Reputation: 75
I am trying to achieve a chrooted PHP pool on my OpenBSD 7.5 machine (I have installed Wordpress, so I need it locked down as much as possible).
Using the following pool config produces no errors and I can see it running fine with ps aux
.
The issue is that nginx just can't see the socket. I have checked the permissions and ownership, and it's definitely created under the www
user (which is what we want!).
Does the following configurations look bad, anyone?
/etc/php-fpm.d/mywebsite.com.conf
[mywebsite.com]
user = www
group = www
listen = /var/www/html/mywebsite.com/run/sock
listen.owner = www
listen.group = www
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
chroot = /var/www/html/mywebsite.com
php_admin_value[error_log] = /var/log/php-fpm/mywebsite.com.log
Now here's my Nginx conf. I can't see what my mistake is here, but there has to be one:
server {
listen 443 ssl http2;
server_name mywebsite.com www.mywebsite.com;
ssl_certificate /etc/ssl/mywebsite.com.fullchain.pem;
ssl_certificate_key /etc/ssl/private/mywebsite.com.key;
access_log /var/www/html/mywebsite.com/logs/access.log;
error_log /var/www/html/mywebsite.com/logs/error.log;
root /var/www/html/mywebsite.com/public;
index index.php;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ^~ /.well-known/acme-challenge/ {
alias /var/www/acme/;
try_files $uri =404;
}
location ~* ^/phpmyadmin(?<pmauri>/.*)?$ {
alias /var/www/html/mywebsite.com/phpmyadmin/;
index index.php;
try_files $pmauri $pmauri/ =404;
location ~ \.php$ {
include /etc/nginx/fastcgi_params;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$pmauri;
fastcgi_pass unix:run/sock;
}
}
location ~ \.php$ {
try_files \$uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:run/sock;
fastcgi_index index.php;
include /etc/nginx/fastcgi_params;
}
# Prevent access to certain file extensions
location ~\.(ini|log|conf|swp|save|bak)$ {
deny all;
}
# Deny access to hidden files and directories
location ~ /\. {
deny all;
}
}
server {
listen 80;
server_name mywebsite.com www.mywebsite.com;
return 301 https://mywebsite.com$request_uri;
}
Here's other configs...
fastcgi_params:
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REQUEST_SCHEME $scheme;
fastcgi_param HTTPS $https if_not_empty;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param REMOTE_USER $remote_user;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param REDIRECT_STATUS 200;
Upvotes: 0
Views: 56