Thanks for clarifying @ericg.
I’m no expert, but I have been doing more and more nginx wrangling lately.
I have some time and lots of motivation. If I can find out how to fix the nginx config on my install, is that something you’d have time/interest in adding to the package?
I’m going to test some settings using the resources below, and will post here how I go.
UPDATE: Early search results
This post appears to describe the same nginx issue as the YNH processwire package has: Nginx directives for Processwire - General Support - ProcessWire Support Forums
These led me to…
Nginx sample config for Processwire 3.0
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name example.com;
root /home/forge/example.com/public;
index index.html index.htm index.php;
charset utf-8;
# -----------------------------------------------------------------------------------------------
# Access Restrictions: Protect ProcessWire system files
# -----------------------------------------------------------------------------------------------
# Block access to ProcessWire system files
location ~ \.(inc|info|module|sh|sql)$ {
deny all;
}
# Block access to any file or directory that begins with a period
location ~ /\. {
deny all;
}
# Block access to protected assets directories
location ~ ^/(site|site-[^/]+)/assets/(cache|logs|backups|sessions|config|install|tmp)($|/.*$) {
deny all;
}
# Block acceess to the /site/install/ directory
location ~ ^/(site|site-[^/]+)/install($|/.*$) {
deny all;
}
# Block dirs in /site/assets/ dirs that start with a hyphen
location ~ ^/(site|site-[^/]+)/assets.*/-.+/.* {
deny all;
}
# Block access to /wire/config.php, /site/config.php, /site/config-dev.php, and /wire/index.config.php
location ~ ^/(wire|site|site-[^/]+)/(config|index\.config|config-dev)\.php$ {
deny all;
}
# Block access to any PHP-based files in /templates-admin/
location ~ ^/(wire|site|site-[^/]+)/templates-admin($|/|/.*\.(php|html?|tpl|inc))$ {
deny all;
}
# Block access to any PHP or markup files in /site/templates/
location ~ ^/(site|site-[^/]+)/templates($|/|/.*\.(php|html?|tpl|inc))$ {
deny all;
}
# Block access to any PHP files in /site/assets/
location ~ ^/(site|site-[^/]+)/assets($|/|/.*\.php)$ {
deny all;
}
# Block access to any PHP files in core or core module directories
location ~ ^/wire/(core|modules)/.*\.(php|inc|tpl|module)$ {
deny all;
}
# Block access to any PHP files in /site/modules/
location ~ ^/(site|site-[^/]+)/modules/.*\.(php|inc|tpl|module)$ {
deny all;
}
# Block access to any software identifying txt files
location ~ ^/(COPYRIGHT|INSTALL|README|htaccess)\.(txt|md)$ {
deny all;
}
# Block all http access to the default/uninstalled site-default directory
location ~ ^/site-default/ {
deny all;
}
#Amplify dashboard
location /nginx_status {
stub_status on;
allow 127.0.0.1;
deny all;
}
# -----------------------------------------------------------------------------------------------
# If the request is for a static file, then set expires header and disable logging.
# Give control to ProcessWire if the requested file or directory is non-existing.
# -----------------------------------------------------------------------------------------------
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|eot|woff|ttf)$ {
expires 15d;
log_not_found off;
access_log off;
try_files $uri $uri/ /index.php?it=$uri&$query_string;
}
# -----------------------------------------------------------------------------------------------
# ProCache Rules
# -----------------------------------------------------------------------------------------------
set $cache_uri $request_uri;
if ($request_method = POST) {
set $cache_uri 'nocache';
}
if ($http_cookie ~* "wires_challenge") {
set $cache_uri 'nocache';
}
if ($http_cookie ~* "persist") {
set $cache_uri 'nocache';
}
# -----------------------------------------------------------------------------------------------
# This location processes all other requests. If the request is for a file or directory that
# physically exists on the server, then load the file. Else give control to ProcessWire.
# -----------------------------------------------------------------------------------------------
location / {
expires -1;
try_files /site/assets/ProCache-b3d534d...d/$cache_uri/index.html $uri $uri/ /index.php?it=$uri&$args;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
access_log off;
error_log /var/log/nginx/example.com-error.log error;
error_page 404 /index.php;
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
}
location ~ /\.ht {
deny all;
}
}
Courtesy of this post (original bulk of code): ProcessWire on NGINX - General Support - ProcessWire Support Forums
And this post (updated to work with Processwire 3.x): ProcessWire on NGINX - Page 2 - General Support - ProcessWire Support Forums
Apache htaccess to nginx converter
https://www.winginx.com/en/htaccess
There are at least a few of these converters, which makes me think it’s a common problem, commonly solved in an automated way. Yay?
Nginx resources
This is for my reference mainly, but sharing in case it helps anyone else searching the forum for nginx issues. 