Pretty URL/mediawiki: Difference between revisions

From Freephile Wiki
Browse history interactively
← Older edit
VisualWikitext
No edit summary
No edit summary
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
The purpose of this page is to merge two different configurations for Pretty URLs for MediaWiki on Nginx into the ultimate configuration.  The first is my current configuration which is a combination of what comes from DebOps, and the code found on MediaWiki.org.  The second is the suggested configuration from shorturls.redwerks.com
The purpose of this page is to merge two different configurations for Pretty URLs for MediaWiki on Nginx into the ultimate configuration.  The first is my current configuration which is a combination of what comes from DebOps, and the code found on MediaWiki.org.  The second is the suggested configuration from shorturls.redwerks.com The [https://github.com/wikimedia/translatewiki/blob/master/puppet/modules/nginx/files/translatewiki.net configuration file for translatewiki.net] as provided by @nikerabbit should be used as a reference in simplicity.




Line 211: Line 211:


== The Ultimate Pretty URL configuration for MediaWiki on Nginx ==
== The Ultimate Pretty URL configuration for MediaWiki on Nginx ==
<div style="color:red;background-color:yellow;">Warning, this config is a work in progress and has KNOWN deficiencies (e.g. thumbnails not working)</div>
<syntaxhighlight lang="php" line>
<syntaxhighlight lang="php" line>




# This file is managed remotely, all changes will be lost


# nginx server configuration for:
#    - https://wiki.ncigt.org/


server {
    listen 80;
    listen [::]:80;
    server_name wiki.ncigt.org;
    root /var/www/clients/wiki.ncigt.org;
    include snippets/acme-challenge.conf;
    location / {
            return 301 https://$host$request_uri;
    }
}


server {
server {
    listen 443 ssl;
    listen [::]:443 ssl http2;
    ssl_certificate          /etc/letsencrypt/live/labs.qualitybox.us/fullchain.pem;
    ssl_certificate_key      /etc/letsencrypt/live/labs.qualitybox.us/privkey.pem;
    ssl_protocols            TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers              "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH"; # TLS cipher suites set: bettercrypto_org__set_b_pfs
    ssl_dhparam              /etc/pki/dhparam/set0;
    ssl_ecdh_curve            secp384r1;
    ssl_stapling              on;
    ssl_stapling_verify      on;
    ssl_trusted_certificate  /etc/pki/realms/domain/trusted.crt;
    resolver                  8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout          5s;
    add_header                Strict-Transport-Security "max-age=15768000; includeSubDomains";
    add_header                X-Content-Type-Options "nosniff" always;
    add_header                X-Frame-Options "SAMEORIGIN" always;
    add_header                X-XSS-Protection "1; mode=block";
    add_header                Referrer-Policy "same-origin";
    server_name wiki.ncigt.org;
    root /var/www/clients/wiki.ncigt.org;
    include snippets/acme-challenge.conf;
    keepalive_timeout 60;
    access_log /var/log/nginx/wiki.ncigt.org_access.log;
    error_log /var/log/nginx/wiki.ncigt.org_error.log;
    index index.html index.htm index.php;


     # [...]
     # [...]


    # setup simple way to take site down
     if (-f $document_root/maintenance.html) {
     if (-f $document_root/maintenance.html) {
            return 503;
        return 503;
     }
     }
     error_page 503 @maintenance;
     error_page 503 @maintenance;
     location @maintenance {
     location @maintenance {
            rewrite ^(.*)$ /maintenance.html break;
        rewrite ^(.*)$ /maintenance.html break;
     }
     }


Line 233: Line 280:
     # https://tools.ietf.org/html/rfc5785
     # https://tools.ietf.org/html/rfc5785
     location ~ /\.(?!well-known/) {
     location ~ /\.(?!well-known/) {
            return 404;
        return 404;
     }
     }


     location = /nginx_status {
     location = /nginx_status {
            stub_status on;
        stub_status on;
            access_log off;
        access_log off;
            allow 127.0.0.1/32;
        allow 127.0.0.1/32;
            allow ::1/128;
        allow ::1/128;
            allow 67.205.190.17;
        allow 67.205.190.17;
            allow 10.10.0.11;
        allow 10.10.0.11;
            allow 10.136.225.163;
        allow 10.136.225.163;
            deny all;
        deny all;
     }
     }
     # Favicon
     # Favicon
     location = /favicon.ico {
     location = /favicon.ico {
            alias /w/images/6/64/Favicon.ico;
        alias /w/images/6/64/Favicon.ico;
            add_header Cache-Control "public";
        add_header Cache-Control "public";
            expires 7d;
        expires 7d;
            access_log off;
        access_log off;
            log_not_found off;
        log_not_found off;
     }
     }


# Location for the wiki's root
    # Location for the wiki's root
location /w/ {
    location /w/ {
# Do this inside of a location so it can be negated
        # Do this inside of a location so it can be negated
location ~ \.php$ {
        location ~ \.php$ {
try_files $uri $uri/ =404; # Don't let php execute non-existent php files
            try_files $uri $uri/ =404; # Don't let php execute non-existent php files
include fastcgi.conf;
            include fastcgi.conf;
                        #Mitigate HTTPOXY attacks (https://httpoxy.org)
            #Mitigate HTTPOXY attacks (https://httpoxy.org)
                        fastcgi_param HTTP_PROXY "";
            fastcgi_param HTTP_PROXY "";
fastcgi_pass 127.0.0.1:9000;
            fastcgi_pass php5_www-data;
}
        }
         # MediaWiki assets (usually images)
         # MediaWiki assets (usually images)
         location ~ ^/w/resources/(assets|lib|src) {
         location ~ ^/w/resources/(assets|lib|src) {
                try_files $uri 404;
            try_files $uri 404;
                add_header Cache-Control "public";
            add_header Cache-Control "public";
                expires 7d;
            expires 7d;
         }
         }
         # Assets, scripts and styles from skins and extensions
         # Assets, scripts and styles from skins and extensions
         location ~ ^/w/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg)$ {
         location ~ ^/w/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg)$ {
                try_files $uri 404;
            try_files $uri 404;
                add_header Cache-Control "public";
            add_header Cache-Control "public";
                expires 7d;
            expires 7d;
         }
         }
}
    }


# Separate location for images/ so .php execution won't apply
    # Separate location for images/ so .php execution won't apply
location /w/images {
    location /w/images {
       
location ~ ^/w/images/thumb/(archive/)?[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ {
        location ~ ^/w/images/thumb/(archive/)?[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ {
# Thumbnail handler for MediaWiki
            # Thumbnail handler for MediaWiki
# This location only matches on a thumbnail's url
            # This location only matches on a thumbnail's url
# If the file does not exist we use @thumb to run the thumb.php script
            # If the file does not exist we use @thumb to run the thumb.php script
try_files $uri $uri/ @thumb;
            try_files $uri $uri/ @thumb;
}
        }
}
    }
     # Thumbnail 404 handler, only called by try_files when a thumbnail does not exist
     # Thumbnail 404 handler, only called by try_files when a thumbnail does not exist
location @thumb {
    location @thumb {
# Do a rewrite here so that thumb.php gets the correct arguments
        # Do a rewrite here so that thumb.php gets the correct arguments
rewrite ^/w/images/thumb/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2;
        rewrite ^/w/images/thumb/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2;
rewrite ^/w/images/thumb/archive/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2&archived=1;
        rewrite ^/w/images/thumb/archive/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2&archived=1;
       
# Run the thumb.php script
        # Run the thumb.php script
include /etc/nginx/fastcgi_params;
        include /etc/nginx/fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root/w/thumb.php;
        fastcgi_param SCRIPT_FILENAME   $document_root/w/thumb.php;
fastcgi_pass 127.0.0.1:9000;
        fastcgi_pass php5_www-data;
}
    }


# Deny access to deleted images folder
    # Deny access to deleted images folder
location /w/images/deleted { deny all; }
    location /w/images/deleted { deny   all; }
   
# Deny access to folders MediaWiki has a .htaccess deny in
    # Deny access to folders MediaWiki has a .htaccess deny in
location /w/cache      { deny all; }
    location /w/cache      { deny all; }
location /w/languages  { deny all; }
    location /w/languages  { deny all; }
location /w/maintenance { deny all; }
    location /w/maintenance { deny all; }
location /w/serialized  { deny all; }
    location /w/serialized  { deny all; }


     # Deny access to the installer
     # Deny access to the installer
location /w/mw-config { deny all; }
    location /w/mw-config { deny all; }


     # Handling for the article path
     # Handling for the article path
location /wiki {
    location /wiki {
include /etc/nginx/fastcgi_params;
        include /etc/nginx/fastcgi_params;
# article path should always be passed to index.php
        # article path should always be passed to index.php
fastcgi_param SCRIPT_FILENAME $document_root/w/index.php;
        fastcgi_param SCRIPT_FILENAME   $document_root/w/index.php;
fastcgi_pass 127.0.0.1:9000;
        fastcgi_pass php5_www-data;
}
    }
 
}
</syntaxhighlight>
</syntaxhighlight>

Latest revision as of 22:51, 18 November 2019

The purpose of this page is to merge two different configurations for Pretty URLs for MediaWiki on Nginx into the ultimate configuration. The first is my current configuration which is a combination of what comes from DebOps, and the code found on MediaWiki.org. The second is the suggested configuration from shorturls.redwerks.com The configuration file for translatewiki.net as provided by @nikerabbit should be used as a reference in simplicity.


My Nginx Conf[edit]

server {

        # [...]

        if (-f $document_root/maintenance.html) {
                return 503;
        }
        error_page 503 @maintenance;
        location @maintenance {
                rewrite ^(.*)$ /maintenance.html break;
        }

        # Disallow access to hidden files and directories, except `/.well-known/`
        # https://www.mnot.net/blog/2010/04/07/well-known
        # https://tools.ietf.org/html/rfc5785
        location ~ /\.(?!well-known/) {
                return 404;
        }

        #location = /favicon.ico {
        #        try_files /favicon.ico =204;
        #        access_log off;
        #        log_not_found off;
        #}

        location = /nginx_status {
                stub_status on;
                access_log off;
                allow 127.0.0.1/32;
                allow ::1/128;
                allow 67.205.190.17;
                allow 10.10.0.11;
                allow 10.136.225.163;
                deny all;
        }

        location ~ ^(?!.+\.php/)(?<script_name>.+\.php)$ {
                try_files $script_name =404;

                include fastcgi.conf;

                # Mitigate HTTPOXY attacks (https://httpoxy.org/)
                fastcgi_param HTTP_PROXY "";

                fastcgi_index index.php;
                fastcgi_pass php5_www-data;
        }

        location ~ ^(?<script_name>.+\.php)(?<path_info>/.*)$ {
                try_files $script_name =404;

                include fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$script_name;
                fastcgi_param PATH_INFO $path_info;
                #fastcgi_param PATH_TRANSLATED $document_root$path_info;

                # Mitigate HTTPOXY attacks (https://httpoxy.org/)
                fastcgi_param HTTP_PROXY "";

                fastcgi_index index.php;
                fastcgi_pass php5_www-data;
        }
        #### All the following rules added for pretty URLs
        location ~ ^/w/(index|load|api|thumb|opensearch_desc)\.php$ {
                include /etc/nginx/fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                fastcgi_pass 127.0.0.1:9000; # or whatever port your PHP-FPM listens on
        }
        
        # Images
        location /w/images {
                # Separate location for images/ so .php execution won't apply
        }
        location /w/images/deleted {
                # Deny access to deleted images folder
                deny all;
        }
        # MediaWiki assets (usually images)
        location ~ ^/w/resources/(assets|lib|src) {
                try_files $uri 404;
                add_header Cache-Control "public";
                expires 7d;
        }
        # Assets, scripts and styles from skins and extensions
        location ~ ^/w/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg)$ {
                try_files $uri 404;
                add_header Cache-Control "public";
                expires 7d;
        }
        # Favicon
        location = /favicon.ico {
                alias /w/images/6/64/Favicon.ico;
                add_header Cache-Control "public";
                expires 7d;
                access_log off;
                log_not_found off;
        }
        
        ## Uncomment the following code if you wish to use the installer/updater
        ## installer/updater
        #location /w/mw-config/ {
        #       # Do this inside of a location so it can be negated
        #       location ~ \.php$ {
        #               include /etc/nginx/fastcgi_params;
        #               fastcgi_param SCRIPT_FILENAME $document_root/w/mw-config/$fastcgi_script_name;
        #               fastcgi_pass 127.0.0.1:9000; # or whatever port your PHP-FPM listens on
        #       }
        #}
        
        # Handling for the article path (pretty URLs)
        location /wiki/ {
                rewrite ^/wiki(?:/(?<pagename>.*))$ /w/index.php;
        }

        # Allow robots.txt in case you have one
        location = /robots.txt {
        }
        # Explicit access to the root website, redirect to main page (adapt as needed)
        # location = / {
        #       return 301 /wiki/Main_Page;
        # }

        # # Every other entry point will be disallowed.
        # # Add specific rules for other entry points/images as needed above this
        # location / {
        #       return 404;
        # }
        #### All the above rules added for pretty URLs
        client_max_body_size 500m;
}

RedWerks Short URL[edit]

from https://shorturls.redwerks.org/?url=https%3A%2F%2Fwww.slicer.org%2Fwiki%2F 


server {
	# [...]

	# Location for the wiki's root
	location /w/ {
		# Do this inside of a location so it can be negated
		location ~ \.php$ {
			try_files $uri $uri/ =404; # Don't let php execute non-existent php files
			include /etc/nginx/fastcgi_params;
			fastcgi_pass 127.0.0.1:9000;
		}
	}
	
	location /w/images {
		# Separate location for images/ so .php execution won't apply
		
		location ~ ^/w/images/thumb/(archive/)?[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ {
			# Thumbnail handler for MediaWiki
			# This location only matches on a thumbnail's url
			# If the file does not exist we use @thumb to run the thumb.php script
			try_files $uri $uri/ @thumb;
		}
	}
	location /w/images/deleted {
		# Deny access to deleted images folder
		deny	all;
	}
	
	# Deny access to folders MediaWiki has a .htaccess deny in
	location /w/cache       { deny all; }
	location /w/languages   { deny all; }
	location /w/maintenance { deny all; }
	location /w/serialized  { deny all; }
	
	# Just in case, hide .svn and .git too
	location ~ /.(svn|git)(/|$) { deny all; }
	
	# Hide any .htaccess files
	location ~ /.ht { deny all; }
	
	# Uncomment the following code if you wish to hide the installer/updater
	## Deny access to the installer
	#location /w/mw-config { deny all; }
	
	# Handling for the article path
	location /wiki {
		include /etc/nginx/fastcgi_params;
		# article path should always be passed to index.php
		fastcgi_param SCRIPT_FILENAME	$document_root/w/index.php;
		fastcgi_pass  127.0.0.1:9000;
	}
	
	# Thumbnail 404 handler, only called by try_files when a thumbnail does not exist
	location @thumb {
		# Do a rewrite here so that thumb.php gets the correct arguments
		rewrite ^/w/images/thumb/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2;
		rewrite ^/w/images/thumb/archive/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2&archived=1;
		
		# Run the thumb.php script
		include /etc/nginx/fastcgi_params;
		fastcgi_param SCRIPT_FILENAME	$document_root/w/thumb.php;
		fastcgi_pass  127.0.0.1:9000;
	}
	
	# [...]
}

The Ultimate Pretty URL configuration for MediaWiki on Nginx[edit]

Warning, this config is a work in progress and has KNOWN deficiencies (e.g. thumbnails not working)
# This file is managed remotely, all changes will be lost

# nginx server configuration for:
#    - https://wiki.ncigt.org/

server {
    listen 80;
    listen [::]:80;
    server_name wiki.ncigt.org;
    root /var/www/clients/wiki.ncigt.org;
    include snippets/acme-challenge.conf;
    location / {
            return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl http2;

    ssl_certificate           /etc/letsencrypt/live/labs.qualitybox.us/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/labs.qualitybox.us/privkey.pem;
    ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers               "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH"; # TLS cipher suites set: bettercrypto_org__set_b_pfs
    ssl_dhparam               /etc/pki/dhparam/set0;
    ssl_ecdh_curve            secp384r1;
    ssl_stapling              on;
    ssl_stapling_verify       on;
    ssl_trusted_certificate   /etc/pki/realms/domain/trusted.crt;
    resolver                  8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout          5s;
    add_header                Strict-Transport-Security "max-age=15768000; includeSubDomains";
    add_header                X-Content-Type-Options "nosniff" always;
    add_header                X-Frame-Options "SAMEORIGIN" always;
    add_header                X-XSS-Protection "1; mode=block";
    add_header                Referrer-Policy "same-origin";

    server_name wiki.ncigt.org;

    root /var/www/clients/wiki.ncigt.org;

    include snippets/acme-challenge.conf;

    keepalive_timeout 60;

    access_log /var/log/nginx/wiki.ncigt.org_access.log;
    error_log /var/log/nginx/wiki.ncigt.org_error.log;
    index index.html index.htm index.php;

    # [...]

    # setup simple way to take site down
    if (-f $document_root/maintenance.html) {
        return 503;
    }
    error_page 503 @maintenance;
    location @maintenance {
        rewrite ^(.*)$ /maintenance.html break;
    }

    # Disallow access to hidden files and directories, except `/.well-known/`
    # https://www.mnot.net/blog/2010/04/07/well-known
    # https://tools.ietf.org/html/rfc5785
    location ~ /\.(?!well-known/) {
        return 404;
    }

    location = /nginx_status {
        stub_status on;
        access_log off;
        allow 127.0.0.1/32;
        allow ::1/128;
        allow 67.205.190.17;
        allow 10.10.0.11;
        allow 10.136.225.163;
        deny all;
    }
    # Favicon
    location = /favicon.ico {
        alias /w/images/6/64/Favicon.ico;
        add_header Cache-Control "public";
        expires 7d;
        access_log off;
        log_not_found off;
    }

    # Location for the wiki's root
    location /w/ {
        # Do this inside of a location so it can be negated
        location ~ \.php$ {
            try_files $uri $uri/ =404; # Don't let php execute non-existent php files
            include fastcgi.conf;
            #Mitigate HTTPOXY attacks (https://httpoxy.org)
            fastcgi_param HTTP_PROXY "";
            fastcgi_pass php5_www-data;
        }
        # MediaWiki assets (usually images)
        location ~ ^/w/resources/(assets|lib|src) {
            try_files $uri 404;
            add_header Cache-Control "public";
            expires 7d;
        }
        # Assets, scripts and styles from skins and extensions
        location ~ ^/w/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg)$ {
            try_files $uri 404;
            add_header Cache-Control "public";
            expires 7d;
        }
    }

    # Separate location for images/ so .php execution won't apply
    location /w/images {
        
        location ~ ^/w/images/thumb/(archive/)?[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ {
            # Thumbnail handler for MediaWiki
            # This location only matches on a thumbnail's url
            # If the file does not exist we use @thumb to run the thumb.php script
            try_files $uri $uri/ @thumb;
        }
    }
    # Thumbnail 404 handler, only called by try_files when a thumbnail does not exist
    location @thumb {
        # Do a rewrite here so that thumb.php gets the correct arguments
        rewrite ^/w/images/thumb/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2;
        rewrite ^/w/images/thumb/archive/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2&archived=1;
        
        # Run the thumb.php script
        include /etc/nginx/fastcgi_params;
        fastcgi_param SCRIPT_FILENAME    $document_root/w/thumb.php;
        fastcgi_pass php5_www-data;
    }

    # Deny access to deleted images folder
    location /w/images/deleted { deny    all; }
    
    # Deny access to folders MediaWiki has a .htaccess deny in
    location /w/cache       { deny all; }
    location /w/languages   { deny all; }
    location /w/maintenance { deny all; }
    location /w/serialized  { deny all; }

    # Deny access to the installer
    location /w/mw-config { deny all; }

    # Handling for the article path
    location /wiki {
        include /etc/nginx/fastcgi_params;
        # article path should always be passed to index.php
        fastcgi_param SCRIPT_FILENAME    $document_root/w/index.php;
        fastcgi_pass php5_www-data;
    }
}

Uniform Resource Locator = an address of a web page or other component, including the protocol.

HyperText Transfer Protocol = the foundation of data communication for the World Wide Web. See HTML

PHP is the HyperText Preprocessor = the most popular programming language for the web

Uniform Resource Locator = an address of a web page or other component, including the protocol.

Transport Layer Security

Retrieved from "https://wiki.freephile.org/wiki/index.php?title=Pretty_URL/mediawiki&oldid=9480"
Powered by QualityBox
Powered by Semantic MediaWiki