0

Context

I used a bitnami prepackage image to started a nginx+wordpress site on Google Compute. I want to enable varnish-cache on this server. A varnish 4.x package is already preinstalled but not enabled.

From what I understand it is a two-steps process to use varnish-cache.

1) Get the ssl part of the wordpress to talk to http port of the service (instead of directly calling fastcgi)

2) Set varnish port to 80 and talk to nginx via another port (says 8080). Get nginx server to use 8080 for wordperess instead of 80.

I am trying to achieve the first step by changing this part of wordpress/nginx configuration

 server {


     listen    443 ssl;

      include "/opt/bitnami/apps/wordpress/conf/nginx-app.conf";

to

server {

 listen    443 ssl;

   location / {
     proxy_pass http://127.0.0.1:80;
     proxy_set_header Host $http_host;
     proxy_set_header X-Forwarded-Host $http_host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto https;
     proxy_set_header HTTPS "on";


     access_log /opt/bitnami/nginx/logs/access-https.log;
 }

The idea of adding an additional access log is as test to verify the new configuration is picked up by nginx.

However it does not seems to be the case. Actually even when I changed the http port to an invalid one (e.g. proxy_pass http://127.0.0.1:79;), after restarting the nginx server, the wordpress site is working properly.

Can you tell what's wrong with my above change?

Original nginx configuration on the server:

./wordpress/conf/nginx-app.conf

index index.php index.html index.htm;
if ($request_uri !~ "^/phpmyadmin.*$")
{
  set $test  A;
}
if ($request_uri !~ "^/bitnami.*$")
{
  set $test  "${test}B";
}
if (!-e $request_filename)
{
  set $test  "${test}C";
}
if ($test = ABC) {
  rewrite ^/(.+)$ /index.php?q=$1 last;
}
include "/opt/bitnami/apps/bitnami/banner/conf/banner-substitutions.conf";
include "/opt/bitnami/apps/bitnami/banner/conf/banner.conf";
location ~ \.php$ {
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_read_timeout 300;
    fastcgi_pass unix:/opt/bitnami/php/var/run/www.sock;
    fastcgi_index index.php;
    fastcgi_param  SCRIPT_FILENAME $request_filename;
    include fastcgi_params;
}

./wordpress/conf/nginx-vhosts.conf

server {
    listen    80;
    root   "/opt/bitnami/apps/wordpress/htdocs";
    server_name  wordpress.example.com www.wordpress.example.com;

    include "/opt/bitnami/apps/wordpress/conf/nginx-app.conf";
}
server { 
    listen    443 ssl;
    root   "/opt/bitnami/apps/wordpress/htdocs";
    server_name  wordpress.example.com www.wordpress.example.com;
    ssl_certificate      "/opt/bitnami/apps/wordpress/conf/certs/server.crt";
    ssl_certificate_key  "/opt/bitnami/apps/wordpress/conf/certs/server.key";

       ssl_session_cache    shared:SSL:1m;
       ssl_session_timeout  5m;
    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    include "/opt/bitnami/apps/wordpress/conf/nginx-app.conf";
}

./wordpress/conf/nginx-prefix.conf

root "/opt/bitnami/apps/wordpress/htdocs";
include "/opt/bitnami/apps/wordpress/conf/nginx-app.conf";

./nginx/conf/nginx.conf

user  daemon daemon;
worker_processes  auto;
error_log  "/opt/bitnami/nginx/logs/error.log";
pid        "/opt/bitnami/nginx/logs/nginx.pid";
events {
    use                 epoll;
    worker_connections  1024;
    multi_accept        on;
}
http {
    client_max_body_size 8M;
    include       mime.types;
    default_type  application/octet-stream;
    client_body_temp_path  "/opt/bitnami/nginx/tmp/client_body" 1 2;
    proxy_temp_path "/opt/bitnami/nginx/tmp/proxy" 1 2;
    fastcgi_temp_path "/opt/bitnami/nginx/tmp/fastcgi" 1 2;
    scgi_temp_path "/opt/bitnami/nginx/tmp/scgi" 1 2;
    uwsgi_temp_path "/opt/bitnami/nginx/tmp/uwsgi" 1 2;
    access_log  "/opt/bitnami/nginx/logs/access.log";
    sendfile        on;
    keepalive_timeout  65;
    gzip on;
    gzip_http_version 1.1;
    gzip_comp_level 2;
    gzip_proxied any;
    gzip_vary on;
    gzip_types text/plain
               text/xml
               text/css
               text/javascript
               application/json
               application/javascript
               application/x-javascript
               application/ecmascript
               application/xml
               application/rss+xml
               application/atom+xml
               application/rdf+xml
               application/xml+rss
               application/xhtml+xml
               application/x-font-ttf
               application/x-font-opentype
               application/vnd.ms-fontobject
               image/svg+xml
               image/x-icon
               application/atom_xml;
    gzip_buffers 16 8k;
    add_header X-Frame-Options SAMEORIGIN;
    ssl_prefer_server_ciphers  on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS;
    include "/opt/bitnami/nginx/conf/bitnami/bitnami.conf";
}

Nginx verison

nginx -V
nginx version: nginx/1.12.2
built with OpenSSL 1.0.2o  27 Mar 2018
TLS SNI support enabled
configure arguments: --prefix=/bitnami/lampstack-linux-x64/output/nginx --with-http_sub_module --with-http_ssl_module --with-http_stub_status_module --w
ith-cc-opt=-I/bitnami/lampstack-linux-x64/output/common --with-ld-opt=-L/bitnami/lampstack-linux-x64/output/common/lib --with-http_gzip_static_module --
with-mail --with-mail_ssl_module --with-http_realip_module --with-http_stub_status_module --with-http_v2_module
0

This part in server 443 overrides your changes:

  include "/opt/bitnami/apps/wordpress/conf/nginx-app.conf";

Are you sure you replaced the entire server { listen 443 ... } block with your own?

You are probably already using some other https frontend - such as a CDN (CloudFlare, etc). Check with host mydomain.com or dig mydomain.com or nslookup mydomain.com how does your domain resolve to IP on the Internet. Check&reconfigure whatever is listening on port 443 on that IP - chances are it's something else than your nginx. Maybe it's already caching you, in which case you don't need varnish.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.