Nginx/MediaWiki

Note: These Nginx configs are written without HTTPS for simplicity, but you should be using SSL certificates from LetsEncrypt. They're free!

PHP-FPM Nginx Config

To make it easy to switch all our present or future PHP apps between TCP ports and UNIX sockets, we use a specific `php-fpm.conf` file which can be called with fastcgi_pass php-fpm;. Create this file:

/etc/nginx/conf.d/php-fpm.conf

# PHP-FPM FastCGI server
# network or unix domain socket configuration

upstream php-fpm {
        #server 127.0.0.1:9000;
        server unix:/var/run/php5-fpm.sock;
}

MediaWiki Nginx Config

This is the Nginx Config that we use when when setting up MediaWiki for the first time over conventional HTTP, with PHP-FPM:

• Path to Mediawiki installation: /var/www/mediawiki/

/etc/nginx/conf.d/wiki.bibanon.org.conf

server {
    listen 80;
    server_name wiki.bibanon.org;

    root /var/www/mediawiki;

    client_max_body_size 8m;

    # let's encrypt SSL dir
    location ~ /\.well-known {
        root /var/lib/letsencrypt;
    }

    access_log /var/log/nginx/wiki.bibanon.org.log;
    error_log /var/log/nginx/wiki.bibanon.org.error.log;

#    Common deny, drop, or internal locations

#    Exclude all access from the cache directory
    location ^~ /cache/ { deny all; }

#    Prevent access to any files starting with a dot, like .htaccess
#    or text editor temp files
    location ~ /\. { access_log off; log_not_found off; deny all; }

#    Prevent access to any files starting with a $ (usually temp files)
    location ~ ~$ { access_log off; log_not_found off; deny all; }

#    Do not log access to robots.txt, to keep the logs cleaner
    location = /robots.txt { access_log off; log_not_found off; }

#    Do not log access to the favicon, to keep the logs cleaner
    location = /favicon.ico { access_log off; log_not_found off; }

#    Keep images and CSS around in browser cache for as long as possible,
#    to cut down on server load
    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        try_files $uri /index.php;
        expires max;
        log_not_found off;
    }

#    Mark all of these directories as "internal", which means that they cannot
#    be explicitly accessed by clients. However, the web server can still use
#    and serve the files inside of them. This keeps people from poking around
#    in the wiki's internals.
    location ^~ /bin/ { internal; }
    location ^~ /docs/ { internal; }
    location ^~ /extensions/ { internal; }
    location ^~ /includes/ { internal; }
    location ^~ /maintenance/ { internal; }
#    location ^~ /mw-config/ { internal; } #Uncomment after installation
    location ^~ /resources/ { internal; }
    location ^~ /serialized/ { internal; }
    location ^~ /tests/ { internal; }

#    Serve the wiki toolbar data out of /resources/assets/
    location ^~ /resources/assets/ { }
    location ^~ /extensions/WikiEditor/modules/images/ { }


#    Serve bootstrap-mediawiki theme assets
#    location ^~ /skins/bootstrap-mediawiki/bootstrap {
#        try_files $uri $uri/;
#    }
#    location ^~ /skins/bootstrap-mediawiki/google-code-prettify {
#        try_files $uri $uri/;
#    }
#    location ^~ /skins/bootstrap-mediawiki/js {
#        try_files $uri $uri/;
#    }
#    location ^~ /skins/bootstrap-mediawiki/font-awesome {
#        try_files $uri $uri/;
#        default_type text/plain;
#    }

#    Redirect all requests for unknown URLs out of images and back to the
#    root index.php file
    location ^~ /images/ {
        try_files $uri /index.php;
    }


#    Uncomment after installation!
#    location / {
#        index index.php;
#        rewrite ^/([^?]*)(?:\?(.*))? /index.php?title=$1&$2 last;
#    }

    location ~ \.php?$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_pass php-fpm;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_intercept_errors on;
    }
}

• Source: BigDinosaur Blog: Mediawiki with Nginx

After setting up MediaWiki, make sure to uncomment the location / { block to allow index.php to be used, and the location ^~ /mw-config/ { internal; } line to disable access to the installation directory.

Also consider setting up an SSL certificate with this Nginx config.

Serving MediaWiki images with Nginx

Nginx can be optimized to make image serving more efficient, and block hotlinking. Since the settings for static images often differ greatly from that of dynamic text, it is recommended that you create a specific subdomain just for images (such as img.bibanon.org) and serve your image folder from there.

Here is the Nginx config we used (without SSL) to serve our image folder:

/etc/nginx/conf.d/img.bibanon.org.conf

server {
    listen 80;
    server_name img.bibanon.org;

    # nginx caching, expires in 1M
    expires 1M;
    access_log off;
    add_header Cache-Control "public";

    # images stored here
    root /var/www/mediawiki/images;

    # let's encrypt SSL dir
    location ~ /\.well-known {
        root /var/lib/letsencrypt;
    }

    location ^~ / {
        try_files $uri =404;
    }

    location ^~ /thumb/ {
        try_files $uri =404;     
    }

    # block unnecessary access
    location ^~ /lockdir/ { deny all; }
    location ^~ /temp/ { deny all; }
    location ^~ /archive/ { deny all; }

    # block image hotlinking, but not from search engines
    valid_referers none blocked bibanon.org *.bibanon.org ~.google. ~.bing. ~.yahoo.;
    if ($invalid_referer) {
        return   403; # you can alternatively link to an small unsavory picture to be a douche, though it still takes a little bandwidth
    }
}

After setting this up, just add this line to LocalSettings:

/var/www/mediawiki/LocalSettings.php

$wgUploadBaseUrl = 'https://img.bibanon.org';

https://serversforhackers.com/nginx-caching