Skip to content

nginx wordpress runbook

Jump to bottom
Severin FERRAND edited this page Oct 8, 2017 · 9 revisions

Overview

In this section I will explain how to setup and maintain Wordpress multi-site on Nginx 1.10.x the main requirement is to be able to create a wordpress subsite (with a subdomain) from wordpress admin without any modification on nginx configuration.

I have mainly followed the Nginx configuration reference from codex.wordpress.org but let me add a few comments.

Prerequisites

Configuration Files

  • /etc/nginx/
    • nginx.conf
    • conf.d/
      • php-fpm.conf
    • global/
      • wp-restrictions.conf
      • wp-multi-sf.conf
      • wp-single.conf
    • sites-available
    • sites-enabled

Main (generic) startup file

/etc/nginx/nginx.conf

  1. the first difference with the documentation from codex is that the php-fpm configuration is stored under /etc/nginx/conf.f/php-fpm.conf and included with:

include /etc/nginx/conf.d/*.conf;

  1. the second difference not in the document is about the maximum size for file upload. Working with WordPress often means to upload large image through the wp-admin. The default limit for file upload is 1 MB. I changed it to 8 MB which is generally big enough for most pictures.

client_max_body_size 8m;

php-fpm configuration

/etc/nginx/conf.f/php-fpm.conf

Global restrictions file

/etc/nginx/global/wp-restrictions.conf

General WordPress rules

/etc/nginx/global/wp-single.conf

if you don't need multisite, this would be enough. I put it just for reference

WordPress Multisite Subdirectory rules

we don't want this one because we want multisite with subdomains, not subdirectories.

WordPress Multisite subdomains rules

/etc/nginx/global/wp-multi-sf.conf

ok, this is the important one for my installation. It does contains complex rules documented in nginx recipes for WordPress. Feel free to read the explanations if you are interested.

fastcgi-params

/etc/nginx/fastcgi_params

HTTPS in Nginx (for my website chococlub.jp)

/etc/nginx/sites-available/chococlub.jp

##
# Root Site : HTTPS : chococlub.jp
##
server {

        listen   443; ## listen for ipv4; this line is default and implied
        #listen   [::]:443 default_server ipv6only=on; ## listen for ipv6

        # Get SSL setup
        ssl                 on;
        ssl_certificate     /etc/letsencrypt/live/chococlub.jp/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/chococlub.jp/privkey.pem;
	ssl_session_timeout 5m;
        ssl_session_cache         shared:SSL:50m;

 	# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
 	# Generate with:
 	#   openssl dhparam -out /etc/nginx/dhparam.pem 2048
	ssl_dhparam /etc/nginx/dhparam.pem;
        
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers	'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_prefer_server_ciphers on;

	# Enable HSTS ( see http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security ) (ngx_http_headers_module is required) (15768000 seconds = 6 months)
        add_header Strict-Transport-Security max-age=15768000;

        # OCSP Stapling
        ssl_stapling            on;
        ssl_stapling_verify     on;
        ssl_trusted_certificate /etc/letsencrypt/live/chococlub.jp/fullchain.pem;
        resolver                8.8.8.8;

	### NOW CONFIGURE YOUR SITE BELOW
        ...

}

I followed the recommendations from codex for the server section.

if you don't have SSL Certificates, I am explaining how to get SSL Certificate in letsencrypt-runbook

WP Super Cache Rules

not implemented

W3 Total Cache Rules

not implemented

Nginx fastcgi_cache

requires to compile nginx with fastcgi_cache_purge module. I initially did compule nginx with this module, so the config appears in my file. But when I updated nginx I just fetched it from jessie-backports repo so it does not contain the module, maybe some day we will be able to install module without recompilation of nginx...

##
# fastcgi_cache with fastcgi_cache_purge module
# https://easyengine.io/wordpress-nginx/tutorials/multisite/subdomains/fastcgi-cache-with-purging/
##
fastcgi_cache_path /var/run/nginx-cache levels=1:2 keys_zone=WORDPRESS:500m inactive=60m;
fastcgi_cache_key "$scheme$request_method$host$request_uri";
fastcgi_cache_use_stale error timeout invalid_header http_500;

Better Performance for Static Files in Multisite

this is an important part and will require WordPress plugin Nginx helper

you can see my configuration for my website:

/etc/nginx/sites-available/chococlub.jp

map $http_host $blogid {
    default 0;
    include /web/chococlub.jp/www/wp-content/uploads/nginx-helper/map.conf;
}

MySQL Database

The last step documented in the general WordPress documentation will be to create a MySQL database for the WordPress installation. It can be done through mysql command line on the server itself or if you like to add a few security risks, you can install phpmyadmin and do it from web ui.

See Also

References

Clone this wiki locally