proper nginx configuration for Civi with perusio/drupal-with-nginx

[Sean Madsen]

I recently switched from Apache to nginx, and so far I'm pleased with the lower memory footprint. But when testing my site I failed to notice that the extern php files are not working. This means that, for example, sending a mailing that tracks click-through rates will yield 404 errors when users click on the links. Other CiviCRM functionality is likely affected too. For example, these php files all reside in the civicrm/extern/ directory and I can imagine they should be accessible: authorizeIPN.php googleNotify.php ipn.php open.php pxIPN.php rest.php soap.php url.php widget.php

These files produce 404 errors on my site after moving to nginx because, as recommended by the nginx documentation, I decided to use the "idiosyncratically crafted bleeding edge configuration" for running Drupal on nginx here: https://github.com/perusio/drupal-with-nginx

This configuration from perusio seems mostly pretty awesome, and it's designed to lock things down from a security perspective -- PHP files are not permitted to be executed by URL unless explicitly allowed. But, apparently this configuration is not CiviCRM-aware.

Has anyone else gone this route and succeeded in altering the nginx configuration to work well with CiviCRM? And how did you do it.

Currently there's an open issue on GitHub raising this same point: https://github.com/perusio/drupal-with-nginx/issues/129

[Sean Madsen]

Some success here...

Adding the following code inside my location / block in the apps/drupal/drupal.conf file got the extern files working

    ## allow CiviCRM php files
    location ~* ^/sites/.*/(?:modules)/(civicrm)/.*\.php$ {
        access_log     off;
        try_files $uri =404;
        fastcgi_pass   phpcgi;
    }

(And also, as recommended here, I made sure that /etc/php5/fpm/php.ini has cgi.fix_pathinfo=0 which was already the case for me by default.)

Similarly, inserting this code into apps/drupal/drupal.conf got Civi to stop complaining about directories being accessible publicly.

    ## Protect private CiviCRM files
    location ~* /(sites/default/)?files/civicrm/(upload|ConfigAndLog|custom)/ {
        internal;
    }


Crossing my fingers that there's nothing else broken...

[Sean Madsen]

Found one other broken thing -- some of CiviCRM's system workflow email messages generate ugly URLs which include "index.php?q=". The default nginx config gives 404 errors for these requests. Adding the following code to the location / block in the apps/drupal/drupal.conf file got these requests working again:

    ## Allow access to index.php directly in case ugly URLs are used
    location ~* /index\.php {
        try_files $uri =404;
        fastcgi_pass   phpcgi;
    }


I also started a separate thread to talk about this issue specifically because I think it would be preferable if CiviCRM generated clean URLs here.

[Aahar]

How has it been on NginX post the couple of issues you mentioned?

[Sean Madsen]

Going very well! I find nginx a bit trickier to configure, but overall it seems to perform better than apache.