Resolved nginx as reverse proxy, just to clarify

[Giorgio1]

In the past I used only Apache so this is the first time I use nginx (as reverse proxy). Of course I started to study nginx and Apache + nginx but i would like to have some clarification / confirm. For example:

1) What to do about jails of fail2ban in general? I have for instance a jail for Wordpress login monitoring the apache log. If I use nginx as reverse proxy should I have to look into the nginx log files too?

2) If I understood correctly, all the .htaccess rules have to be translated for nginx and inserted in the page Apache & nginx Settings. Is it right? Or the .htaccess rules are still processed?

3) For a Wordpress websites, is better to use FPM or FastCGI served by Apache?

Thanks a lot for any help to understand the general situation!

 

[gbotica]

Hi,

I'm not 100% sure about my responses, but I'm sure someone will comment if I'm wrong. However, my understanding is as follows:

1. PHP is still processed by Apache (by default, Nginx only handles static files), so a WordPress Fail2Ban rule only needs to monitor Apache logs. For example, the 'plesk-wordpress' jail monitors logs: /var/www/vhosts/system/*/logs/*access*log. All the "plesk-" prefixed Jails should be set up by default to monitor the appropriate logs.

2. .htaccess files are still used, even when Nginx is reverse proxy.

3. My understanding is that FPM performs better than FAST-CGI

I hope that helps!

 

[Giorgio1]

Thanks gbotica for your clear answer! We will see if someone adds further details.

 

[Bitpalast]

but I'm sure someone will comment if I'm wrong.

Only to add that the answers are true if "PHP Apache FPM" is used. When you set it to "PHP Nginx FPM", PHP will run through Nginx, and in that case indeed the fail2ban rules won't work correctly, neither will .htaccess. But for most applications, it is best to just keep PHP Apache FPM.

 

[Sergio Manzi]

Only to add that the answers are true if "PHP Apache FPM" is used. When you set it to "PHP Nginx FPM", PHP will run through Nginx, and in that case indeed the fail2ban rules won't work correctly, neither will .htaccess. But for most applications, it is best to just keep PHP Apache FPM.

There is anyway a possible configuration that defies my logic:

• Proxy Mode
• Smart static files processing
• Serve static files directly by nginx
• PHP FPM served by nginx
• ... and maybe "Enable caching" too!!

What is Apache doing in above setup?

 

[Bitpalast]

As far as I remember it simply does not work correctly with a contradictive configuration.

 

[Sergio Manzi]

As far as I remember it simply does not work correctly with a contradictive configuration.

actually the above config is perfectly working (no cache involved, thus...)...