Nginx downloads PHP instead of executing

Question

PHP files are downloading instead of executing, and the mydomain.com root gives a HTTP 403 Forbidden, suggesting the index directive is not set up correctly.

(Sorry I know this has been asked a million times but I feel like I've tried every combination of articles I could get my hands on.)

Ubuntu 16.04, PHP FPM 7.2 installed

Here are the basic configs I'm using. I've stripped out everything else I've tried for clarity:

/etc/nginx/sites-available/default

# Default server configuration

server {
        listen 80 default_server;
        listen [::]:80 default_server;

        index index.php index.html index.htm;

        location / {
            try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php7.2-fpm.sock;
        }

        location ~ /\.ht {
               deny all;
        }
}

/etc/nginx/sites-available/mydomain.com.conf

server {
    server_name .mydomain.com;
    listen 80;
    listen [::]:80 ipv6only=on;
    listen 443 default_server ssl;
    listen [::]:443 ipv6only=on;

    location / {
        root /var/www/html/mydomain.com;
    }
}

One thing I've noticed is that /run/php/php7.2-fpm.sock has a file size of zero even on a fresh install.

Answer 1

When is nginx downloading the php file? If it happens when you are accessing your main site mydomain.com/foo.php, it's because your php configuration should be inside your main site's server block, not in the default server block.

So this should work :

/etc/nginx/sites-available/mydomain.com.conf

server {
    server_name .mydomain.com;
    listen 80;
    listen [::]:80 ipv6only=on;
    listen 443 default_server ssl;
    listen [::]:443 ipv6only=on;

    # You need to add your SSL certs here
    ssl_certificate /path/to/mydomain.com.crt;
    ssl_certificate_key /path/to/mydomain.com.key;
    ssl_dhparam /path/to/dhparam.pem;

    root /var/www/html/mydomain.com;
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.2-fpm.sock;
    }

    location ~ /\.ht {
           deny all;
    }
}

# Default server
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    return 401;
}

As with best practices, the default server block should only be used as dummy to drop any request that has does not have a valid destination (i.e. domain name, e.g. mydomain.com). Which means when someone requests myexample.com and points that DNS to your nginx server, the person will hit a 401.