Pretty URL/mediawiki

From Freephile Wiki

The purpose of this page is to merge two different configurations for Pretty URLs for MediaWiki on Nginx into the ultimate configuration. The first is my current configuration which is a combination of what comes from DebOps, and the code found on MediaWiki.org. The second is the suggested configuration from shorturls.redwerks.com The configuration file for translatewiki.net as provided by @nikerabbit should be used as a reference in simplicity.


My Nginx Conf[edit | edit source]

server {

        # [...]

        if (-f $document_root/maintenance.html) {
                return 503;
        }
        error_page 503 @maintenance;
        location @maintenance {
                rewrite ^(.*)$ /maintenance.html break;
        }

        # Disallow access to hidden files and directories, except `/.well-known/`
        # https://www.mnot.net/blog/2010/04/07/well-known
        # https://tools.ietf.org/html/rfc5785
        location ~ /\.(?!well-known/) {
                return 404;
        }

        #location = /favicon.ico {
        #        try_files /favicon.ico =204;
        #        access_log off;
        #        log_not_found off;
        #}

        location = /nginx_status {
                stub_status on;
                access_log off;
                allow 127.0.0.1/32;
                allow ::1/128;
                allow 67.205.190.17;
                allow 10.10.0.11;
                allow 10.136.225.163;
                deny all;
        }

        location ~ ^(?!.+\.php/)(?<script_name>.+\.php)$ {
                try_files $script_name =404;

                include fastcgi.conf;

                # Mitigate HTTPOXY attacks (https://httpoxy.org/)
                fastcgi_param HTTP_PROXY "";

                fastcgi_index index.php;
                fastcgi_pass php5_www-data;
        }

        location ~ ^(?<script_name>.+\.php)(?<path_info>/.*)$ {
                try_files $script_name =404;

                include fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$script_name;
                fastcgi_param PATH_INFO $path_info;
                #fastcgi_param PATH_TRANSLATED $document_root$path_info;

                # Mitigate HTTPOXY attacks (https://httpoxy.org/)
                fastcgi_param HTTP_PROXY "";

                fastcgi_index index.php;
                fastcgi_pass php5_www-data;
        }
        #### All the following rules added for pretty URLs
        location ~ ^/w/(index|load|api|thumb|opensearch_desc)\.php$ {
                include /etc/nginx/fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                fastcgi_pass 127.0.0.1:9000; # or whatever port your PHP-FPM listens on
        }
        
        # Images
        location /w/images {
                # Separate location for images/ so .php execution won't apply
        }
        location /w/images/deleted {
                # Deny access to deleted images folder
                deny all;
        }
        # MediaWiki assets (usually images)
        location ~ ^/w/resources/(assets|lib|src) {
                try_files $uri 404;
                add_header Cache-Control "public";
                expires 7d;
        }
        # Assets, scripts and styles from skins and extensions
        location ~ ^/w/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg)$ {
                try_files $uri 404;
                add_header Cache-Control "public";
                expires 7d;
        }
        # Favicon
        location = /favicon.ico {
                alias /w/images/6/64/Favicon.ico;
                add_header Cache-Control "public";
                expires 7d;
                access_log off;
                log_not_found off;
        }
        
        ## Uncomment the following code if you wish to use the installer/updater
        ## installer/updater
        #location /w/mw-config/ {
        #       # Do this inside of a location so it can be negated
        #       location ~ \.php$ {
        #               include /etc/nginx/fastcgi_params;
        #               fastcgi_param SCRIPT_FILENAME $document_root/w/mw-config/$fastcgi_script_name;
        #               fastcgi_pass 127.0.0.1:9000; # or whatever port your PHP-FPM listens on
        #       }
        #}
        
        # Handling for the article path (pretty URLs)
        location /wiki/ {
                rewrite ^/wiki(?:/(?<pagename>.*))$ /w/index.php;
        }

        # Allow robots.txt in case you have one
        location = /robots.txt {
        }
        # Explicit access to the root website, redirect to main page (adapt as needed)
        # location = / {
        #       return 301 /wiki/Main_Page;
        # }

        # # Every other entry point will be disallowed.
        # # Add specific rules for other entry points/images as needed above this
        # location / {
        #       return 404;
        # }
        #### All the above rules added for pretty URLs
        client_max_body_size 500m;
}

RedWerks Short URL[edit | edit source]

from https://shorturls.redwerks.org/?url=https%3A%2F%2Fwww.slicer.org%2Fwiki%2F 


server {
	# [...]

	# Location for the wiki's root
	location /w/ {
		# Do this inside of a location so it can be negated
		location ~ \.php$ {
			try_files $uri $uri/ =404; # Don't let php execute non-existent php files
			include /etc/nginx/fastcgi_params;
			fastcgi_pass 127.0.0.1:9000;
		}
	}
	
	location /w/images {
		# Separate location for images/ so .php execution won't apply
		
		location ~ ^/w/images/thumb/(archive/)?[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ {
			# Thumbnail handler for MediaWiki
			# This location only matches on a thumbnail's url
			# If the file does not exist we use @thumb to run the thumb.php script
			try_files $uri $uri/ @thumb;
		}
	}
	location /w/images/deleted {
		# Deny access to deleted images folder
		deny	all;
	}
	
	# Deny access to folders MediaWiki has a .htaccess deny in
	location /w/cache       { deny all; }
	location /w/languages   { deny all; }
	location /w/maintenance { deny all; }
	location /w/serialized  { deny all; }
	
	# Just in case, hide .svn and .git too
	location ~ /.(svn|git)(/|$) { deny all; }
	
	# Hide any .htaccess files
	location ~ /.ht { deny all; }
	
	# Uncomment the following code if you wish to hide the installer/updater
	## Deny access to the installer
	#location /w/mw-config { deny all; }
	
	# Handling for the article path
	location /wiki {
		include /etc/nginx/fastcgi_params;
		# article path should always be passed to index.php
		fastcgi_param SCRIPT_FILENAME	$document_root/w/index.php;
		fastcgi_pass  127.0.0.1:9000;
	}
	
	# Thumbnail 404 handler, only called by try_files when a thumbnail does not exist
	location @thumb {
		# Do a rewrite here so that thumb.php gets the correct arguments
		rewrite ^/w/images/thumb/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2;
		rewrite ^/w/images/thumb/archive/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2&archived=1;
		
		# Run the thumb.php script
		include /etc/nginx/fastcgi_params;
		fastcgi_param SCRIPT_FILENAME	$document_root/w/thumb.php;
		fastcgi_pass  127.0.0.1:9000;
	}
	
	# [...]
}

The Ultimate Pretty URL configuration for MediaWiki on Nginx[edit | edit source]

Warning, this config is a work in progress and has KNOWN deficiencies (e.g. thumbnails not working)
# This file is managed remotely, all changes will be lost

# nginx server configuration for:
#    - https://wiki.ncigt.org/

server {
    listen 80;
    listen [::]:80;
    server_name wiki.ncigt.org;
    root /var/www/clients/wiki.ncigt.org;
    include snippets/acme-challenge.conf;
    location / {
            return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl http2;

    ssl_certificate           /etc/letsencrypt/live/labs.qualitybox.us/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/labs.qualitybox.us/privkey.pem;
    ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers               "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH"; # TLS cipher suites set: bettercrypto_org__set_b_pfs
    ssl_dhparam               /etc/pki/dhparam/set0;
    ssl_ecdh_curve            secp384r1;
    ssl_stapling              on;
    ssl_stapling_verify       on;
    ssl_trusted_certificate   /etc/pki/realms/domain/trusted.crt;
    resolver                  8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout          5s;
    add_header                Strict-Transport-Security "max-age=15768000; includeSubDomains";
    add_header                X-Content-Type-Options "nosniff" always;
    add_header                X-Frame-Options "SAMEORIGIN" always;
    add_header                X-XSS-Protection "1; mode=block";
    add_header                Referrer-Policy "same-origin";

    server_name wiki.ncigt.org;

    root /var/www/clients/wiki.ncigt.org;

    include snippets/acme-challenge.conf;

    keepalive_timeout 60;

    access_log /var/log/nginx/wiki.ncigt.org_access.log;
    error_log /var/log/nginx/wiki.ncigt.org_error.log;
    index index.html index.htm index.php;

    # [...]

    # setup simple way to take site down
    if (-f $document_root/maintenance.html) {
        return 503;
    }
    error_page 503 @maintenance;
    location @maintenance {
        rewrite ^(.*)$ /maintenance.html break;
    }

    # Disallow access to hidden files and directories, except `/.well-known/`
    # https://www.mnot.net/blog/2010/04/07/well-known
    # https://tools.ietf.org/html/rfc5785
    location ~ /\.(?!well-known/) {
        return 404;
    }

    location = /nginx_status {
        stub_status on;
        access_log off;
        allow 127.0.0.1/32;
        allow ::1/128;
        allow 67.205.190.17;
        allow 10.10.0.11;
        allow 10.136.225.163;
        deny all;
    }
    # Favicon
    location = /favicon.ico {
        alias /w/images/6/64/Favicon.ico;
        add_header Cache-Control "public";
        expires 7d;
        access_log off;
        log_not_found off;
    }

    # Location for the wiki's root
    location /w/ {
        # Do this inside of a location so it can be negated
        location ~ \.php$ {
            try_files $uri $uri/ =404; # Don't let php execute non-existent php files
            include fastcgi.conf;
            #Mitigate HTTPOXY attacks (https://httpoxy.org)
            fastcgi_param HTTP_PROXY "";
            fastcgi_pass php5_www-data;
        }
        # MediaWiki assets (usually images)
        location ~ ^/w/resources/(assets|lib|src) {
            try_files $uri 404;
            add_header Cache-Control "public";
            expires 7d;
        }
        # Assets, scripts and styles from skins and extensions
        location ~ ^/w/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg)$ {
            try_files $uri 404;
            add_header Cache-Control "public";
            expires 7d;
        }
    }

    # Separate location for images/ so .php execution won't apply
    location /w/images {
        
        location ~ ^/w/images/thumb/(archive/)?[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ {
            # Thumbnail handler for MediaWiki
            # This location only matches on a thumbnail's url
            # If the file does not exist we use @thumb to run the thumb.php script
            try_files $uri $uri/ @thumb;
        }
    }
    # Thumbnail 404 handler, only called by try_files when a thumbnail does not exist
    location @thumb {
        # Do a rewrite here so that thumb.php gets the correct arguments
        rewrite ^/w/images/thumb/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2;
        rewrite ^/w/images/thumb/archive/[0-9a-f]/[0-9a-f][0-9a-f]/([^/]+)/([0-9]+)px-.*$ /w/thumb.php?f=$1&width=$2&archived=1;
        
        # Run the thumb.php script
        include /etc/nginx/fastcgi_params;
        fastcgi_param SCRIPT_FILENAME    $document_root/w/thumb.php;
        fastcgi_pass php5_www-data;
    }

    # Deny access to deleted images folder
    location /w/images/deleted { deny    all; }
    
    # Deny access to folders MediaWiki has a .htaccess deny in
    location /w/cache       { deny all; }
    location /w/languages   { deny all; }
    location /w/maintenance { deny all; }
    location /w/serialized  { deny all; }

    # Deny access to the installer
    location /w/mw-config { deny all; }

    # Handling for the article path
    location /wiki {
        include /etc/nginx/fastcgi_params;
        # article path should always be passed to index.php
        fastcgi_param SCRIPT_FILENAME    $document_root/w/index.php;
        fastcgi_pass php5_www-data;
    }
}

Uniform Resource Locator = an address of a web page or other component, including the protocol.

HyperText Transfer Protocol = the foundation of data communication for the World Wide Web. See HTML

PHP is the HyperText Preprocessor = the most popular programming language for the web

Uniform Resource Locator = an address of a web page or other component, including the protocol.

Transport Layer Security

Retrieved from "https://wiki.freephile.org/wiki/index.php?title=Pretty_URL/mediawiki&oldid=9480"
Powered by QualityBox
Powered by Semantic MediaWiki