Nginx + PHP (fpm) - Debian 10

Updated at: 03/10/2021

Di seguito alcuni passaggi per installare Nginx e php7.3 su Debian 10.

I comandi sono da intendersi come un promemoria e un eventuale punto di partenza da adattare di volta in volta alle necessità

sudo apt update
sudo apt install -y gnupg2
sudo mkdir -p /srv/sites/default
echo "Default website" | sudo tee /srv/sites/default/index.html

Nginx

echo "Installing nginx stable" && \
echo "deb http://nginx.org/packages/debian `lsb_release -cs` nginx" \ | sudo tee /etc/apt/sources.list.d/nginx.list && \
curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add - && \
sudo apt update && \
sudo apt install -y nginx && \
sudo systemctl start nginx.service && \
sudo systemctl enable nginx.service

PHP

echo "Installing php" && \
sudo apt install -y software-properties-common && \
wget -q https://packages.sury.org/php/apt.gpg -O- | sudo apt-key add - && \
echo "deb https://packages.sury.org/php/ `lsb_release -cs` main" | sudo tee /etc/apt/sources.list.d/php.list && \
sudo apt update && \
sudo apt -y dist-upgrade && \
sudo apt install -y php7.3-fpm && \
sudo apt -y autoremove && \
sudo apt install -y zip && \
sudo apt install -y php7.3-fpm php7.3-mysql php7.3-fileinfo php7.3-mbstring php7.3-xml php7.3-zip php7.3-gd php7.3-soap php7.3-calendar php7.3-curl

sudo apt install -y libxml2-dev libpng-dev libjpeg-dev libzip-dev && \
sudo apt install -y libmagickwand-dev --no-install-recommends && \
sudo apt install -y libcurl3-dev && \
sudo apt install -y libldap2-dev && \
sudo apt install -y pdftk && \
sudo apt install -y php7.3-imagick ghostscript-x poppler-utils

Composer

curl -sS https://getcomposer.org/installer | sudo php -- --install-dir=/usr/local/bin --filename=composer
sudo composer self-update --1

Configurazione base Nginx

sudo mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf.orig
sudo tee -a /etc/nginx/nginx.conf > /dev/null <<EOT
user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {

    client_max_body_size 50M;

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    server_tokens off;
    include /etc/nginx/conf.d/*.conf;
}
EOT

Generazione certificato self-signed (in produzione nel caso utilizzare let's encrypt o simili) e configurazione SSL

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

sudo tee -a /etc/ssl/cipherli.st.conf > /dev/null <<EOT
    ########################################################################
    # from https://cipherli.st/                                            #
    # and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html #
    ########################################################################

    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling off;
    ssl_stapling_verify off;
    resolver 1.1.1.1 8.8.8.8 valid=300s;
    resolver_timeout 5s;
    # Disable preloading HSTS for now.  You can use the commented out header line that includes
    # the "preload" directive if you understand the implications.
    #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;

    ##################################
    # END https://cipherli.st/ BLOCK #
    ##################################
EOT

sudo tee -a /etc/nginx/conf.d/ssl.conf > /dev/null <server {
    listen 443 http2 ssl;
    listen [::]:443 http2 ssl;

    # server_name server_IP_address;

    ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
    ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    include /etc/ssl/cipherli.st.conf;

    root /srv/sites/default;
    index index.html index.php;

    location / {
        try_files \$uri \$uri/ =404;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME \$realpath_root\$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_read_timeout 400;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }

    error_page 404 /404.html;
    location = /404.html {
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
    }

}
EOT

sudo nginx -t
sudo systemctl restart nginx

Una volta fatto ciò è possibile configurare i vari virtualhost creando il file opportuno (nome_sito.conf) nella cartella /etc/nginx/conf.d/

server {
    listen 80;
    index index.php index.html;

    server_name www.example.com;
    root /srv/sites/example/public;

    error_log  /var/log/nginx/example-error.log;
    access_log /var/log/nginx/example-access.log;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    charset utf-8;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_read_timeout 400;
    }

    # location ~ /\.(?!well-known).* {
    #     deny all;
    # }

    # return 301 https://$host$request_uri;
    # return 302 https://$host$request_uri;

}

server {
    listen 443 http2 ssl;
    listen [::]:443 http2 ssl;

    server_name www.example.com;

    ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
    ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    root /srv/sites/example/public;
    index index.html index.php;

    error_log  /var/log/nginx/example-error.log;
    access_log /var/log/nginx/example-access.log;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    charset utf-8;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    error_page 404 /index.php;

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_read_timeout 400;
    }

    # location ~ /\.(?!well-known).* {
    #     deny all;
    # }

}