Nginx Configuration for Drupal 7

Here is Drupal 7 server configuration for Nginx with letsencrypt SSL.

server {
    listen 443 ssl http2;
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem; # managed by Certbot
    server_name yourdomain.com www.yourdomain.com;
    root /home/yourdomain.com/html/;
    index index.php index.html index.htm;
    access_log /var/log/nginx/yourdomain.com.log;
    error_log /var/log/nginx/yourdomain.com-error.log;
    client_max_body_size 1000M;
    proxy_read_timeout 600s;
    fastcgi_read_timeout 600s;
    fastcgi_send_timeout 600s;

# Forbidden files or directories
    location ~ ^/(\.user.ini|\.htaccess|\.git|\.svn|\.project|\.env) {
        return 404;
    }

location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

# Very rarely should these ever be accessed outside of your lan
    location ~* \.(txt|log)$ {
        allow 192.168.0.0/16;
        deny all;
    }

location ~ \..*/.*\.php$ {
        return 403;
    }

location ~ ^/sites/.*/private/ {
        return 403;
    }

# Block access to scripts in site files directory
    location ~ ^/sites/[^/]+/files/.*\.php$ {
        deny all;
    }

# Allow "Well-Known URIs" as per RFC 5785
    location ~* ^/.well-known/ {
        allow all;
    }

# Block access to "hidden" files and directories whose names begin with a
    # period. This includes directories used by version control systems such
    # as Subversion or Git to store control files.
    location ~ (^|/)\. {
        return 403;
    }

location / {
        # try_files $uri @rewrite; # For Drupal <= 6
        try_files $uri /index.php?$query_string; # For Drupal >= 7
    }

location @rewrite {
        #rewrite ^/(.*)$ /index.php?q=$1; # For Drupal <= 6
        rewrite ^ /index.php; # For Drupal >= 7
    }

# Don't allow direct access to PHP files in the vendor directory.
    location ~ /vendor/.*\.php$ {
        deny all;
        return 404;
    }

# Protect files and directories from prying eyes.
    location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|/(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|/#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {
        deny all;
        return 404;
    }

# In Drupal 8, we must also match new paths where the '.php' appears in
    # the middle, such as update.php/selection. The rule we use is strict,
    # and only allows this pattern with the update.php front controller.
    # This allows legacy path aliases in the form of
    # blog/index.php/legacy-path to continue to route to Drupal nodes. If
    # you do not have any paths like that, then you might prefer to use a
    # laxer rule, such as:
    #   location ~ \.php(/|$) {
    # The laxer rule will continue to work if Drupal uses this new URL
    # pattern with front controllers other than update.php in a future
    # release.
    location ~ '\.php$|^/update.php' {
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        # Ensure the php file exists. Mitigates CVE-2019-11043
        try_files $fastcgi_script_name =404;
        # Security note: If you're running a version of PHP older than the
        # latest 5.3, you should have "cgi.fix_pathinfo = 0;" in php.ini.
        # See http://serverfault.com/q/627903/94922 for details.
        include fastcgi_params;
        # Block httpoxy attacks. See https://httpoxy.org/.
        fastcgi_param HTTP_PROXY "";
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_intercept_errors on;
        # PHP 5 socket location.
        #fastcgi_pass unix:/var/run/php5-fpm.sock;
        # PHP 7 socket location.
        fastcgi_pass unix:/run/php/php-fpm-USERNAME.sock;
    }

location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
        try_files $uri @rewrite;
        expires max;
        log_not_found off;
    }

# Fighting with Styles? This little gem is amazing.
    # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
    location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7
        try_files $uri @rewrite;
    }

# Handle private files through Drupal. Private file's path can come
    # with a language prefix.
    location ~ ^(/[a-z\-]+)?/system/files/ { # For Drupal >= 7
        try_files $uri /index.php?$query_string;
    }

# Enforce clean URLs
    # Removes index.php from urls like www.example.com/index.php/my-page --> www.example.com/my-page
    # Could be done with 301 for permanent or other redirect codes.
    if ($request_uri ~* "^(.*/)index\.php/(.*)") {
        return 307 $1$2;
    }

}

server {
    if ($host = yourdomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 404; # managed by Certbot
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

server {

listen 443 ssl http2;

ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem; # managed by Certbot

ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem; # managed by Certbot

server_name yourdomain.com www.yourdomain.com;

root /home/yourdomain.com/html/;

index index.php index.html index.htm;

access_log /var/log/nginx/yourdomain.com.log;

error_log /var/log/nginx/yourdomain.com-error.log;

client_max_body_size 1000M;

proxy_read_timeout 600s;

fastcgi_read_timeout 600s;

fastcgi_send_timeout 600s;

# Forbidden files or directories

location ~ ^/(\.user.ini|\.htaccess|\.git|\.svn|\.project|\.env) {

return 404;

}

location = /favicon.ico {

log_not_found off;

access_log off;

}

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

# Very rarely should these ever be accessed outside of your lan

location ~* \.(txt|log)$ {

allow 192.168.0.0/16;

deny all;

}

location ~ \..*/.*\.php$ {

return 403;

}

location ~ ^/sites/.*/private/ {

return 403;

}

# Block access to scripts in site files directory

location ~ ^/sites/[^/]+/files/.*\.php$ {

deny all;

}

# Allow "Well-Known URIs" as per RFC 5785

location ~* ^/.well-known/ {

allow all;

}

# Block access to "hidden" files and directories whose names begin with a

# period. This includes directories used by version control systems such

# as Subversion or Git to store control files.

location ~ (^|/)\. {

return 403;

}

location / {

# try_files $uri @rewrite; # For Drupal <= 6

try_files $uri /index.php?$query_string; # For Drupal >= 7

}

location @rewrite {

#rewrite ^/(.*)$ /index.php?q=$1; # For Drupal <= 6

rewrite ^ /index.php; # For Drupal >= 7

}

# Don't allow direct access to PHP files in the vendor directory.

location ~ /vendor/.*\.php$ {

deny all;

return 404;

}

# Protect files and directories from prying eyes.

location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|/(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|/#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {

deny all;

return 404;

}

# In Drupal 8, we must also match new paths where the '.php' appears in

# the middle, such as update.php/selection. The rule we use is strict,

# and only allows this pattern with the update.php front controller.

# This allows legacy path aliases in the form of

# blog/index.php/legacy-path to continue to route to Drupal nodes. If

# you do not have any paths like that, then you might prefer to use a

# laxer rule, such as:

# location ~ \.php(/|$) {

# The laxer rule will continue to work if Drupal uses this new URL

# pattern with front controllers other than update.php in a future

# release.

location ~ '\.php$|^/update.php' {

fastcgi_split_path_info ^(.+?\.php)(|/.*)$;

# Ensure the php file exists. Mitigates CVE-2019-11043

try_files $fastcgi_script_name =404;

# Security note: If you're running a version of PHP older than the

# latest 5.3, you should have "cgi.fix_pathinfo = 0;" in php.ini.

# See http://serverfault.com/q/627903/94922 for details.

include fastcgi_params;

# Block httpoxy attacks. See https://httpoxy.org/.

fastcgi_param HTTP_PROXY "";

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_param PATH_INFO $fastcgi_path_info;

fastcgi_param QUERY_STRING $query_string;

fastcgi_intercept_errors on;

# PHP 5 socket location.

#fastcgi_pass unix:/var/run/php5-fpm.sock;

# PHP 7 socket location.

fastcgi_pass unix:/run/php/php-fpm-USERNAME.sock;

}

location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {

try_files $uri @rewrite;

expires max;

log_not_found off;

}

# Fighting with Styles? This little gem is amazing.

# location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6

location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7

try_files $uri @rewrite;

}

# Handle private files through Drupal. Private file's path can come

# with a language prefix.

location ~ ^(/[a-z\-]+)?/system/files/ { # For Drupal >= 7

try_files $uri /index.php?$query_string;

}

# Enforce clean URLs

# Removes index.php from urls like www.example.com/index.php/my-page --> www.example.com/my-page

# Could be done with 301 for permanent or other redirect codes.

if ($request_uri ~* "^(.*/)index\.php/(.*)") {

return 307 $1$2;

}

server {

if ($host = yourdomain.com) {

return 301 https://$host$request_uri;

} # managed by Certbot

listen 80;

server_name yourdomain.com www.yourdomain.com;

return 404; # managed by Certbot

}

In the above config, replace

1	fastcgi_pass unix:/run/php/php-fpm-USERNAME.sock;

with the location of php-fpm socket on your server.

yourdomain.com with your actual domain name.

Leave a Reply Cancel reply