Running Horde on nginx

nginx is a high performance webserver. Unlike Apache and lighttpd nginx need an external helper to execute php scripts.

nginx use the concept of include direcrories. You may find a file /etc/nginx/nginx.conf containig a statement

http {
    include                             conf.d/*;
    include                             sites-enabled/*;
}

That mean any file in /etc/nginx/sites-enabled/ will be used as configfile, too.
So I put my configuration in /etc/nginx/sites-enabled/horde.example.org.

server {
    # assume correct DNS settings
    # - horde.example.org = 192.0.2.1 and 2001:db8::1
    # - 1.2.0.192.in-addr.arpa. = horde.example.org
    # - 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa = horde.example.org
    listen                              192.0.2.1:443 ssl spdy;
    listen                              [2001:db8::1]:443 ssl spdy;
    server_name                         horde.example.org;

    # minimum ssl stuff
    ssl_certificate                     /etc/ssl/horde.example.org/cert+intermediate.pem;
    ssl_certificate_key                 /etc/ssl/horde.example.org/key.pem;

    # optional: see https://www.owasp.org/index.php/List_of_useful_HTTP_headers
    add_header                          strict-transport-security "max-age=31536000";
    add_header                          x-frame-options           "sameorigin";
    add_header                          x-xss-protection          "1; mode=block";
    add_header                          x-content-type-options    "nosniff";

    root                                /path/to/horde/;
    index                               index.php;

    location / {

        location ^~ /static/ {
            expires                     4w;
            add_header                  Cache-Control public;
        }

        location ^~ /themes/ {
            expires                     4w;
            add_header                  Cache-Control public;
        }

        location ^~ /services/ajax.php {
            fastcgi_split_path_info     ^(.+\.php)(/.+)$;
            fastcgi_pass                unix:/var/run/phpcgi/socket;
            include                     /etc/nginx/fastcgi.conf;
        }

        location ~ \.php {
            fastcgi_pass                unix:/var/run/phpcgi/socket;
            include                     /etc/nginx/fastcgi.conf;
        }

        try_files                       $uri $uri/ /rampage.php?$args;

    }
}

the file /etc/nginx/fastcgi.conf is included in default nginx installations.

The socket /var/run/phpcgi/socket is created by a separate php process.
The important thing: nginx must have write access to the socket. So it's best to run nginx and php with the same uid.

I like to run such processes supervised, aka not forking in background, by such script:

#!/bin/sh

exec < /dev/null
exec 2>&1

# still root now
# create the directory for the socket to allow the non-root user to create the socket
install -d -o www-run -g root -m 0700 /var/run/phpcgi/
rm -f /var/run/phpcgi/socket

cd /empty
exec env - setuidgid www-run /usr/bin/php5-cgi --bindpath /var/run/phpcgi/socket --no-chdir

setuidgid belong to a toolchain from djb. It simply switch to the given uid.

ATTENTION: this ist the first configuration published here. It's working but assumed to need optimitzation.