[http://nginx.org nginx] is a high performance webserver. Unlike Apache and lighttpd nginx need an external helper to execute php scripts.
nginx use the concept of include direcrories. You may find a file /etc/nginx/nginx.conf containig a statement
http {
include conf.d/;
include sites-enabled/;
}
That mean any file in /etc/nginx/sites-enabled/ will be used as configfile, too.
So I put my configuration in /etc/nginx/sites-enabled/horde.example.org.
server {
# assume correct DNS settings
# - horde.example.org = 192.0.2.1 and 2001:db8::1
# - 1.2.0.192.in-addr.arpa. = horde.example.org
# - 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa = horde.example.org
listen 192.0.2.1:443 ssl spdy;
listen [2001:db8::1]:443 ssl spdy;
server_name horde.example.org;
# minimum ssl stuff
ssl_certificate /etc/ssl/horde.example.org/cert+intermediate.pem;
ssl_certificate_key /etc/ssl/horde.example.org/key.pem;
# optional: see https://www.owasp.org/index.php/List_of_useful_HTTP_headers
add_header strict-transport-security "max-age=31536000";
add_header x-frame-options "sameorigin";
add_header x-xss-protection "1; mode=block";
add_header x-content-type-options "nosniff";
root /path/to/horde/;
index index.php;
location / {
location ^~ /static/ {
expires 4w;
add_header Cache-Control public;
}
location ^~ /themes/ {
expires 4w;
add_header Cache-Control public;
}
location ^~ /services/ajax.php {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/phpcgi/socket;
include /etc/nginx/fastcgi.conf;
}
location ~ \.php {
fastcgi_pass unix:/var/run/phpcgi/socket;
include /etc/nginx/fastcgi.conf;
}
try_files $uri $uri/ /rampage.php?$args;
}
}
the file /etc/nginx/fastcgi.conf is included in default nginx installations.
The socket {{/var/run/phpcgi/socket}} is created by a separate php process.
The important thing: nginx must have write access to the socket. So it's best to run nginx and php with the same uid.
I like to run such processes supervised, aka not forking in background, by such script:
#!/bin/sh
exec < /dev/null
exec 2>&1
still root now
create the directory for the socket to allow the non-root user to create the socket
install -d -o www-run -g root -m 0700 /var/run/phpcgi/
rm -f /var/run/phpcgi/socket
cd /empty
exec env - setuidgid www-run /usr/bin/php5-cgi --bindpath /var/run/phpcgi/socket --no-chdir
{{setuidgid}} belong to a toolchain from djb. [http://cr.yp.to/daemontools/setuidgid.html It simply switch to the given uid].
ATTENTION: this ist the first configuration published here. It's working but assumed to need optimitzation.