Vanilla Vanilla Forums 2.5.1+ vhost Configuration

Vanilla Forums 2.5.1+ vhost Configuration

---

Available on Github: Centmin mod nginx vhost configuration for Vanilla Forums software.

Code:

# Vanilla Forums 2.5.1+ working NGINX site conf file for use with Centminmod.
# Vanilla Forums:  https://vanillaforums.com/en/
# Vanilla Forums nginx docs:  https://docs.vanillaforums.com/developer/backend/server-nginx/
# Vanilla Forums github:  https://github.com/vanilla
# Centmin mod:  https://centminmod.com
# Centmin mod forum thread: https://community.centminmod.com/threads/vanilla-forums-2-5-1-vhost-configuration.14335/

# This file is for a FORCED SSL site.  Non-SSL requests will be directed to SSL.
# 10.0.0.123 is a demo IP.  Replace with your domain. Example:  yourdomain.com
# Thanks to @eva2000 from Centminmod for all your help!

# Redirect to HTTPS from port 80
# Redirect from www to non-www with forced SSL
server {
    listen  80;
    # listen []:80 ipv6only=off;
    server_name 10.0.0.123 www.10.0.0.123;
    return 301 https://10.0.0.123$request_uri;

    # Error Logs via 80
    access_log /home/nginx/domains/10.0.0.123/log/access_via80_123.log combined buffer=256k flush=5m;
    error_log /home/nginx/domains/10.0.0.123/log/error_via80_123.log;
}

server {
    listen 10.0.0.123:443 ssl http2;
    # listen []:443 ssl http2 ipv6only=off;
    server_name  10.0.0.123;

    # Will re-direct any SSL requests for www to non-www
    # https://centminmod.com/nginx_domain_dns_setup.html#httpsredirect
    if ($host = 'www.10.0.0.123' ) {
        return 301 https://10.0.0.123$request_uri;
    }

    ssl_dhparam /usr/local/nginx/conf/ssl/10.0.0.123/dhparam.pem;
    ssl_certificate      /usr/local/nginx/conf/ssl/10.0.0.123/10.0.0.123.crt;
    ssl_certificate_key  /usr/local/nginx/conf/ssl/10.0.0.123/10.0.0.123.key;
    include /usr/local/nginx/conf/ssl_include.conf;

    # Cloudflare authenticated origin pull cert community.centminmod.com/threads/13847/
    # ssl_client_certificate /usr/local/nginx/conf/ssl/cloudflare/blockchaintalk.org/origin.crt;
    # ssl_verify_client on;

    http2_max_field_size 16k;
    http2_max_header_size 32k;

    # Dual Cert Supported SSL Ciphers
    ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS;
    ssl_prefer_server_ciphers   on;

    # add_header Alternate-Protocol  443:npn-spdy/3;

    # HTTP Public Key Pinning Header uncomment only one that applies include or exclude domains.
    # You'd want to include subdomains if you're using SSL wildcard certificates
    # include subdomain
    # add_header Public-Key-Pins 'pin-sha256="kUtRfCe0JWOz1gw4DOGvf15QCfSLkIrlu+eOpf/PFOg="; pin-sha256="7nF+BczNEgtaZKE9fU80QwigQ+9Ip5S4AhR8CYM/U70="; max-age=86400; includeSubDomains';
    # exclude subdomains
    # add_header Public-Key-Pins 'pin-sha256="kUtRfCe0JWOz1gw4DOGvf15QCfSLkIrlu+eOpf/PFOg="; pin-sha256="7nF+BczNEgtaZKE9fU80QwigQ+9Ip5S4AhR8CYM/U70="; max-age=86400';

    # before enabling HSTS line below read centminmod.com/nginx_domain_dns_setup.html#hsts
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Xss-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin";
    # spdy_headers_comp 5;
    ssl_buffer_size 1369;
    ssl_session_tickets on;

    # OCSP Stapling
    # resolver 8.8.8.8 8.8.4.4 valid=10m;
    # resolver_timeout 10s;
    # ssl_stapling on;
    # ssl_stapling_verify on;
    # ssl_trusted_certificate /usr/local/nginx/conf/ssl/10.0.0.121/10.0.0.121-trusted.crt;

    # ngx_pagespeed & ngx_pagespeed handler
    # include /usr/local/nginx/conf/pagespeed.conf;
    # include /usr/local/nginx/conf/pagespeedhandler.conf;
    # include /usr/local/nginx/conf/pagespeedstatslog.conf;

    # Limit Connections Per IP Address
    # Modified from default to allow Admin directory to have more connections
    # Modified in nginx.conf
    # limit_conn_zone $limitconn_map zone=limit_per_ip:16m;

    # ssi  on;

    # Error Logs via 443
    access_log /home/nginx/domains/10.0.0.123/log/access_via443_123.log combined buffer=256k flush=60m;
    error_log /home/nginx/domains/10.0.0.123/log/error_via443_123.log;

    # CMM Autoprotect
    include /usr/local/nginx/conf/autoprotect/10.0.0.123/autoprotect-10.0.0.123.conf;

    # Root folder of project
    root /home/nginx/domains/10.0.0.123/public;

    # Cloudflare
    # uncomment cloudflare.conf include if using cloudflare for server and/or vhost site
    # include /usr/local/nginx/conf/cloudflare.conf;

    # Centmin Mod Maintenance Pages
    include /usr/local/nginx/conf/503include-main.conf;

    # location ~ ^/ {
    #     auth_basic "Private";
    #     auth_basic_user_file /usr/local/nginx/conf/htpasswd_site;
    #     include /usr/local/nginx/conf/php.conf;
    #     try_files    $uri $uri/ /index.php;
    # }

    # Prevent access to ./directories and files
    location ~ (?:^|/)\. {
        deny all;
    }
   
    # Vanilla Forums Deny Locations
    location ~* "^/build/" {
        access_log off;
        log_not_found off;
        deny all;
    }
    location ~* "^/cache/" {
        access_log off;
        log_not_found off;
        deny all;
    }
    location ~* "^/cgi-bin/" {
        access_log off;
        log_not_found off;
        deny all;
    }
    location ~* "^/uploads/import/" {
        access_log off;
        log_not_found off;
        deny all;
    }
    location ~* "^/conf/" {
        access_log off;
        log_not_found off;
        deny all;
    }
    location ~* "^/tests/" {
        access_log off;
        log_not_found off;
        deny all;
    }
    location ~* "^/vendor/" {
        access_log off;
        log_not_found off;
        deny all;
    }

    location / {

        include /usr/local/nginx/conf/503include-only.conf;

        # block common exploits, sql injections etc
        include /usr/local/nginx/conf/block.conf;

        # Enables directory listings when index file not found
        # autoindex  on;

        # Shows file listing times as local time
        autoindex_localtime on;

        try_files $uri $uri/ @vanilla;

    }

    location @vanilla {
        rewrite ^ /index.php$uri last;
    }

    include /usr/local/nginx/conf/staticfiles.conf;
    include /usr/local/nginx/conf/php.conf;
    include /usr/local/nginx/conf/drop.conf;
    include /usr/local/nginx/conf/errorpage.conf;
    include /usr/local/nginx/conf/vts_server.conf;
}

Add the below line to your php.conf file:

Code:

fastcgi_param X_REWRITE 1;

 

I can confirm that adding the rewrite to the conf file works. Didn't see docs on that.

I guess I should put those deny blocks above the try_files.

With the right theme, vanilla forums will allow me to deploy a large number of forums and move the forums which gain traction to IPB.

The theme choices for vanilla forums really stink. Most of them look like they're from 2000 and other others don't work.

 

Oh, VF recommended using @ so the index.php file isn't called directly.

I actually modified the IPB vhost file with the @ locations too.

 

It seems like a nice forums package. I like that it's open source.

I first went through all the plugins and themes to see what was offered above the basic forum stuff.

 

Looks like I'm going to need X_REWRITE 1; after all. nprestarted my server and none of the links worked.

 

Not with your exact rules. But our rules are pretty much the same.

1. Without the line in the php.conf or VF conf = ugly urls. Pretty urls basically off.

2. Line only in the VF conf = site works but only page that shows is the home page, no matter what link you click on.

3. Line only in the php.conf = pretty urls.

4. Line in the php.conf && VF conf = pretty urls.

 

Why would VF specifically request to put in the X_REWRITE if putting the line in the VF config = pretty urls? It would be a lot easier to tell people to put X line in the VF config.

Why would VF request adding that and what does CMM do that results in not having to use the X_REWRITE?

I'll test what you listed, but I think overall, I'll add the X_ because maybe in bleeding edge situations it's needed IDK???

 

I did a search for X_ in CMM but didn't think to do a search of VF, good call.

So, we use the X_ and not the line in the config. Glad we cleared this up.

Looks like VF might be the next forum software in line for assimilation.

 

Maybe you should start a dedicated thread for VF?

 

Would there be any reason why X_ couldn't be included in the default php.conf file? Would having that hurt anything (Xenforo, IPB, WP, etc)?

 

Where did you get the below from?

Code:

location @site {
     rewrite ^ /index.php?p=$uri&$args last;
}

VF install docs: Vanilla Forums Documentation

Code:

location @vanilla {
     rewrite ^ /index.php$uri last;
}