Nginx- und PHP-FPM-Konfiguration

Warum Nginx + PHP-FPM?

Einfacher Nginx-Serverblock

# /etc/nginx/sites-available/myapp
server {
    listen 80;
    server_name example.com;
    root /srv/myapp/public;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
    }

    location ~ /\.ht {
        deny all;
    }
}

try_files-Direktive

PHP-FPM-Pool-Konfiguration

[www]
pm = dynamic
pm.max_children      = 20
pm.start_servers     = 5
pm.min_spare_servers = 2
pm.max_spare_servers = 8
pm.max_requests      = 500  ; recycle workers to prevent leaks

Unix-Socket vs. TCP

HTTPS mit Let's Encrypt

$ certbot --nginx -d example.com
# Certbot modifies your Nginx config and sets up auto-renewal

Gzip-Komprimierung

# nginx.conf or server block:
gzip on;
gzip_types text/plain text/css application/javascript application/json;
gzip_min_length 1024;

Browser-Caching für statische Assets

location ~* \.(js|css|png|jpg|gif|ico|woff2)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
}

Rate Limiting in Nginx

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;
}

server {
    location /api/ {
        limit_req zone=one burst=20 nodelay;
    }
}

Sicherheits-Header

add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "strict-origin-when-cross-origin";

Reload vs. Restart

Zusammenfassung

Kurzer Check