Rastapop : « Maintenant que nginx a dépassé Apache, je pense que tout logiciel web doit fournir la conf nginx aussi. »
recette Nginx
Copie d’archive de nginx.com/resources/wiki/start/topics/recipes/spip
server {
server_name emeagwali.net www.emeagwali.net;
client_max_body_size 10m;
root /var/www/spip;
index index.php;
location / {
# this is the usual way, but careful because all non-existing content will display home page with code 200
try_files $uri $uri/ /spip.php?$args;
# if you don't use rewriting (all internal links are already like spip.php?…), next line is enough
#try_files $uri $uri/;
}
location ~^/(tmp|config)/{
return 403;
}
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php ;
fastcgi_buffers 16 16k;
fastcgi_buffer_size 32k;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
location ~ /(tmp|config)/ {
deny all;
}
}
Avec les recommandations suivantes :
deny access to /tmp and /local
SPIP was (initialy) made to be used with Apache. So when you deploy a SPIP on a web server that don’t use .htaccess you must not permit visitors to access to tmp nor config (the database dumps are stored in /tmp so a visitor can discover admin password by a brut force attack).
Another way to prevent this kind of attack is:
- put these dir outside the spip root path
- redefine _DIR_TMP & _DIR_CONNECT constants in mes_options.php
fastcgi buffer
fastcgi_buffers and fastcgi_buffers_size is to prevent “upstream sent too big header while reading response header from upstream” error
Liens complémentaires
- recette :
https://github.com/nginxinc/nginx-wiki/blob/master/source/start/topics/recipes/spip.rst - configuration exemple (2019) :
https://www.nginx.com/resources/wiki/start/topics/recipes/spip/ - notes concernant la config utilisée sur seenthis.net :
https://github.com/seenthis/hebergement/wiki/Configuration-nginx - la config du site de William Piedfort :
https://discuter.spip.net/t/montees-en-systeme-trop-rapides/160238/7 - la redirection des .api :
https://discuter.spip.net/t/resolu-plugin-mastodon-et-serveur-nginx/187573/4.
server {
server_name mondomaine ; listen xx.xx.xxx.xxx;
# spécial à mon squelette
rewrite ^/groupe_mots(\d+).html$ /spip.php?page=groupe_mots&groupe=$1 last;
rewrite ^/sitemap\.xml$ /spip.php?page=sitemap.xml last;
}
# .well-known doit rester accessible pour Lets Encrypt
location ~ /\.well-known/acme-challenge {
allow all;
}
# On interdit l'accès aux dotfiles
location ~ /\. {
deny all; access_log off; log_not_found off;
}
# redirection des APIs
location ~ /(ecrire/)?([\w]+).api([/.](.*))$ {
rewrite ^/(ecrire/)?([\w]+).api([/.](.*))?$ /spip.php?action=api_$2&arg=$4 last;
}