Nginx setup

This section applies to installations performed using the official BastionGuard package.

Below is a complete example configuration and the required changes to ensure WordPress permalinks, rewrites, and PHP-FPM handling work correctly.

# ----------------------------------------------------------------------
# FULL EXAMPLE NGINX SERVER BLOCK (WordPress + Joomla example included)
# ----------------------------------------------------------------------
server {
    listen 80;
    listen [::]:80;
    server_name _;

    root /srv/http;
    index index.php index.html index.htm;

    # Se non hai questi file, evita di loggare errori inutili
    location = /favicon.ico { log_not_found off; access_log off; }
    location = /robots.txt  { log_not_found off; access_log off; }

    # Fix header grandi (wp-admin / cookie / plugin)
    fastcgi_buffer_size 64k;
    fastcgi_buffers 16 64k;
    fastcgi_busy_buffers_size 128k;
    fastcgi_temp_file_write_size 128k;

    # Cache asset statici
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff2?)$ {
        expires 30d;
        access_log off;
        log_not_found off;
        try_files $uri =404;
    }

    # Proteggi dotfiles (lascia .well-known)
    location ~ /\.(?!well-known) {
        deny all;
        access_log off;
        log_not_found off;
    }

    # ----------------------------------------------------------
    # WordPress in /wordpress
    # ----------------------------------------------------------
    location = /wordpress { return 301 /wordpress/; }

    location /wordpress/ {
        try_files $uri $uri/ /wordpress/index.php?$args;
    }

    location ~* ^/wordpress/(?:wp-config\.php|readme\.html|license\.txt)$ { deny all; }
    location ~* ^/wordpress/xmlrpc\.php$ { deny all; }  # solo se non lo usi


    # ----------------------------------------------------------
    # Joomla in /joomla
    # ----------------------------------------------------------
    location = /joomla { return 301 /joomla/; }

    location /joomla/ {
        try_files $uri $uri/ /joomla/index.php?$args;
    }

    # ----------------------------------------------------------
    # Root (catch-all)
    # ----------------------------------------------------------
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # ----------------------------------------------------------
    # PHP handler (globale): esegue SOLO file PHP esistenti
    # ----------------------------------------------------------
    location ~ \.php$ {
        try_files $uri =404;

         # --- Common sockets: enable ONLY the correct one for your distro ---

        # Debian / Ubuntu (example PHP 8.4)
        fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;

        # Fedora / openSUSE / Arch (common default)
         fastcgi_pass unix:/run/php/php-fpm.sock;

        # Slackware / older Arch paths (example)
        # fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;

        # Se per qualche motivo fastcgi.conf non imposta SCRIPT_FILENAME,
        # scommenta le due righe sotto:
        # fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        # fastcgi_param DOCUMENT_ROOT  $document_root;
    }
}

---

CONFIGURATION STEPS (WHAT TO CHANGE)

Step 1 — Change the Nginx document root
Replace:

root /srv/http;

With one of the following (depending on your distribution):

- root /var/www/html;
- root /srv/www/htdocs;

Step 2 — Ensure permalinks and rewrites (WordPress)
The required block for WordPress permalinks is:

location = /wordpress {
    return 301 /wordpress/;
}

location /wordpress/ {
    index index.php;
    try_files $uri $uri/ /wordpress/index.php?$query_string;
}

You can freely change your WordPress directory (e.g. /shop, /blog) or add other CMS paths (Drupal, etc.).
The Joomla block is included only as an example of a second subdirectory CMS.

Step 3 — Configure the correct PHP-FPM socket
In the PHP location block, change:

fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;

to match your distribution’s PHP-FPM socket path.

———————————————————————-

PHP INSTALLATION COMMANDS (BY DISTRIBUTION)

———————————————————————-

Debian / Ubuntu

sudo apt install -y php php-pdo php-mysql php-zip php-gd php-mbstring php-curl php-xml php-pear php-bcmath

openSUSE

zypper in php8 php8-cli php8-mysql php8-gd php8-gettext php8-mbstring

Fedora

sudo dnf -y install php php-cli php-php-gettext php-mbstring php-mcrypt php-mysqlnd php-pear php-curl php-gd php-xml php-bcmath php-zip php-fpm

Arch Linux

sudo pacman -S php php-cgi php-fpm php-embed php-phpdbg php-dblib php-enchant php-gd php-sodium php-odbc php-pgsql php-snmp php-sqlite php-tidy php-xsl