Webcontrat - Serveurs Web

Les serveurs Webs terminaux tournent sous Nginx / php-fpm

Nginx

/etc/nginx/nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
 

events {
   worker_connections  8096;
   multi_accept        on;
   use                 epoll;
}

http {

 ##
 # Basic Settings
 ##
 
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;

# server_names_hash_bucket_size 64;
# server_name_in_redirect off;


include /etc/nginx/mime.types;
default_type application/octet-stream;

client_max_body_size 500M; # allows file uploads up to 500 megabytes

# Accepter les underscore dans les headers    
underscores_in_headers on;

#        real_ip_header $HTTP_X_FORWARDED_FOR;
#        set_real_ip_from 0.0.0.0;

##
# SSL Settings
##

ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;

##
# Logging Settings
##

## This log format makes it so we can see real requester's IP address \
##    not just the reverse proxy server's IP address. Also note, that \
##    "specialLog" can be replaced with any name you would like to \
##    give to this log format.
log_format specialLog '$remote_addr forwarded for $HTTP_X_FORWARDED_FOR - $HTTP_EPPN [$time_local]  '
                  '"$request" $status $body_bytes_sent '
                  '"$http_referer" "$http_user_agent"';



## On log vers un syslog
access_log syslog:server=10.30.0.200,tag=nginx_access specialLog;
error_log syslog:server=10.30.0.200,tag=nginx_error;

## On ne log pas en local pour ameliorer les perfs
#access_log /var/log/nginx/access.log specialLog;
#error_log /var/log/nginx/error.log;

##
# Gzip Settings
##

gzip on;
gzip_disable "msie6";

gzip_vary on;
gzip_min_length 10240;
gzip_proxied expired no-cache no-store private auth;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
 gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

##
# nginx-naxsi config
##
# Uncomment it if you installed nginx-naxsi
##

#include /etc/nginx/naxsi_core.rules;

##
# Virtual Host Configs
##

include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*; 
}

/etc/nginx/sites-available/site :

server {
listen 80;
listen [::]:80 ipv6only=on;

root /var/www/html/assiduNat;
       
server_name webcontrat;

location / {
index index.php;
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
# Uncomment to enable naxsi on this location
# include /etc/nginx/naxsi.rules;
proxy_read_timeout 300;
}

      location ~ \.php$ { 
       fastcgi_split_path_info ^(.+\.php)(/.+)$;
         # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini

         # With php5-fpm:
         fastcgi_pass unix:/var/run/php5-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         include fastcgi_params;
         # nous sommes derriere un proxy :
         fastcgi_param REMOTE_ADDR             $HTTP_X_FORWARDED_FOR;

       }

# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
location ~ /\.ht {
	deny all;
}

       ##
       # Cache
       ##

       location ~* \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
        access_log        off;
        log_not_found     off;
        expires           30d;
       }


############################################################################
## Administration :
############################################################################ 

       location /nginx_status {
         stub_status on;
         access_log   off;
         allow 193.49.133.2;
         allow 193.49.133.28;
         allow 193.49.132.60;
         allow 10.21.70.0/24;
         deny all;
       }

       location ~ ^/(status|ping)$ {
          access_log off;
          allow 127.0.0.1;
          allow 193.49.132.60;
          allow 193.49.133.2;
          allow 193.49.133.28;
          allow 10.21.70.0/24;
          deny all;
          
          include fastcgi_params;
          fastcgi_pass unix:/var/run/php5-fpm.sock;
          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

       }

}

Symfony

Attention, il faut régler finement les droits des répertoires cache et logs et que acl soit activé sur la partition (par defaut en ext4):

setfacl -R -m u:www-data:rwX -m u:cedric.masse:rwX app/cache app/logs
setfacl -dR -m u:www-data:rwX -m u:cedric.masse:rwX app/cache app/logs

PhpDocx

Attention, Nelly a modifié la lib, il faut prendre en compte ses modifs

 /usr/share/php/phpdocx-corporate.3.5/classes/CreateDocx.inc

La licence vérifie le domaine en fonction du nom donné au virtualhost, il faut donc des noms de virtualhosts terminant par .cnrs.fr