".

I am not sure how one could discriminate what should be cached in that case. Any idea?

404 on non-default permalinks

need to add this in order to work with '%postname%.html' as permalink.

if (!-e $request_filename) {
    rewrite ^.*$ /index.php last;
}

WP JSON

You should update to not cache URLs that lead to /wp-json

if ($request_uri ~* "/wp-admin/|/wp-json/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml") { set $skip_cache 1; }

Configuration test failed on security.conf

After using this for my nginx config structure and using multisite-subdomain.com as the structure for my enabled-site config I received a error message when testing the configuration:

# nginx -t
nginx: [emerg] invalid number of arguments in "add_header" directive in /etc/nginx/global/server/security.conf:8
nginx: configuration file /etc/nginx/nginx.conf test failed

I removed the inclution of the file in global/server/defaults.conf and was able to get error free test results.

I have not touched any of the configs when testing the setup other than the basics from the instructions found on deliciousbrains.com

Use multiple pools

This config works very well but if the server is running several websites it seems nicer to use separate PHP pools. (and a bit more secure).
With different pools it is easier to monitor memory use etc.
I was wondering if this could be implemented in this setup. Currently everything points to a global file.
Any hints?

Update:
Noticed some remarks in this setup about using different pools for different PHP version.
Can't really figure out how to use newly made pools.

My wishlist for an updated new article: (and big thank you for all the previous ones!)

  1. More about using pools, both for changing PHP version and for separating sites so monitoring eg memory becomes easier
  2. Memory tuning / time out tuning. I have spent a lot of time to get this working ok but love to hear some more opinions what to tweak in in all the possible locations.
  3. monit or other watchdog setups. How to make sure if the system stops, it restarts, reports, alerts. (why does this always happen in the middle of the night :-) )

Enable caching for webfonts

Hy Ashley,

I love this repository. Made a lot of our sites damn fast 👍

For one of our projects we are using webfonts like woff, woff2, eot or ttf files. So I added these extensions to the static-files.conf

When you allow pull requests I can create one otherwise here is the changed line:

location ~* .(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc|woff|woff2|eot|ttf)$ {

Best Christofer, keep up the good work!

using a cache plugin

Hello;

Thanks for this configuration, feel like kissing you lol. i have few questions please.

  1. I am using wp-rocket on wp-super cache for different sites what would be the configuration? wp-rocket has its own (i can get that via support)
  2. What is the rewrite run for sitemap plugin, i am not using the one included in yoast.

Thanks

502 bad gateway

HEY, Ashley

Been following your series and everything's been working out great up until I cloned this repo.

Now I'm getting a 502 Bad Gateway page on a site that was working before the change.

Did I miss something?

Add Yoast SEO Sitemap XML Support

Please add the following lines to a global file for Yoast XML Support:

rewrite /sitemap_index.xml$ /index.php?sitemap=1 last;
rewrite /([^/]+?)-sitemap([0-9]+)?.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;

security.conf headers are wiped out by static-files.conf for matched files

hey
I don't feel like kissing you but thanks again lol

Well, after many tries and reloads and investigations, I can tell you that there 2 issues with the current configuration:

  1. the security header for click-jacking and all the other headers in this files are wiped out by the Cache-control header in static-files.conf

  2. moreover, whatever header is declared before an image extension is matched by this static-files.conf location is wiped out.

I think it's an issue, because you lose the click-jacking protection, just for a cache control header.
On the other hand, how do you add this cache-control header just for images without a location?

I'm thinking of a possible workaround that would :

  1. Since you cannot include the server_tokens directive more than once, move this one in nginx.conf or create a global/security.conf?
  2. include server/security.conf in any locations that need a specific header

what do you think?

Please add a license file.

Copyright (c)

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

fast-cgi cach

I think the fast cgi cach is not working for me

when I enter this line

add header to make sure cach with hit or missed

add_header X-Cache $upstream_cache_status;

I dont see the header

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.