Skip to content

Commit 770fa0c

Browse files
pothipothi
committed
Version 3.1 - multiple small fixes and tiny improvements
1 parent 7127028 commit 770fa0c

File tree

9 files changed

+127
-11
lines changed

9 files changed

+127
-11
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ Tested with the following servers...
5252

5353
Test with the following Nginx versions...
5454
+ Stable verisons 1.12.x and 1.14.x
55-
+ Mainline versions 1.13.x
55+
+ Mainline versions 1.13.x, 1.15.x
5656

5757
For RPM based distros (Fedora, Redhat, CentOS and Amazon Linux AMI), the configuration mentioned in the repo should work. Additional steps may be needed, though. See below for some details!
5858

‎conf.d/common.conf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,13 @@ proxy_buffers 8 32k;
1010
proxy_buffer_size 64k;
1111
# -------------------------------------------------------------------
1212

13+
# for time-consuming operations (such as WP import or file upload)
14+
# https://nginx.org/r/fastcgi_read_timeout
15+
# default 60 seconds
16+
fastcgi_read_timeout 5m;
17+
18+
# -------------------------------------------------------------------
19+
1320
### To enable large uploads
1421
# Please make sure the corresponding PHP values are increased as well
1522
# post_max_size = 8M (default)

‎conf.d/ssl-common.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,5 @@ ssl_protocols TLSv1.1 TLSv1.2;
88
# directly from https://weakdh.org/sysadmin.html
99
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
1010

11-
# run "openssl dhparam -out /etc/nginx/dhparam.pem 4096" before uncommenting the following option
11+
# run "openssl dhparam -dsaparam -out /etc/nginx/dhparam.pem 4096" before uncommenting the following option
1212
# ssl_dhparam /etc/nginx/dhparam.pem;

‎globals/cache-enabler.conf‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# To improve the perf, we may use open_file_cache
2+
# ref: https://nginx.org/r/open_file_cache
3+
# open_file_cache max=1000;
4+
# open_file_cache_valid 60s;
5+
# open_file_cache_min_uses 2;
6+
# open_file_cache_errors off;
7+
8+
location / {
9+
# requires server support
10+
# gzip_static on;
11+
12+
error_page 418 = @cachemiss;
13+
error_page 419 = @mobileaccess;
14+
recursive_error_pages on;
15+
16+
# bypass POST requests
17+
if ($request_method = POST) { return 418; }
18+
19+
# uncommenting the following degrades the performance on certain sites. YMMV
20+
# if ($query_string != "") { return 418; }
21+
22+
# bypass cache for common query strings
23+
if ($arg_s != "") { return 418; } # search query
24+
if ($arg_p != "") { return 418; } # request a post / page by ID
25+
if ($arg_amp != "") { return 418; } # amp test
26+
if ($arg_preview = "true") { return 418; } # preview post / page
27+
if ($arg_ao_noptimize != "") { return 418; } # support for Autoptimize plugin
28+
29+
if ($http_cookie ~* "wordpress_logged_in_") { return 418; }
30+
if ($http_cookie ~* "comment_author_") { return 418; }
31+
if ($http_cookie ~* "wp_postpass_") { return 418; }
32+
33+
# if ($http_user_agent ~* "2.0\ MMP|240x320|400X240|AvantGo|BlackBerry|Blazer|Cellphone|Danger|DoCoMo|Elaine/3.0|EudoraWeb|Googlebot-Mobile|hiptop|IEMobile|KYOCERA/WX310K|LG/U990|MIDP-2.|MMEF20|MOT-V|NetFront|Newt|Nintendo\ Wii|Nitro|Nokia|Opera\ Mini|Palm|PlayStation\ Portable|portalmmm|Proxinet|ProxiNet|SHARP-TQ-GX10|SHG-i900|Small|SonyEricsson|Symbian\ OS|SymbianOS|TS21i-10|UP.Browser|UP.Link|webOS|Windows\ CE|WinWAP|YahooSeeker/M1A1-R2D2|iPhone|iPod|Android|BlackBerry9530|LG-TU915\ Obigo|LGE\ VX|webOS|Nokia5800|iPad") { return 419; }
34+
35+
# uncomment the following if deemed fit
36+
# if ($http_user_agent ~* "w3c\ |w3c-|acs-|alav|alca|amoi|audi|avan|benq|bird|blac|blaz|brew|cell|cldc|cmd-|dang|doco|eric|hipt|htc_|inno|ipaq|ipod|jigs|kddi|keji|leno|lg-c|lg-d|lg-g|lge-|lg/u|maui|maxo|midp|mits|mmef|mobi|mot-|moto|mwbp|nec-|newt|noki|palm|pana|pant|phil|play|port|prox|qwap|sage|sams|sany|sch-|sec-|send|seri|sgh-|shar|sie-|siem|smal|smar|sony|sph-|symb|t-mo|teli|tim-|tosh|tsm-|upg1|upsi|vk-v|voda|wap-|wapa|wapi|wapp|wapr|webc|winw|winw|xda\ |xda-|ipad") { return 419; }
37+
38+
try_files "/wp-content/cache/cache-enabler/$host${uri}index.html" $uri $uri/ /index.php$is_args$args;
39+
40+
#--> all the following would apply, only if the request hits the cache
41+
42+
add_header "X-Cache" "HIT - Cache Enabler";
43+
# include "globals/hsts.conf";
44+
45+
# expires modified 30m;
46+
expires 30m;
47+
add_header "Cache-Control" "must-revalidate";
48+
49+
# For proxies
50+
# add_header "Cache-Control" "s-maxage=3600";
51+
}
52+
53+
location @mobileaccess {
54+
# try_files $uri $uri/ /index.php$is_args$args;
55+
try_files "/wp-content/cache/supercache/$host${uri}index$https_suffix-mobile.html" $uri $uri/ /index.php$is_args$args;
56+
57+
add_header "X-Cache" "HIT - Mobile - Cache Enabler";
58+
# include "globals/hsts.conf";
59+
60+
# expires modified 30m;
61+
expires 30m;
62+
add_header "Cache-Control" "must-revalidate";
63+
64+
# For proxies
65+
# add_header "Cache-Control" "s-maxage=3600";
66+
}
67+
68+
location @cachemiss {
69+
try_files $uri $uri/ /index.php$is_args$args;
70+
}

‎globals/cloudflare.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# make sure you set up a cron to run update-cloudflare-ip-list.sh regularly
22

33
include '/etc/nginx/globals/cloudflare-ip-list.conf';
4+
5+
# use any of the following two options (but not both)
46
real_ip_header CF-Connecting-IP;
7+
# real_ip_header X-Forwarded-For;
8+
59
real_ip_recursive on;

‎sites-available/default.conf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,12 @@ server {
22
listen 80 default_server;
33
listen [::]:80 default_server;
44

5-
listen 443 ssl http2 default_server;
6-
listen [::]:443 ssl http2 default_server;
5+
# create dummy certificates, if you'd like to enable the following...
6+
# listen 443 ssl http2 default_server;
7+
# listen [::]:443 ssl http2 default_server;
8+
9+
# ssl_certificate "/etc/letsencrypt/live/example.com/fullchain.pem";
10+
# ssl_certificate_key "/etc/letsencrypt/live/example.com/privkey.pem";
711

812
# to catch all domains not hosted here!
913
server_name _;

‎sites-available/example.com.conf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@ server {
5858
### Enaable only one of the following lines
5959
include "globals/wp-super-cache.conf"; # WP Super Cache plugin support
6060
# include "globals/wp-rocket.conf"; # WP Rocket Cache plugin support
61-
# include "globals/wp-fastest-cache.conf"; # WP Rocket Cache plugin support
61+
# include "globals/wp-fastest-cache.conf"; # WP Fastest Cache plugin support
62+
# include "globals/cache-enabler.conf"; # Cache Enabler plugin support
6263
# location / { try_files $uri $uri/ /index.php$is_args$args; } # the plain-old method - suits Batcache
6364

6465
}

‎sites-available/pma.example.com.conf‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,25 @@
66
### Ref: http://serverfault.com/questions/246300/running-phpmyadmin-on-nginx-port-8080-passed-to-varnish-not-working-well
77
### Ref: http://sourceforge.net/tracker/index.php?func=detail&aid=1340187&group_id=23067&atid=377409
88

9+
# http => https
910
server {
1011
listen 80;
12+
listen [::]:80; # IPv6 support
1113
server_name pma.example.com;
12-
return 301 https://$host$request_uri;
14+
15+
# Replace the path with the actual path to WordPress core files
16+
root /home/username/sites/pma.example.com/public;
17+
18+
# for LetsEncrypt
19+
location ^~ /.well-known/acme-challenge {
20+
auth_basic off;
21+
try_files $uri =404;
22+
expires -1;
23+
}
24+
25+
location / {
26+
return 301 https://$host$request_uri;
27+
}
1328
}
1429

1530
server {
@@ -23,8 +38,8 @@ server {
2338
access_log /var/log/nginx/pma.example.com-access.log combined buffer=64k flush=5m if=$loggable; # $loggable is defined in conf.d/common.conf
2439
error_log /var/log/nginx/pma.example.com-error.log;
2540

26-
ssl_certificate "/etc/letsencrypt/live/example.com/fullchain.pem";
27-
ssl_certificate_key "/etc/letsencrypt/live/example.com/privkey.pem";
41+
ssl_certificate "/etc/letsencrypt/live/pma.example.com/fullchain.pem";
42+
ssl_certificate_key "/etc/letsencrypt/live/pma.example.com/privkey.pem";
2843

2944
include globals/restrictions.conf;
3045
include globals/assets.conf;

‎sites-available/ssl-example.com.conf‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,20 @@ server {
33
listen 80;
44
listen [::]:80; # IPv6 support
55
server_name example.com www.example.com;
6-
return 301 https://$host$request_uri;
6+
7+
# Replace the path with the actual path to WordPress core files
8+
root /home/username/sites/example.com/public;
9+
10+
# for LetsEncrypt
11+
location ^~ /.well-known/acme-challenge {
12+
auth_basic off;
13+
try_files $uri =404;
14+
expires -1;
15+
}
16+
17+
location / {
18+
return 301 https://$host$request_uri;
19+
}
720
}
821

922
# www.example.com => example.com (server-level)
@@ -29,7 +42,7 @@ server {
2942
index index.php;
3043

3144
# Replace the path with the actual path to WordPress core files
32-
root /home/username/sites/ssl-example.com/public;
45+
root /home/username/sites/example.com/public;
3346

3447
ssl_certificate "/etc/letsencrypt/live/example.com/fullchain.pem";
3548
ssl_certificate_key "/etc/letsencrypt/live/example.com/privkey.pem";
@@ -46,6 +59,7 @@ server {
4659

4760
include globals/restrictions.conf;
4861
include globals/assets.conf;
62+
include globals/auto-versioning-support.conf;
4963

5064
location ~ \.php$ {
5165
fastcgi_split_path_info ^(.+\.php)(/.*)$;
@@ -63,6 +77,7 @@ server {
6377
### Enaable only one of the following lines
6478
include "globals/wp-super-cache.conf"; # WP Super Cache plugin support
6579
# include "globals/wp-rocket.conf"; # WP Rocket Cache plugin support
66-
# include "globals/wp-fastest-cache.conf"; # WP Rocket Cache plugin support
80+
# include "globals/wp-fastest-cache.conf"; # WP Fastest Cache plugin support
81+
# include "globals/cache-enabler.conf"; # Cache Enabler plugin support
6782
# location / { try_files $uri $uri/ /index.php$is_args$args; } # the plain-old method - suits Batcache
6883
}

0 commit comments

Comments
 (0)