Nginx+PHP-FPM secure server installation guide

[Sull5]

Guys you see this I'm seeing some really nice speed increases with pagespeed, I've been playing around with all the different filters, you can read about them here I think there was two that broke the site, deferring javascript pretty sure broke ProMenu and one other broke the mobile skin layout.

[Dmacleo]

grr I had to swap back to apache for the day while I narrow down something.

luckily I think I found the issue and can move back nginx in a bit.

not yet ready to go no control panel but I am learning as fast as I can.

then when ready do offsite backup, format, reinstall with no panel and not have to worry about some stupid stuff.

[Makoto]

If you need help, you'll need to post what the issue is in detail and include all relevant error logs.

[Dmacleo]

not nginx related really, I thought initially it was php-fpm but thats because the underlying issue was causing php-fpm cpu spike.

so think I have it fixed now, just need to swap back to nginx and try those parameters we discussed.

[Dmacleo]

yeah think I found the fpm issue. a deleted user was removed everywhere except a specific vhost file directadmin looks at.

[Makoto]

There was a typo made on line 7 of the example configuration. You may need to update your configurations to fix this typo if you haven't already noticed it yet.

   # Basic web server configuration.
    index        index.php

Should be..

   # Basic web server configuration.
    index        index.php;

It's just missing a semicolon after index.php

[Luis Manson]

did you note any improvement with dynamic/ondemand fpm?

[Makoto]

You won't have any improvement using dynamic/ondemand over static. Static is the best option for web servers designated to serving a single or group of web applications from a single FPM pool. Static designates a set number of FPM pools to spawn and keeps them spawned at all times. That means every single time someone connects to your website, you'll have a set number of pools spawned and ready to serve them, there will never be any need to spawn a new pool for the user.

Dynamic can be a viable option for web servers processing multiple websites all with their own FPM pools.

Ondemand can be a viable option when you have a very large number of low traffic websites all being processed from their own FPM pools. You probably don't want this. With dynamic you will at least always have a set number of minimum pools spawned.

[yacenty]

do You see any performance boost upgrading from nginx 1.0 to 1.4?

any boost after enabling pagespeed?

I have pure web server without any panel like cpanel, da or something similiar

[Sull5]

do You see any performance boost upgrading from nginx 1.0 to 1.4?

any boost after enabling pagespeed?

I have pure web server without any panel like cpanel, da or something similiar

I noticed a boost upgrading from nginx 1.2.7 to 1.4 and building with pagespeed I've noticed another boost yes :)

[yacenty]

any results in % of lower load or page generating time?

[Makoto]

If you're using Debian Wheezy (or upgrading to Wheezy), you should remove the DotDeb repositories from the instructions posted here and instead use the packages available from Debian directly now.

The easiest way to accomplish this when upgrading is to simply apt-get remove php5*

After that just remove DotDeb from your sources.list file. Once your upgrade is complete, re-install all of the PHP packages (including php5-fpm), but change php5-apc to php-apc.

[Dmacleo]

fwiw think I found what was causing my issues with php-fpm

pm.process_idle_timeout = 60

with static pm this was causing issues.

removed the line and all is good now.

on directadmin server custombuild 2 installs nginx using dynamic pm as default and that parameter is used with dynamic.

[yacenty]

Hi guys could You give some hint what is the best cachin option today for busy site?

25k uniq users daily, 300k pageviews, 200k pictures in gallery and over 1M posts

Just know we have nginx with php-fpm with xcache and memcached

[Makoto]

Don't use memcache unless you need it.

My vote is to opt for APC and increase the apc.shm_size a bit. (See post #11)

[yacenty]

why? in my case enabling memcache reduces load drastically

[Makoto]

why? in my case enabling memcache reduces load drastically

Memcached is a distributed caching system, whereas APC is non-distributed - and mainly an opcode cache.

If (and only if) you have a web application which has to live on different webservers (loadbalancing), you have to use memcache for distributed caching. If not, just stick to APC and its cache.

You should always use an opcode cache, which APC is (also APC will get integrated into php6 iirc, so why not start using it now).

You can/should use both for different purposes.

- Memcached vs APC which one should I choose?

[kase]

Hello and thanks for this topic.

"deny all" doesn't work when IPv6 is enabled. Instead something like

return 403;

should work. To confuse a script kiddy wich is accessing a file in /uploads/ you could also return a code about something completly wrong like 422 :rofl:

Also don't forget to say php-fpm that ssl is active. Otherwise the ACP will have an endless loop when "login over ssl" is active.

location ~ ^(.+?.php)(/.*)?$ {
                [...]
                fastcgi_param HTTPS on;
                [...]
        }

[mark2012]

First of all thank you very much for well-written tutorial Kirito. It helped me to made nginx server to work smooth.

Can i ask you please how did you managed to make Ip.content to work with this configuration or are you using this app ?

And because this topic is very useful, thought to contribute a bit too by posting the directives to make the SSL working properly for nginx. Im talking about log in system and store check out places :

# HTTPS server config directives for https://yourwebsite.com
#
server {
    listen <<IP ADDRESS>>:443;   
    server_name  yourwebsite.com;
    root /var/www/yourwebsite.com;

    ssl                  on;
    ssl_certificate      /etc/ssl/yourwebsite_com.crt;
    ssl_certificate_key  /etc/ssl/server.key;

    ssl_session_timeout  5m;

    ssl_protocols  SSLv2 SSLv3 TLSv1;
    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers   on;

    location / {
        index index.php;
        try_files $uri $uri/ /forum/index.php?q=$request_uri;
    }

    location ~ .php$ {
        try_files $uri =404;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include /etc/nginx/fastcgi_params;
    }
}

[Makoto]

Glad you found it useful.

If you have ".php" titled pages in your IP.Content app, you may need to include the "~^(/page/).*(.php)$" location in your configuration.

I do use IP.Content on my forums also.

[mark2012]

I checked now and all my pages are static but still cannot make them work even if i rebuild cache including furl cache.

I`m using /root for ip content and forum located in /forum :cry:

[mark2012]

I checked now and all my pages are static but still cannot make them work even if i rebuild cache including furl cache.

I`m using /root for ip content and forum located in /forum :cry:

Ok, I figure it out why articles and pages are not working was something from a missing directive.

This is part from my forum.conf file :

location / {
        try_files $uri $uri/ /forum/index.php?q=$request_uri;
    }

#    location /forum/ {
#        index index.php;
#        try_files $uri $uri/ /forum/index.php?q=$uri;
#    }

#    location /forum {
#        index index.php;
#        try_files $uri $uri/ /forum/index.php?q=$uri;
#    }

Adding bellow directive return duplicate error in shell.

location / {
        index  index.php index.html index.htm;
        try_files  $uri $uri/ /index.php;
 }

Also by replacing the #1 directive with the above one from board configuration file resolve the problem with pages and articles but mess up forums and sub-forums. All these issues just because i was using mod_write from ip content. Its very important to me to keep the created pages as they were at the begining because having some important messages there with lots of redirect from topics/sub-forums.

Any other ideas please ?

[mark2012]

Finally managed to fix the articles and pages.

For those who using mod_write and querry string and ip content on first page and forum located in /forum this is the properly configuration:

location / {
     try_files $uri $uri/ /index.php?$args;
    }

location /forum/ {
        index index.php;
        try_files $uri $uri/ /forum/index.php?q=$request_uri;

:thumbsup:

[Jason Sorenti]

Hello Kirito !

I've got some problem with nginx config. Can you help me ?

[Makoto]

Hello Kirito !

I've got some problem with nginx config. Can you help me ?

Ask away, or you're welcome to send me a private message if you want.