Makoto

yum install nginx

apt-get update
apt-get install nginx

user  nginx nginx;
pid   /var/run/nginx.pid;
worker_processes  auto;
worker_priority   -10;


events {
    worker_connections  1024;
}


http {

    ##
    # Basic Settings
    ##
    default_type        application/octet-stream;
    keepalive_timeout   30;

    sendfile        on;
    tcp_nodelay     on;
    tcp_nopush      on;

    ##
    # Logging Settings
    ##
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  /var/log/nginx/access.log   main;
    access_log  off;
    error_log   /var/log/nginx/error.log    error;

    ##
    # Gzip Settings
    ##
    gzip on;
    gzip_disable "msie6";

    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Configuration Includes
    ##
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

}

$ ln -vs /etc/nginx/sites-available/example.org/root.conf /etc/nginx/sites-enabled/example.org
$ ln -vs /etc/nginx/sites-available/example.org/foo.conf /etc/nginx/sites-enabled/foo.example.org

$ ls -l /etc/nginx/sites-enabled/
lrwxrwxrwx. 1 root nginx 44 Dec 20 11:23 example.org -> /etc/nginx/sites-available/example.org/root.conf
lrwxrwxrwx. 1 root nginx 44 Dec 20 11:23 foo.example.org -> /etc/nginx/sites-available/example.org/foo.conf
$ rm -i /etc/nginx/sites-enabled/foo.example.org
rm: remove symbolic link `/etc/nginx/sites-enabled/foo.example.org'? y

cd /etc/nginx/
wget https://github.com/FujiMakoto/nginx-helpers/releases/download/v0.1/scripts.tar.gz
tar -xzvf scripts.tar.gz
rm -f scripts.tar.gz
/etc/nginx/scripts/provision

mkdir /etc/nginx/sites-available/yourdomain.com

upstream php_backend {
    server  unix:/var/run/php-fpm_webapp.sock;
}


server {

    # Basic server configuration
    listen       80;
    server_name  yourdomain.com www.yourdomain.com;
    root         /srv/http/yourdomain.com/root/html;
    index        index.php;

    # Maximum allowed upload size
    client_max_body_size 100M;

    # Logging
    #access_log  /srv/http/yourdomain.com/root/logs/access.log.gz combined gzip flush=5m;
    error_log   /srv/http/yourdomain.com/root/logs/error.log error;

    # Friendly URL "rewrite" rules
    location / {
        try_files   $uri $uri/ @ips;
    }

    # Configuration includes
    include /etc/nginx/includes/ips/protect_upload_directories;
    include /etc/nginx/includes/deny_dotfiles;
    include /etc/nginx/includes/stub_status;
    include /etc/nginx/includes/php_fpm_status;

    # Assign cache headers to static files
    location ~* ^.+\.(?:jpg|jpeg|gif|css|png|js|ico|xml|htm|swf|cur)$ {
        # If the static resource doesn't exist, pass off to IPS' 404 handler
        try_files   $uri @ips404;

        access_log  off;
        expires     2w;
    }

    # Lock down access to the AdminCP
    location ~ ^/admin/.+\.php$ {
        #allow         127.0.0.1;
        #deny          all;
        #auth_basic    "This page is restricted to administrators";
        #auth_basic_user_file $document_root/admin/.htpasswd;

        try_files   $uri @ips404;
        
        include         /etc/nginx/includes/php_fastcgi_params;
        fastcgi_pass    php_backend;
    }

    # Execute the requested PHP script if it exists, otherwise pass off to IPS
    location ~ \.php$ {
        try_files   $uri @ips;

        include             /etc/nginx/includes/php_fastcgi_params;
        fastcgi_pass        php_backend;

        fastcgi_buffers     38 4k;
        fastcgi_buffer_size 16k;
    }

    # Pass off not found errors to IPS' 404 handler
    location @ips404 {
        include             /etc/nginx/includes/php_fastcgi_params;
        fastcgi_pass        php_backend;

        fastcgi_param       SCRIPT_FILENAME  $document_root/404error.php;
        fastcgi_param       SCRIPT_NAME      404error.php;
    }

    # Send rewritten requests directly to IPS
    location @ips {
        include             /etc/nginx/includes/php_fastcgi_params;
        fastcgi_pass        php_backend;

        fastcgi_param       SCRIPT_FILENAME  $document_root/index.php;
        fastcgi_param       SCRIPT_NAME      /index.php;

        fastcgi_buffers     38 4k;
        fastcgi_buffer_size 16k;
    }

}

mkdir -p /srv/http
/etc/nginx/scripts/create yourdomain.com root

touch acl_test
setfacl -m "u:nginx:r--" acl_test
getfacl acl_test
rm acl_test

mount -o remount,acl /
tune2fs -o acl /dev/sdXY

/etc/nginx/scripts/fixperms yourdomain.com root

$ /etc/nginx/scripts/fixperms yourdomain.com root
What user do you want to grant file ownership to? webapp
What user does PHP-FPM run under for this virtual host? www-data
Which individual files/directories should PHP be granted write access to? conf_global.php
Which directories should PHP be granted recursive write access to? applications/ datastore/ plugins/ uploads/

Making sure all files and directories are owned by webapp
Setting directory permissions to 0750
Setting file permissions to 0640
Setting default permissions for new files
Granting Nginx user read-only access to all files and directories
Granting PHP-FPM user read-only access to all files and directories
Granting PHP-FPM user write access to conf_global.php
Granting PHP-FPM user recursive write access in applications/
Granting PHP-FPM user recursive write access in datastore/
Granting PHP-FPM user recursive write access in plugins/
Granting PHP-FPM user recursive write access in uploads/

All site permissions updated successfully

# Nginx
setfacl -R -m "u:nginx:r-X" /srv/http/yourdomain.com/root
setfacl -R -d -m "u:nginx:r-X" /srv/http/yourdomain.com/root

# PHP-FPM
setfacl -R -m "u:www-data:r-X" /srv/http/yourdomain.com/root
setfacl -R -d -m "u:www-data:r-X" /srv/http/yourdomain.com/root

# Make a file writable
setfacl -m "u:www-data:rw-" conf_global.php

# Make a file read-only
setfacl -m "u:www-data:r--" conf_global.php

# Recusrively make a directory and its contents writable
setfacl -R -m "u:www-data:rwX" uploads/
setfacl -R -d -m "u:www-data:rwX" uploads/

# Recursively make a directory and its contents read-only
setfacl -R -m "u:www-data:r-X" uploads/
setfacl -R -d -m "u:www-data:r-X" uploads/

For a good general overview of the acl utility commands and how they work, check out the Arch Wiki and Debian / CentOS documentation pages. For a more in-depth understanding of how setfacl works, read the manpages.

Finally, it's time to install and configure PHP-FPM. Go ahead and install the required packages now,

CentOS 7

yum install php-fpm php-cli php-mysqlnd php-pdo php-gd php-mbstring php-xml

# Only required if you use Imagick (which I recommend using over GD)
yum install php-devel php-pear ImageMagick*
pecl install Imagick
echo "extension=imagick.so" > /etc/php.d/imagick.ini

Debian / Ubuntu

apt-get update
apt-get install php5-fpm php5-cli php5-mysqlnd php5-curl php5-gd php5-imagick php5-json php5-mcrypt

Afterwards, go ahead and delete the default PHP-FPM pool, as we will be replacing it with our own,

CentOS 7

rm /etc/php-fpm.d/www.conf
nano /etc/php-fpm.d/webapp.conf

Debian / Ubuntu

rm /etc/php5/fpm/pool.d/www.conf
nano /etc/php5/fpm/pool.d/webapp.conf

Inside of this file, insert the following configuration template,

[webapp]

;;;;;;;;;;;;;;;;;;;;;
; FPM Configuration ;
;;;;;;;;;;;;;;;;;;;;;

; Basic settings
prefix = /var/run
user = www-data
group = www-data
listen = php-fpm_webapp.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660

; Process manager configuration
pm = dynamic
pm.max_children = 8
pm.start_servers = 2
pm.min_spare_servers = 2
pm.max_spare_servers = 4
pm.max_requests = 500
pm.status_path = /php_fpm_status

; Log slow requests (used for performance tuning, 0 = Off)
request_slowlog_timeout = 0
slowlog = /srv/http/yourdomain.com/root/logs/php_slow.log

; Terminate unresponsive requests, this should match PHP's max_execution_timeout at a minimum
request_terminate_timeout = 30s

; Don't allow executing arbitrary files as PHP scripts. YOU SHOULD NEVER DISABLE THIS.
security.limit_extensions = .php


;;;;;;;;;;;;;;;;;;;;;
; PHP Configuration ;
;;;;;;;;;;;;;;;;;;;;;

; Make sure errors are not displayed publicly, error logging can be enabled as needed
php_flag[display_errors] = off
php_admin_flag[log_errors] = off
php_admin_value[error_log] = /srv/http/yourdomain.com/root/logs/php_error.log

; Set the maximum upload size, memory limit and execution timeout
php_admin_value[upload_max_filesize] = 100M
php_admin_value[post_max_size] = 100M
php_admin_value[memory_limit] = 128M
php_admin_value[max_execution_time] = 30

; PHP security directives, adjust open_basedir appropriately
php_admin_value[cgi.fix_pathinfo] = 0
php_admin_value[disable_functions] = exec,system,popen,proc_open,shell_exec
php_admin_value[open_basedir] = /tmp/:/usr/bin/:/srv/http/yourdomain.com/root/html/

As usual, go ahead and replace all references to yourdomain.com accordingly. If you allow uploads larger than 100M, you'll also want to tweak the upload_max_filesize and post_max_size PHP values.

The main thing we want to look at here is the process manager configuration. There are three ways you can configure the process manager; static, dynamic, and ondemand. You can use whichever makes the most sense to you, but you'll likely be needing to watch and tune these settings a bit no matter which you choose, so there's no harm in experimenting with different configurations.

Regardless of which you use, it's very important you don't try and set pm.max_children to a higher value than your server can handle. In the brief amount of profiling I could perform on IPS4 prior to writing this guide, my tests indicated that the average pool memory consumption for a mostly stock IPS install was around 32M per process. With the above configuration, this means that with all 8 children in use, PHP would be utilizing approximately 256M of memory.

So, when tuning this value, you need to factor in how much memory you have know you can dedicate entirely to PHP. In the above example, you would need to dedicate at least 256MB to PHP with a bit of margin for error. This is what you should be doing for everything on your server. Also consider that 32M is only an example, the actual average memory requirement will vary from setup to setup, so it would be a good idea to do a bit of profiling yourself.

As a final note, even if you have massive amounts of memory on hand, you still shouldn't set this value absurdly high. It can do more harm than good. Memory restrictions aside, a good starting value would probably be the number of cores your server has * 2. So, for a quad core server, 8 children would probably be a good starting point. If your community hosts a lot of attachments and handles a lot of PHP file transfers, you'll probably want to increase this value. Finding an optimal value here will take a bit of trial and error.

So, what about Static?

Good for very high traffic websites

Static is the PM configuration I used for a long time. It's dead simple. With static, you don't need to specify start_servers, min_spare_servers or max_spare_servers. You just provide a number of child processes to spawn and they are all immediately spawned and kept alive and ready to handle requests at any moments notice.

This sounds nice considering what I mentioned above. It offers better FPM performance, and since you're already dedicating that memory to PHP anyways, who cares if that memory is always in use?

While there is a bit of truth to that, I probably would not recommend static for most installations anymore. I consider static particularly good for high traffic websites, or websites that receive a lot of very heavy intermittent traffic spikes. For most low to moderate traffic communities, I am more likely to recommend dynamic, and I explain why in more detail below.

So, what about Dynamic?

Good for moderate and low traffic websites

Dynamic is probably the most common configuration. It's the middle ground between static and ondemand. With this setup, PHP always keeps a set number of child processes spawned and ready to handle incoming traffic. New child processes are spawned as traffic increases, old processes are destroyed as traffic lowers again. This is great for most web applications, as it avoids wasting memory.

While you still should always tune assuming all processes are in use, keeping the unused processes cleaned up gives more free memory to the server, which can in return be used for disk caching to improve overall server performance.

Dynamic also helps better protect against memory leaks. As unused processes are killed off, there's naturally less risk of memory leaks eating away at your memory pool. pm.max_requests normally helps protect against this, but it becomes less effective the more processes you keep spawned.

So, what about Ondemand?

Good for low traffic websites

As its name implies, ondemand only spawns child processes on demand. This is similar to dynamic, however unlike with dynamic, ondemand does not keep any unused child processes active. When a request is made that spawns a new child process, a timeout is set. If no further requests are sent to that process within the timeout window, the process is destroyed.

This could be beneficial for low traffic websites (particularly those on more memory constrained VPS'), but outside of that, there's probably not much of a reason to use it. Even for low traffic websites, keeping a small number of child processes spawned to handle new requests is usually good for performance.

Once you have PHP-FPM configured, it's finally time to test everything out. Go ahead and enable your new virtualhost now,

/etc/nginx/scripts/enable yourdomain.com root
systemctl restart {nginx,php-fpm}

Assuming no errors are returned, try and visit your community in your web browser. If all has gone well, you're done! If not, check your error logs, review your configuration, make sure permissions are properly applied, and make sure you have all the required PHP packages installed. If you still have problems, don't be afraid to ask for help, just be sure to provide a detailed description of your problem and include any relevant error log entries when doing so!

Did you find this guide useful? You can show your support by sending a small tip, or by buying and reviewing one of my marketplace submissions! If that's not an option for you, you can also just tell me I'm awesome or something.