Facebook
Twitter
TimReeves
Regular Pleskian
Plesk Onyx, 17.0.17, Debian Jessie, vServer at Hetzner (KVM virtualisation)
NOTE July 2017 - some specifics here are now outdated, see my post from July 2017 below!
Some time ago I started the thread turn off Apache, and I'm pleased that this is now possible by deselecting "Proxy mode". But I have inspected the nginx config which Plesk generates in that case, and it is problematical for the way I need to use nginx and php-fpm. In PHP Settings I have selected "FPM application served by nginx". The config thus generated has the following problems:
For more clarification, here is the actual config, with my explanatory remarks:
NOTE July 2017 - some specifics here are now outdated, see my post from July 2017 below!
Some time ago I started the thread turn off Apache, and I'm pleased that this is now possible by deselecting "Proxy mode". But I have inspected the nginx config which Plesk generates in that case, and it is problematical for the way I need to use nginx and php-fpm. In PHP Settings I have selected "FPM application served by nginx". The config thus generated has the following problems:
- Bug: A block "location ^~ /plesk-site-preview/ {...}" is still generated even when turned off in the Plesk GUI: Tools & Settings | Website Preview | Disable Quick Preview
- Custom-PHP-Killer: If PHP Support is turned on for a domain - to get the pool entries - then Plesk generates a location statement to handle .php files: "location ~ \.php(/.*)?$ {...}". That regex location statement is exactly what I would normally use myself, and coming before anything I can add in my custom nginx file, it pre-empts anything I would do. BUT the statements inside the block, while fine as far as they go, do not go far enough for me:
(a) I really miss a "try_files" directive in there - without it, all the attack attempts which reference some URI in the hope of hitting something, get passed to PHP-FPM and logged by it. Since I am actively monitoring those logs, it is not only a waste of resources calling FPM, but also creates a lot of warnings from my log monitoring.
(b) Some applications (e.g. owncloud/nextcloud) need custom fastcgi params. I have no possibilty to add them when Plesk is grabbing the location.
(c) Sometimes we need to be careful about the order in which regex locations are defined, as the first one encountered which matches, wins. And thus we need control over the order anyway.
So as far as I see: Please add an option (checkbox) to suppress the ".php" location, e.g. "Suppress .php location in Plesk nginx config" with subtitle: "If you select this option, then you must include a similar location statement in your custom nginx config file to get php processing".
- Irritation: There seems to be no way to turn off output of the location for web users: "location ~ ^/~(.+?)(/.*?\.php)(/.*)?$ {...}". I would do it explicitly if there were a checkbox somewhere; even more elegant would be that Plesk notes that for a domain there ARE no web users defined and silently omits the location.
For more clarification, here is the actual config, with my explanatory remarks:
Code:
server {
listen {local-ip}:{port} [default_server] ssl http2;
# TR: SNI – Server Name Indication
server_name [sub.]{domain.tld}
server_name www.[sub.]{domain.tld}
server_name ipv{4|6}.[sub.]{domain.tld}
# TR: If with SSL certificate then 3 statements for the ssl_certificate
# TR: This is problematic; see https://kb.plesk.com/en/122689
# and https://talk.plesk.com/threads/client_max_body_size-duplicate-problem-still-exists.334148/
# It goes away if you put "nginxClientMaxBodySize =" (with empty value) in Plesk's panel.ini
client_max_body_size 128m;
root "/var/www/vhosts/{domain.tld}/httpdocs";
access_log "/var/www/vhosts/system/{domain.tld}/logs/proxy_access_ssl_log";
error_log "/var/www/vhosts/system/{domain.tld}/logs/proxy_error_log";
# TR: One SHOULD be able to get rid of this in Plesk GUI: Tools & Settings | Website Preview | Disable Quick Preview
# BUT it remains present )-: This is a bug, but only a minor irritation
location ^~ /plesk-site-preview/ {
proxy_pass http://127.0.0.1:8880;
proxy_set_header Host plesk-site-preview.local;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_cookie_domain plesk-site-preview.local $host;
access_log off;
}
# TR: This is added when "Hosting Settings | Preferred domain" is without "www."
if ($host ~* ^www.[sub.]{domain.tld}$) {
rewrite ^(.*)$ https://[sub.]{domain.tld}$1 permanent;
}
# TR: Web Users: I can't find any way to turn this off in general in Plesk GUI
# => It DOES disappear if you deselect "PHP support" in the domain's PHP Settings
location ~ ^/~(.+?)(/.*?\.php)(/.*)?$ {
alias /var/www/vhosts/{domain.tld}/web_users/$1/$2;
fastcgi_split_path_info ^((?U).+\.php)(/?.+)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass "unix:///var/www/vhosts/system/[sub.]{domain.tld}/php-fpm.sock";
include /etc/nginx/fastcgi.conf;
}
# TR: Catchall for .php files - send them straight to php-fpm via nginx
# => The regex itself and ensuing capture of PATH_INFO are fine (except regex is case-sensitive)
# => It correctly disappears if you deselect "PHP support" in the domain's PHP Settings
# PRE-EMPTS any own location for .php files ***
# We could get around this by NOT deselecting "Proxy mode" in Plesk - but then, Plesk will configure Apache...
# THIS HERE IS THE ONLY REAL PROBLEM: Missing "try_files" and possibility for custom (app-specific) fastcgi params
location ~ \.php(/.*)?$ {
fastcgi_split_path_info ^((?U).+\.php)(/?.+)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass "unix:///var/www/vhosts/system/[sub.]{domain.tld}/php-fpm.sock";
include /etc/nginx/fastcgi.conf;
}
# TR: We could configure PHP support and then switch it off - currently Plesk leaves the fpm pool active.
# But that solution would be dependent on Plesk retaining a strategy which I have loudly criticised...
# Another idea on that line would be to insert own php-fpm pools manually and turn off PHP support in Plesk,
# but that would mean that we double up the pools - our own plus those NOT cleaned up by Plesk. Unsavoury...
# TR: Blanket index statement for web-root - pre-empt with "location = /" to modify
# Although experiment shows that repeating the "location ~ /$" later also works
# => This also disappears if you deselect "PHP support" in the domain's PHP Settings
location ~ /$ {
index index.html index.cgi index.pl index.php index.xhtml index.htm index.shtml;
}
# TR: This is where - last of all - our custom config gets included
# Another solution would be for Plesk to include it near the top of this file, so that any "ours" pre-empts "theirs",
# leaving "theirs" active if we do not pre-empt it in our custom config. Then, we would have the option!
include "/var/www/vhosts/system/[sub.]{domain.tld}/conf/vhost_nginx.conf";
}
Last edited: