Nginx: Difference between revisions

Latest revision as of 14:23, 17 February 2018

Nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server, written by Igor Sysoev. The nginx project started with a strong focus on high concurrency, high performance and low memory usage. It is licensed under the 2-clause BSD-like license and it runs on Linux, BSD variants, Mac OS X, Solaris, AIX, HP-UX, as well as on other *nix flavours. It also has a proof of concept port for Microsoft Windows.

The following is community-contributed documentation on Nginx configuration. Amendments and additions are welcome.

Nginx configuration

PHP-FPM

Nginx is usually configured to interface with PHP via php-fpm. This is both fast and robust.

PHP-FPM's default behaviour for pools is usually to restrict the execution of scripts to a specific extension, i.e. .php. You should ensure that this behaviour is configured within your particular package/distribution, e.g. for debian,

/etc/php5/fpm/pool.d/www.conf

security.limit_extensions = .php

Nginx

Add the following 'slash arguments' compatible 'location' block to your vhosts 'server' in your nginx configuration (further explanation at 'Using slash arguments').

nginx.conf location:

location ~ [^/]\.php(/|$) {
    fastcgi_split_path_info  ^(.+\.php)(/.+)$;
    fastcgi_index            index.php;
    fastcgi_pass             127.0.0.1:9000 (or your php-fpm socket);
    include                  fastcgi_params;
    fastcgi_param   PATH_INFO       $fastcgi_path_info;
    fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

If you find that this does not work (scripts, styles, and images not loading) and that there are open() "..." failed (20: Not a directory) lines appearing in your logs: Check whether there are any directives related to static content before this block and try moving them after this block.

XSendfile aka X-Accel-Redirect

Setting Moodle and Nginx to use XSendfile functionality is a big win as it frees PHP from delivering files allowing Nginx to do what it does best, i.e. deliver files.

Enable xsendfile for Nginx in Moodles config.php, this is documented in the config-dist.php, a minimal configuration look like this,

$CFG->xsendfile = 'X-Accel-Redirect';
$CFG->xsendfilealiases = array(
    '/dataroot/' => $CFG->dataroot
);

Accompany this with a matching 'location' block in your nginx server configuration.

location /dataroot/ {
    internal;
    alias <full_moodledata_path>; # ensure the path ends with /
}

The definition of 'internal' here is critical as it prevents client access to your dataroot.

@@ Line 1: / Line 1: @@
-{{Installing Moodle}}[[Nginx]] [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server, written by Igor Sysoev. The nginx project started with a strong focus on high concurrency, high performance and low memory usage. It is licensed under the 2-clause BSD-like license and it runs on Linux, BSD variants, Mac OS X, Solaris, AIX, HP-UX, as well as on other *nix flavors. It also has a proof of concept port for Microsoft Windows.
+{{Installing Moodle}}[[Nginx]] [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server, written by Igor Sysoev. The nginx project started with a strong focus on high concurrency, high performance and low memory usage. It is licensed under the 2-clause BSD-like license and it runs on Linux, BSD variants, Mac OS X, Solaris, AIX, HP-UX, as well as on other *nix flavours. It also has a proof of concept port for Microsoft Windows.
-''The following is community-contributed documentation on Nginx configuration. Amendmends and additions are welcome.''
+''The following is community-contributed documentation on Nginx configuration. Amendments and additions are welcome.''
 == Nginx configuration ==
-=== FastCGI ===
+=== PHP-FPM ===
-<pre>
-fastcgi_param QUERY_STRING $query_string;
+Nginx is usually configured to interface with PHP via [http://php.net/manual/en/install.fpm.php php-fpm]. This is both fast and robust.
-fastcgi_param REQUEST_METHOD $request_method;
-fastcgi_param CONTENT_TYPE $content_type;
+PHP-FPM's default behaviour for pools is usually to restrict the execution of scripts to a specific extension, i.e. .php. You should ensure that this behaviour is configured within your particular package/distribution, e.g. for debian,
-fastcgi_param CONTENT_LENGTH $content_length;
-fastcgi_param SCRIPT_NAME $fastcgi_script_name;
+'''/etc/php5/fpm/pool.d/www.conf'''
-fastcgi_param REQUEST_URI $request_uri;
+ security.limit_extensions = .php
-fastcgi_param DOCUMENT_URI $document_uri;
-fastcgi_param DOCUMENT_ROOT $document_root;
-fastcgi_param SERVER_PROTOCOL $server_protocol;
-fastcgi_param GATEWAY_INTERFACE CGI/1.1;
+=== Nginx ===
-fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
-fastcgi_param REMOTE_ADDR $remote_addr;
+Add the following 'slash arguments' compatible 'location' block to your vhosts 'server' in your nginx configuration (further explanation at '[[Using slash arguments]]').
-fastcgi_param REMOTE_PORT $remote_port;
-fastcgi_param SERVER_ADDR $server_addr;
-fastcgi_param SERVER_PORT $server_port;
-fastcgi_param SERVER_NAME $server_name;
-# PHP only, required if PHP was built with --enable-force-cgi-redirect
+'''nginx.conf location:'''
-fastcgi_param REDIRECT_STATUS 200;
+<pre>
+location ~ [^/]\.php(/|$) {
+    fastcgi_split_path_info  ^(.+\.php)(/.+)$;
+    fastcgi_index            index.php;
+    fastcgi_pass            127.0.0.1:9000 (or your php-fpm socket);
+    include                  fastcgi_params;
+    fastcgi_param  PATH_INFO      $fastcgi_path_info;
+    fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
+}
 </pre>
-=== Slasharguments ===
-The function ''slash arguments'' is required for various features in Moodle to work correctly, as described in [[Using slash arguments]].
+If you find that this does not work (scripts, styles, and images not loading) '''and''' that there are <code>open() "..." failed (20: Not a directory)</code> lines appearing in your logs: Check whether there are any directives related to static content '''before''' this block and try moving them '''after''' this block.
-Slash arguments can be enabled by adding the following configuration to the nginx.conf:
+===== XSendfile aka X-Accel-Redirect =====
-'''nginx.conf location:'''
+Setting Moodle and Nginx to use XSendfile functionality is a big win as it frees PHP from delivering files allowing Nginx to do what it does best, i.e. deliver files.
+Enable xsendfile for Nginx in Moodles config.php, this is documented in the config-dist.php, a minimal configuration look like this,
+<pre>
+$CFG->xsendfile = 'X-Accel-Redirect';
+$CFG->xsendfilealiases = array(
+    '/dataroot/' => $CFG->dataroot
+);
+</pre>
+Accompany this with a matching 'location' block in your nginx server configuration.
 <pre>
-location ~ \.php(.*)$ {
+location /dataroot/ {
-include fastcgi_params;
+    internal;
-fastcgi_index index.php;
+    alias &lt;full_moodledata_path&gt;; # ensure the path ends with /
-if (!-e $request_filename) {
-rewrite ^(.*\.php)(/)(.*)$ $1?file=/$3 last;
-}
-fastcgi_param SCRIPT_FILENAME /var/moodle_www/html$fastcgi_script_name;
-fastcgi_pass 127.0.0.1:9000;
-fastcgi_read_timeout 250s;
 }
 </pre>
+The definition of 'internal' here is '''critical''' as it prevents client access to your dataroot.
 == See also ==
-* https://docs.moodle.org/dev/Install_Moodle_On_Ubuntu_with_Nginx/PHP-fpm
+* Real <tt>PATH_INFO</tt> support:
-* https://moodle.org/mod/forum/discuss.php?d=83445
+** https://moodle.org/mod/forum/discuss.php?d=278916
+** https://moodle.org/mod/forum/discuss.php?d=307388
+* '''[Deprecated]''' Internal rewriting to the HTTP GET <tt>file</tt> parameter:
+** https://moodle.org/mod/forum/discuss.php?d=83445
 [[Category:Installation]]
 [[es:Nginx]]

Documentation