NGINX vhost for Chamilo 2

[bragasrc]

Any instructions on how to configure Chamilo 2 on an NGINX server?

[ywarnier]

Nginx + PHP8.3-FPM, or Nginx as a reverse proxy in front of something else?

For Nginx + PHP 8.3-FPM, there's almost nothing to do. Just point your root to the {path-to-chamilo}/public directory, then setup the handling by php8.3-fpm and you should be good to go.

For security hardening, make sure the {path-to-chamilo}/var does not allow interpretation by php-fpm.

If you need more specific instructions, let us know, but if you've ever configured an Nginx+php-fpm before, you should have it easy.

You can find instructions for the Apache+mod-php setup in section 3.3 (here)[https://2.chamilo.org/documentation/installation_guide.html], but most of the php_admin_value tags are then passed on to php-fpm...

[bragasrc]

Hi @ywarnier

The goal is to use NGINX + PHP 8.3. I have this question because the .htaccess file in the root of the public folder contains some instructions to the Apache server, and also because Chamilo 1.x has a series of routing instructions for the NGINX server. Thanks for the reply!

[ywarnier]

This should do the trick. It's experimental so far (first draft), but your confirmation would help decide if it's worth publishing as part of the installation guide and helper files.

You'll have to change the 3 first lines (listen if https, server_name and root) to match your config, and review if php8.3-fpm.sock is located where it says below. Other than that, it's just adding this in your nginx vhosts directory (e.g. /etc/nginx/sites-enabled) or whatever suits you better and reloading nginx.

server {
  listen 80;
  server_name my.chamilo.net;
  root /var/www/chamilo/public;

  index index.php;

  add_header X-Frame-Options        "SAMEORIGIN"                      always;
  add_header X-Content-Type-Options "nosniff"                         always;
  add_header Referrer-Policy        "strict-origin-when-cross-origin" always;

  # Block hidden files (.env, .git, etc.) except Let's Encrypt
  location ~ /\.(?!well-known) {
    deny all;
  }

  # -----------------------------------------------------------------------
  # Pure static directories
  # -----------------------------------------------------------------------
  location ~* ^/(build|bundles|documentation|fonts|img|libs|sound)/ {
    expires 30d;
    add_header Cache-Control "public, immutable";
    try_files $uri =404;
  }

  # -----------------------------------------------------------------------
  # Legacy PHP trees — main/ and plugin/ execute .php files directly
  # -----------------------------------------------------------------------
  location ~ ^/(main|plugin)/ {
    try_files $uri $uri/ =404;

    location ~ \.php$ {
      fastcgi_pass  unix:/var/run/php/php8.3-fpm.sock;
      fastcgi_split_path_info ^(.+\.php)(/.*)$;
      include       fastcgi_params;
      fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
      fastcgi_param DOCUMENT_ROOT   $realpath_root;
      fastcgi_param PATH_INFO       $fastcgi_path_info;
    }
  }

  # -----------------------------------------------------------------------
  # Symfony front controller
  # -----------------------------------------------------------------------
  location / {
    try_files $uri /index.php$is_args$args;
  }

  # -----------------------------------------------------------------------
  # check.php — Symfony requirements checker.
  # PRODUCTION: block public access entirely.
  # DEV/TEST:   comment out this block to allow direct browser access.
  # -----------------------------------------------------------------------
  location = /check.php {
    deny all;
  }

  # -----------------------------------------------------------------------
  # legacy.php — bootstrap included by legacy PHP scripts via require/include.
  # Must never be served over HTTP in any environment.
  # -----------------------------------------------------------------------
  location = /legacy.php {
    deny all;
  }

  # -----------------------------------------------------------------------
  # PHP execution — Symfony entry point only.
  # `internal` ensures direct browser requests to /index.php return 404,
  # preventing duplicate content without needing a redirect.
  # -----------------------------------------------------------------------
  location ~ ^/index\.php$ {
    fastcgi_pass  unix:/var/run/php/php8.3-fpm.sock;
    fastcgi_split_path_info ^(.+\.php)(/.*)$;
    include       fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
    fastcgi_param DOCUMENT_ROOT   $realpath_root;
    fastcgi_param PATH_INFO       $fastcgi_path_info;
    internal;
  }

  # Deny direct access to any other .php at root level
  location ~ \.php$ {
    return 404;
  }
}

[ywarnier]

Note to self: if confirmed, add it to public/documentation/installation_guide.html and as .github/gh-nginx (properly reformatted to use the right domain and path)