2

Disclaimer: I have posted this on Stackoverflow as well as I thought it may have fit better there. The link to the question is below if someone would like to answer there.

--

I have the following:

domain.com - many urls that have no need for SSL (I would like to use Varnish to cache all of these) domain.com/shop - all urls should be using SSL (No need for Varnish, I would like to listen on port 443)

I am basically looking for the best way to configure the server to cache all uris that are not in need of SSL as this has to run on port 443. All port 8080 requests are going to Varnish and working correctly. In addition I want to make sure and non-ssl request is sent to domain.com (including www requests). I have done this before but for some reason the SSL in the equation is making things complicated.

My configuration is as follows:

`server {       
   listen 8080;
   server_name domain.com;  

   root /var/www/domain.com/public_html;

   index index.html index.htm index.php;

   location / {
     try_files $uri $uri/ /index.php?q=$uri&$args;                     
   } 

   location ~ \.php$ {
     fastcgi_buffers 8 256k;
     fastcgi_buffer_size 128k;
     fastcgi_intercept_errors on;
     include fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_pass unix:/dev/shm/php-fpm-www.sock;    

     # Tried using to shut off http on all non SSL needed urls.
     fastcgi_param  HTTPS off;      
   }   

}              

server {    
    listen 443 ssl;    
    server_name domain.com;  

    ssl_certificate   /etc/nginx/keys/www.domain.com.chained.crt;    
    ssl_certificate_key   /etc/nginx/keys/domain.com.key;

    access_log  /var/www/domain.com/logs/access.log ;
    error_log  /var/www/domain.com/logs/error.log ;

    root /var/www/domain.com/public_html;

    index index.html index.htm index.php;

    location / {
      try_files $uri $uri/ /index.php?q=$uri&$args;
    }

    location ~ \.php$ {
      fastcgi_buffers 8 256k;
      fastcgi_buffer_size 128k;
      fastcgi_intercept_errors on;
      include fastcgi_params;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_pass unix:/dev/shm/php-fpm-www.sock;  

      #https will not work without this.
      fastcgi_param  HTTPS on;   
    }

}                       

2 Answers 2

2

Try port allocation:

Varnish:80 => NginX:8080
NginX:443

This way, you pass everything thru varnish as above-cache layer, so the no of requests to NginX is reduced.

Your application should control via headers how the content should be cached, and by default it should work OK - dynamic files are passed to NginX while the static is served from cache for as long as the expiry date header says.

8
  • Hey @Andrew Smith - Thank you for your answer and it seems to make a good amount of sense to me although I have never done port allocation (that I know of). Would you mind shedding some more light on how to go about this?
    – jnolte
    Aug 15, 2012 at 17:34
  • Just setup Varnish on port 80 and make it forwarding to NginX port 8080 for HTTP. For HTTPS, you dont need varnish, so you just make NginX listening on port 443 and answering SSL queries. Aug 15, 2012 at 18:38
  • Hi Andrew - This is exactly how I have it currently setup but I only want SSL to be active on /shop uris.
    – jnolte
    Aug 15, 2012 at 19:17
  • Can you just /shop URLs to render with https:// prefix? Aug 15, 2012 at 21:31
  • I have done this and when it switches to https:// on the /shop urls it remains https:// for the remainer of the session. I would like to only use https:// on these urls with /shop. Using regex to detect if the url is not /shop seems like a bit much.
    – jnolte
    Aug 15, 2012 at 22:37
0

This is how we could do. I use this pattern to enable SSH for "admin" pages (in WordPress). Hopefully, it works in your situation.

server {
  listen 8080;
  server_name domainname.com;
  root /path/to/domainname.com/installation;
  index index.php;

  location ~ \.php$ {
    # Request to /shop to go via HTTPS
    location ~ /shop {
      return 301 https://$host$request_uri;
    }

    # Process non-/shop PHP requests
    try_files $uri =404;
    include fastcgi_params;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass  unix:/dev/shm/php-fpm-www.sock;
  }

  location / {
    try_files $uri $uri/ /index.php;
  }

}

server {
  listen 443 ssl;
  server_name domainname.com;

  ssl_certificate xyz.crt;
  ssl_certificate_key xyz.key;

  root /path/to/domainname.com/installation;
  index index.php;

  # Process only the requests to shop
  location ~ /shop {
    location ~ \.php$ {
      try_files $uri =404;
      include fastcgi_params;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_pass  unix:/dev/shm/php-fpm-www.sock;
      fastcgi_param  HTTPS on;
    }
  }

  # Redirect everything else to port 80 (Varnish)
  location / {
    return 301 http://$host$request_uri;
  }
}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .