0

PHP files are downloading instead of executing, and the mydomain.com root gives a HTTP 403 Forbidden, suggesting the index directive is not set up correctly.

(Sorry I know this has been asked a million times but I feel like I've tried every combination of articles I could get my hands on.)

Ubuntu 16.04, PHP FPM 7.2 installed

Here are the basic configs I'm using. I've stripped out everything else I've tried for clarity:

/etc/nginx/sites-available/default

# Default server configuration

server {
        listen 80 default_server;
        listen [::]:80 default_server;

        index index.php index.html index.htm;

        location / {
            try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php7.2-fpm.sock;
        }

        location ~ /\.ht {
               deny all;
        }
}

/etc/nginx/sites-available/mydomain.com.conf

server {
    server_name .mydomain.com;
    listen 80;
    listen [::]:80 ipv6only=on;
    listen 443 default_server ssl;
    listen [::]:443 ipv6only=on;

    location / {
        root /var/www/html/mydomain.com;
    }
}

One thing I've noticed is that /run/php/php7.2-fpm.sock has a file size of zero even on a fresh install.

1 Answer 1

0

When is nginx downloading the php file? If it happens when you are accessing your main site mydomain.com/foo.php, it's because your php configuration should be inside your main site's server block, not in the default server block.

So this should work :

/etc/nginx/sites-available/mydomain.com.conf

server {
    server_name .mydomain.com;
    listen 80;
    listen [::]:80 ipv6only=on;
    listen 443 default_server ssl;
    listen [::]:443 ipv6only=on;

    # You need to add your SSL certs here
    ssl_certificate /path/to/mydomain.com.crt;
    ssl_certificate_key /path/to/mydomain.com.key;
    ssl_dhparam /path/to/dhparam.pem;

    root /var/www/html/mydomain.com;
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.2-fpm.sock;
    }

    location ~ /\.ht {
           deny all;
    }
}

# Default server
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    return 401;
}

As with best practices, the default server block should only be used as dummy to drop any request that has does not have a valid destination (i.e. domain name, e.g. mydomain.com). Which means when someone requests myexample.com and points that DNS to your nginx server, the person will hit a 401.

4
  • Thank you! That worked. So when should the sites-available/default config be used? I was thinking of that file as a catch-all of general settings that should apply to all sites I'll host, then have specific site configs in the relevant files, no?
    – Jon
    Feb 26, 2019 at 9:55
  • To the best of my knowledge nginx allows 'global' settings for only some directives. Best practices recommend dedicated server blocks. Even dynamically configured load balancers with service discovery generate full server blocks, based on an nginx template. See: nginx-proxy used with a template generator docker-gen using an nginx template nginx.tmpl. If you scan the template you see dedicated server blocks and some 'global' settings
    – L. J.
    Mar 11, 2019 at 3:34
  • Some 'global' settings you see in that template are map, ssl_dhparam, server_names_hash_bucket_size, gzip_types, log_format, access_log, proxy_*... Basically anything that is allowed in the http context. See map in the nginx docs as an example. But these directives should not go into the default_server server block.
    – L. J.
    Mar 11, 2019 at 3:47
  • 1
    what should we name the file if we only have ip address and not DNS? Mar 24 at 5:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.