drupal_boost_escaped.conf (12895B)
1 # -*- mode: nginx; mode: flyspell-prog; ispell-local-dictionary: "american" -*- 2 ### Nginx configuration for using Boost with Drupal. This 3 ### configuration makes use of drush (http:///drupal.org/project/drush) 4 ### for site maintenance and like tasks: 5 ### 6 ### 1. Run the cronjobs. 7 ### 2. Run the DB and code updates: drush up or drush upc followed by 8 ### drush updb to run any DB updates required by the code upgrades 9 ### that were performed. 10 ### 3. Disabling of xmlrpc.xml, install.php (needed only for 11 ### installing the site) and update.php: all updates are now 12 ### handled through drush. 13 14 ## To avoid the ugly rewrite we use Lua to escape the URI. 15 set_by_lua $escaped_uri 'return ngx.escape_uri(ngx.var.uri)'; 16 17 ## The 'default' location. 18 location / { 19 20 ## Drupal 404 from can impact performance. If using a module like 21 ## search404 then 404's *have *to be handled by Drupal. Uncomment to 22 ## relay the handling of 404's to Drupal. 23 ## error_page 404 /index.php; 24 25 ## Using a nested location is the 'correct' way to use regexes. 26 27 ## Regular private file serving (i.e. handled by Drupal). 28 location ^~ /system/files/ { 29 ## Include the specific FastCGI configuration. This is for a 30 ## FCGI backend like php-cgi or php-fpm. 31 include apps/drupal/fastcgi_drupal.conf; 32 fastcgi_pass phpcgi; 33 34 ## If proxying to apache comment the two lines above and 35 ## uncomment the line below. 36 #proxy_pass http://phpapache/index.php?q=$escaped_uri; 37 #proxy_set_header Connection ''; 38 39 ## For not signaling a 404 in the error log whenever the 40 ## system/files directory is accessed add the line below. 41 ## Note that the 404 is the intended behavior. 42 log_not_found off; 43 } 44 45 ## Trying to access private files directly returns a 404. 46 location ^~ /sites/default/files/private/ { 47 internal; 48 } 49 50 ## Support for the file_force module 51 ## http://drupal.org/project/file_force. 52 location ^~ /system/files_force/ { 53 ## Include the specific FastCGI configuration. This is for a 54 ## FCGI backend like php-cgi or php-fpm. 55 include apps/drupal/fastcgi_drupal.conf; 56 fastcgi_pass phpcgi; 57 58 ## If proxying to apache comment the two lines above and 59 ## uncomment the line below. 60 #proxy_pass http://phpapache/index.php?q=$no_slash_uri; 61 #proxy_set_header Connection ''; 62 63 ## For not signaling a 404 in the error log whenever the 64 ## system/files directory is accessed add the line below. 65 ## Note that the 404 is the intended behavior. 66 log_not_found off; 67 } 68 69 ## If accessing an image generated by Drupal 6 imagecache, serve it 70 ## directly if available, if not relay the request to Drupal to (re)generate 71 ## the image. 72 location ~* /imagecache/ { 73 ## Image hotlinking protection. If you want hotlinking 74 ## protection for your images uncomment the following line. 75 #include apps/drupal/hotlinking_protection.conf; 76 77 access_log off; 78 expires 30d; 79 try_files $escaped_uri @drupal; 80 } 81 82 ## Drupal 7 generated image handling, i.e., imagecache in core. See: 83 ## http://drupal.org/node/371374. 84 location ~* /files/styles/ { 85 ## Image hotlinking protection. If you want hotlinking 86 ## protection for your images uncomment the following line. 87 #include apps/drupal/hotlinking_protection.conf; 88 89 access_log off; 90 expires 30d; 91 try_files $escaped_uri @drupal; 92 } 93 94 ## Advanced Aggregation module CSS 95 ## support. http://drupal.org/project/advagg. 96 location ^~ /sites/default/files/advagg_css/ { 97 expires max; 98 add_header ETag ''; 99 add_header Last-Modified 'Wed, 20 Jan 1988 04:20:42 GMT'; 100 add_header Accept-Ranges ''; 101 102 location ~* /sites/default/files/advagg_css/css[_[:alnum:]]+\.css$ { 103 access_log off; 104 try_files $escaped_uri @drupal; 105 } 106 } 107 108 ## Advanced Aggregation module JS 109 ## support. http://drupal.org/project/advagg. 110 location ^~ /sites/default/files/advagg_js/ { 111 add_header Pragma ''; 112 add_header Cache-Control 'public, max-age=946080000'; 113 add_header Accept-Ranges ''; 114 115 location ~* /sites/default/files/advagg_js/js[_[:alnum:]]+\.js$ { 116 access_log off; 117 try_files $escaped_uri @drupal; 118 } 119 } 120 121 ## All static files will be served directly. 122 location ~* ^.+\.(?:css|cur|js|jpe?g|gif|htc|ico|png|html|xml|otf|ttf|eot|woff|svg)$ { 123 access_log off; 124 expires 30d; 125 ## No need to bleed constant updates. Send the all shebang in one 126 ## fell swoop. 127 tcp_nodelay off; 128 } 129 130 ## PDFs and powerpoint files handling. 131 location ~* ^.+\.(?:pdf|pptx?)$ { 132 expires 30d; 133 ## No need to bleed constant updates. Send the all shebang in one 134 ## fell swoop. 135 tcp_nodelay off; 136 } 137 138 ## MP3 and Ogg/Vorbis files are served using AIO when supported. Your OS must support it. 139 location ^~ /sites/default/files/audio/mp3 { 140 location ~* ^/sites/default/files/audio/mp3/.*\.mp3$ { 141 directio 4k; # for XFS 142 ## If you're using ext3 or similar uncomment the line below and comment the above. 143 #directio 512; # for ext3 or similar (block alignments) 144 tcp_nopush off; 145 aio on; 146 output_buffers 1 2M; 147 } 148 } 149 150 location ^~ /sites/default/files/audio/ogg { 151 location ~* ^/sites/default/files/audio/ogg/.*\.ogg$ { 152 directio 4k; # for XFS 153 ## If you're using ext3 or similar uncomment the line below and comment the above. 154 #directio 512; # for ext3 or similar (block alignments) 155 tcp_nopush off; 156 aio on; 157 output_buffers 1 2M; 158 } 159 } 160 161 ## Pseudo streaming of FLV files: 162 ## http://wiki.nginx.org/HttpFlvStreamModule. 163 ## If pseudo streaming isn't working, try to comment 164 ## out in nginx.conf line with: 165 ## add_header X-Frame-Options SAMEORIGIN; 166 location ^~ /sites/default/files/video/flv { 167 location ~* ^/sites/default/files/video/flv/.*\.flv$ { 168 flv; 169 } 170 } 171 172 ## Pseudo streaming of H264/AAC files. This requires an Nginx 173 ## version greater or equal to 1.0.7 for the stable branch and 174 ## greater or equal to 1.1.3 for the development branch. 175 ## Cf. http://nginx.org/en/docs/http/ngx_http_mp4_module.html. 176 location ^~ /sites/default/files/video/mp4 { # videos 177 location ~* ^/sites/default/files/video/mp4/.*\.(?:mp4|mov)$ { 178 mp4; 179 mp4_buffer_size 1M; 180 mp4_max_buffer_size 5M; 181 } 182 } 183 184 location ^~ /sites/default/files/audio/m4a { # audios 185 location ~* ^/sites/default/files/audio/m4a/.*\.m4a$ { 186 mp4; 187 mp4_buffer_size 1M; 188 mp4_max_buffer_size 5M; 189 } 190 } 191 192 ## Advanced Help module makes each module provided README available. 193 location ^~ /help/ { 194 location ~* ^/help/[^/]*/README\.txt$ { 195 ## Include the specific FastCGI configuration. This is for a 196 ## FCGI backend like php-cgi or php-fpm. 197 include apps/drupal/fastcgi_drupal.conf; 198 fastcgi_pass phpcgi; 199 200 ## If proxying to apache comment the two lines above and 201 ## uncomment the line below. 202 #proxy_pass http://phpapache/index.php?q=$escaped_uri; 203 #proxy_set_header Connection ''; 204 } 205 } 206 207 ## Replicate the Apache <FilesMatch> directive of Drupal standard 208 ## .htaccess. Disable access to any code files. Return a 404 to curtail 209 ## information disclosure. Hide also the text files. 210 location ~* ^(?:.+\.(?:htaccess|make|txt|engine|inc|info|install|module|profile|po|pot|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ { 211 return 404; 212 } 213 214 ## First we try the URI and relay to the @cache if not found. 215 try_files $escaped_uri @cache; 216 } 217 218 ## We define a named location for the cache. 219 location @cache { 220 ## Boost compresses can the pages so we check it. Comment it out 221 ## if you don't have it enabled in Boost. 222 gzip_static on; 223 224 ## Error page handler for the case where $no_cache is 1. POST 225 ## request or authenticated. 226 error_page 418 = @drupal; 227 228 ## If $no_cache is 1 then it means that either we have a session 229 ## cookie or that the request method is POST. So serve the dynamic 230 ## page. 231 if ($no_cache) { 232 return 418; # I'm a teapot/I can't get no cachifaction 233 } 234 235 ## No caching for POST requests. 236 if ($request_method = POST) { 237 return 418; 238 } 239 240 # Now for some header tweaking. We use a date that differs 241 # from stock Drupal. Everyone seems to be using their 242 # birthdate. Why go against the grain? 243 add_header Expires "Tue, 13 Jun 1977 03:45:00 GMT"; 244 # We bypass all delays in the post-check and pre-check 245 # parameters of Cache-Control. Both set to 0. 246 add_header Cache-Control "must-revalidate, post-check=0, pre-check=0"; 247 # Funny...perhaps. Egocentric? Damn right!; 248 add_header X-Header "Boost Helás Avril 1.0"; 249 ## Boost doesn't set a charset. 250 charset utf-8; 251 252 # We try each boost URI in succession, if every one of them 253 # fails then relay to Drupal. 254 try_files /cache/normal/$host${uri}_${args}.html /cache/perm/$host${uri}_.css /cache/perm/$host${uri}_.js /cache/$host/0$escaped_uri.html /cache/$host/0${uri}/index.html @drupal; 255 } 256 257 ########### Security measures ########## 258 259 ## Uncomment the line below if you want to enable basic auth for 260 ## access to all /admin URIs. Note that this provides much better 261 ## protection if use HTTPS. Since it can easily be eavesdropped if you 262 ## use HTTP. 263 #include apps/drupal/admin_basic_auth.conf; 264 265 ## Restrict access to the strictly necessary PHP files. Reducing the 266 ## scope for exploits. Handling of PHP code and the Drupal event loop. 267 location @drupal { 268 ## Include the FastCGI config. 269 include apps/drupal/fastcgi_drupal.conf; 270 fastcgi_pass phpcgi; 271 272 ## FCGI microcache for authenticated users also. 273 include apps/drupal/microcache_fcgi_auth.conf; 274 275 ## To use Apache for serving PHP uncomment the line bellow and 276 ## comment out the above. 277 #proxy_pass http://phpapache/index.php?q=$escaped_uri&$args; 278 #proxy_set_header Connection ''; 279 ## Proxy microcache for authenticated users also. 280 #include apps/drupal/microcache_proxy_auth.conf; 281 282 ## Filefield Upload progress 283 ## http://drupal.org/project/filefield_nginx_progress support 284 ## through the NginxUploadProgress modules. 285 track_uploads uploads 60s; 286 } 287 288 location @drupal-no-args { 289 ## Include the specific FastCGI configuration. This is for a 290 ## FCGI backend like php-cgi or php-fpm. 291 include apps/drupal/fastcgi_no_args_drupal.conf; 292 fastcgi_pass phpcgi; 293 294 ## FCGI microcache for authenticated users also. 295 include apps/drupal/microcache_fcgi_auth.conf; 296 297 ## If proxying to apache comment the two lines above and 298 ## uncomment the line below. 299 #proxy_pass http://phpapache/index.php?q=$escaped_uri; 300 #proxy_set_header Connection ''; 301 302 ## Proxy microcache for authenticated users also. 303 #include apps/drupal/microcache_proxy_auth.conf; 304 } 305 306 ## Disallow access to .bzr, .git, .hg, .svn, .cvs directories: return 307 ## 404 as not to disclose information. 308 location ^~ /.bzr { 309 return 404; 310 } 311 312 location ^~ /.git { 313 return 404; 314 } 315 316 location ^~ /.hg { 317 return 404; 318 } 319 320 location ^~ /.svn { 321 return 404; 322 } 323 324 location ^~ /.cvs { 325 return 404; 326 } 327 328 ## Disallow access to patches directory. 329 location ^~ /patches { 330 return 404; 331 } 332 333 ## Disallow access to drush backup directory. 334 location ^~ /backup { 335 return 404; 336 } 337 338 ## Disable access logs for robots.txt. 339 location = /robots.txt { 340 access_log off; 341 ## Add support for the robotstxt module 342 ## http://drupal.org/project/robotstxt. 343 try_files $uri @drupal-no-args; 344 } 345 346 ## RSS feed support. 347 location = /rss.xml { 348 try_files $escaped_uri @drupal-no-args; 349 } 350 351 ## XML Sitemap support. 352 location = /sitemap.xml { 353 try_files $escaped_uri @drupal-no-args; 354 } 355 356 ## Support for favicon. Return an 1x1 transparent GIF if it doesn't 357 ## exist. 358 location = /favicon.ico { 359 expires 30d; 360 try_files /favicon.ico @empty; 361 } 362 363 ## Return an in memory 1x1 transparent GIF. 364 location @empty { 365 expires 30d; 366 empty_gif; 367 } 368 369 ## Any other attempt to access PHP files returns a 404. 370 location ~* ^.+\.php$ { 371 return 404; 372 } 373 374 ## Boost stats. 375 location = /boost_stats.php { 376 fastcgi_pass phpcgi; 377 ## To use Apache for serving PHP uncomment the line bellow and 378 ## comment out the above. 379 #proxy_pass http://phpapache; 380 #proxy_set_header Connection ''; 381 } 382