CyanMan2019
CyanMan2019

Reputation: 75

Problem with PHP-FPM chroot pools in conjunction with Nginx and OpenBSD 7.5

I am trying to achieve a chrooted PHP pool on my OpenBSD 7.5 machine (I have installed Wordpress, so I need it locked down as much as possible).

Using the following pool config produces no errors and I can see it running fine with ps aux.

The issue is that nginx just can't see the socket. I have checked the permissions and ownership, and it's definitely created under the www user (which is what we want!).

Does the following configurations look bad, anyone?

/etc/php-fpm.d/mywebsite.com.conf

[mywebsite.com]
user = www
group = www
listen = /var/www/html/mywebsite.com/run/sock
listen.owner = www
listen.group = www
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
chroot = /var/www/html/mywebsite.com
php_admin_value[error_log] = /var/log/php-fpm/mywebsite.com.log

Now here's my Nginx conf. I can't see what my mistake is here, but there has to be one:

server {
    listen 443 ssl http2;
    server_name mywebsite.com www.mywebsite.com;
    ssl_certificate /etc/ssl/mywebsite.com.fullchain.pem;
    ssl_certificate_key /etc/ssl/private/mywebsite.com.key;
    access_log /var/www/html/mywebsite.com/logs/access.log;
    error_log /var/www/html/mywebsite.com/logs/error.log;
    root /var/www/html/mywebsite.com/public;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ^~ /.well-known/acme-challenge/ {
        alias /var/www/acme/;
        try_files $uri =404;
    }

    location ~* ^/phpmyadmin(?<pmauri>/.*)?$ {

        alias /var/www/html/mywebsite.com/phpmyadmin/;
        index index.php;
        try_files $pmauri $pmauri/ =404;
        location ~ \.php$ {
            include /etc/nginx/fastcgi_params;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$pmauri;
            fastcgi_pass unix:run/sock;
        }
    }

    location ~ \.php$ {

        try_files \$uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:run/sock;
        fastcgi_index index.php;
        include /etc/nginx/fastcgi_params;

    }

    # Prevent access to certain file extensions
    location ~\.(ini|log|conf|swp|save|bak)$ {
        deny all;
    }

    # Deny access to hidden files and directories
    location ~ /\. {
        deny all;
    }
}

server {
    listen 80;
    server_name mywebsite.com www.mywebsite.com;
    return 301 https://mywebsite.com$request_uri;
}

Here's other configs...

fastcgi_params:

fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  REQUEST_SCHEME     $scheme;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  REMOTE_USER        $remote_user;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  REDIRECT_STATUS    200;

Upvotes: 0

Views: 56

Answers (0)

Related Questions