Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Disclaimer: I have posted this on Stackoverflow as well as I thought it may have fit better there. The link to the question is below if someone would like to answer there.

--

I have the following:

domain.com - many urls that have no need for SSL (I would like to use Varnish to cache all of these) domain.com/shop - all urls should be using SSL (No need for Varnish, I would like to listen on port 443)

I am basically looking for the best way to configure the server to cache all uris that are not in need of SSL as this has to run on port 443. All port 8080 requests are going to Varnish and working correctly. In addition I want to make sure and non-ssl request is sent to domain.com (including www requests). I have done this before but for some reason the SSL in the equation is making things complicated.

My configuration is as follows:

`server {       
   listen 8080;
   server_name domain.com;  

   root /var/www/domain.com/public_html;

   index index.html index.htm index.php;

   location / {
     try_files $uri $uri/ /index.php?q=$uri&$args;                     
   } 

   location ~ \.php$ {
     fastcgi_buffers 8 256k;
     fastcgi_buffer_size 128k;
     fastcgi_intercept_errors on;
     include fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_pass unix:/dev/shm/php-fpm-www.sock;    

     # Tried using to shut off http on all non SSL needed urls.
     fastcgi_param  HTTPS off;      
   }   

}              

server {    
    listen 443 ssl;    
    server_name domain.com;  

    ssl_certificate   /etc/nginx/keys/www.domain.com.chained.crt;    
    ssl_certificate_key   /etc/nginx/keys/domain.com.key;

    access_log  /var/www/domain.com/logs/access.log ;
    error_log  /var/www/domain.com/logs/error.log ;

    root /var/www/domain.com/public_html;

    index index.html index.htm index.php;

    location / {
      try_files $uri $uri/ /index.php?q=$uri&$args;
    }

    location ~ \.php$ {
      fastcgi_buffers 8 256k;
      fastcgi_buffer_size 128k;
      fastcgi_intercept_errors on;
      include fastcgi_params;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_pass unix:/dev/shm/php-fpm-www.sock;  

      #https will not work without this.
      fastcgi_param  HTTPS on;   
    }

}                       
share|improve this question

2 Answers 2

Try port allocation:

Varnish:80 => NginX:8080
NginX:443

This way, you pass everything thru varnish as above-cache layer, so the no of requests to NginX is reduced.

Your application should control via headers how the content should be cached, and by default it should work OK - dynamic files are passed to NginX while the static is served from cache for as long as the expiry date header says.

share|improve this answer
    
Hey @Andrew Smith - Thank you for your answer and it seems to make a good amount of sense to me although I have never done port allocation (that I know of). Would you mind shedding some more light on how to go about this? –  jnolte Aug 15 '12 at 17:34
    
Just setup Varnish on port 80 and make it forwarding to NginX port 8080 for HTTP. For HTTPS, you dont need varnish, so you just make NginX listening on port 443 and answering SSL queries. –  Andrew Smith Aug 15 '12 at 18:38
    
Hi Andrew - This is exactly how I have it currently setup but I only want SSL to be active on /shop uris. –  jnolte Aug 15 '12 at 19:17
    
Can you just /shop URLs to render with https:// prefix? –  Andrew Smith Aug 15 '12 at 21:31
    
I have done this and when it switches to https:// on the /shop urls it remains https:// for the remainer of the session. I would like to only use https:// on these urls with /shop. Using regex to detect if the url is not /shop seems like a bit much. –  jnolte Aug 15 '12 at 22:37

This is how we could do. I use this pattern to enable SSH for "admin" pages (in WordPress). Hopefully, it works in your situation.

server {
  listen 8080;
  server_name domainname.com;
  root /path/to/domainname.com/installation;
  index index.php;

  location ~ \.php$ {
    # Request to /shop to go via HTTPS
    location ~ /shop {
      return 301 https://$host$request_uri;
    }

    # Process non-/shop PHP requests
    try_files $uri =404;
    include fastcgi_params;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass  unix:/dev/shm/php-fpm-www.sock;
  }

  location / {
    try_files $uri $uri/ /index.php;
  }

}

server {
  listen 443 ssl;
  server_name domainname.com;

  ssl_certificate xyz.crt;
  ssl_certificate_key xyz.key;

  root /path/to/domainname.com/installation;
  index index.php;

  # Process only the requests to shop
  location ~ /shop {
    location ~ \.php$ {
      try_files $uri =404;
      include fastcgi_params;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_pass  unix:/dev/shm/php-fpm-www.sock;
      fastcgi_param  HTTPS on;
    }
  }

  # Redirect everything else to port 80 (Varnish)
  location / {
    return 301 http://$host$request_uri;
  }
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.