Raspberry Pi nginx-wordpressでリバースプロキシを構築

立ち上げっている「WordPressサイト」の数＝４。

user  nginx;
worker_processes auto;
worker_rlimit_nofile 100000;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections 1024;
    multi_accept on;
    use epoll;
}

http {
    server_tokens off;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    access_log off;
    keepalive_timeout 10;
    client_header_timeout 10;
    client_body_timeout 10;
    reset_timedout_connection on;
    send_timeout 10;
    limit_conn_zone $binary_remote_addr zone=addr:5m;
    limit_conn addr 100;

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

	##
	# SSL Perfect Forward Secrecy（PFS）を有効にする Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	# 安全でない暗号化スイートはサポートしない
	# ssl_ciphers  'ECDH !aNULL !eNULL !SSLv2 !SSLv3';
	ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";

	#HTTP Strict Transport Security --- HSTSの設定
	add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload';

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    gzip  on;
    gzip_vary on;
    gzip_proxied any;
    gzip_min_length 1024;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain
		 text/xml
		 text/css
		 text/javascript
		 image/gif
		 image/png
		 image/jpeg
		 application/javascript
		 application/x-javascript
		 application/json
		 application/xml
		 application/xml+rss
		 application/font-woff
		 application/font-tff
		 application/octet-stream;

    open_file_cache max=100000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;

    # ブラウザキャッシュの設定
    expires 30d;

    server_names_hash_bucket_size 128;

    proxy_buffering       on;
    proxy_buffer_size     8k;
    proxy_buffers         100 8k;
    proxy_cache_path      /var/cache/nginx/proxy_file_cache levels=2:2 keys_zone=cache_key:15m inactive=1d max_size=5g;
    proxy_temp_path       /var/cache/nginx/temp 1 2; 
    proxy_connect_timeout 60;
    proxy_read_timeout    90;
    proxy_send_timeout    60;
    proxy_cache_valid     200 2h;
    proxy_cache_valid     302 2h;
    proxy_cache_valid     301 4h;
    proxy_cache_valid     any 1m;

    include /etc/nginx/conf.d/*.conf;
}

server {
        listen 80;
        server_name www.arakan60.mydns.jp;
        return 301 https://arakan60.mydns.jp$request_uri;
}

server {
	listen 80;
	server_name arakan60.mydns.jp;
	return 301 https://$host$request_uri;
}

server {
	listen 443 ssl;
	server_name arakan60.mydns.jp;
	root /home/yaopi/www;
	index index.html index.htm index.php;

	# ssl on;
	ssl_certificate /etc/letsencrypt/live/arakan60.mydns.jp/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/arakan60.mydns.jp/privkey.pem;

	error_page 404 /pc_404.html;
	location = /pc_404.html {
		root /home/yaopi/www;
		internal;
	}	

	client_max_body_size 500M;  # ←追加

	# デフォルト 60秒を300秒までアップします。
	fastcgi_read_timeout 300; 

	# nginx リダイレクト設定

	# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
	#
	location ~ \.php$ {
		fastcgi_split_path_info ^(.+\.php)(/.+)$;
		fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
		fastcgi_index index.php;
		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
		include fastcgi_params;
	}

}

server {
    listen 80;
    server_name arakan60.com;
    rewrite ^(.*)$ https://$host$1 permanent;
}

server {
    listen 443 ssl;
    server_name arakan60.com;

    ssl_certificate /etc/letsencrypt/live/arakan60.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/arakan60.com/privkey.pem; 

    client_max_body_size 500M;  # ←ここにも追加
    fastcgi_read_timeout 300;

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;

    location / {
        proxy_pass https://192.168.11.106;

        # 基本はキャッシュしない
        set $do_not_cache 1;

        # 画像のみキャッシュさせる
        if ($uri ~* "\.(jpg|jpeg|png|gif|css|js|ico)$") {
            set $do_not_cache 0;
        }
        proxy_no_cache $do_not_cache;

        # キャッシュの検索
        proxy_cache_bypass $do_not_cache;
        
        # バックエンド no-cache を無視
        proxy_ignore_headers Cache-Control;
        
        # キャッシュのキーゾーンを指定
        proxy_cache cache_key;
        
        # キャッシュの有効時間を指定
        proxy_cache_valid 200 302 60m;
        proxy_cache_valid 404 10m;
        
        # キャッシュのステータスヘッダーを追加
	add_header X-Cache-Status $upstream_cache_status;
    }
}

user  nginx;
worker_processes auto;
worker_rlimit_nofile 100000;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections 1024;
    multi_accept on;
    use epoll;
}

http {
    server_tokens off;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    access_log off;
    keepalive_timeout 10;
    client_header_timeout 10;
    client_body_timeout 10;
    reset_timedout_connection on;
    send_timeout 10;
    limit_conn_zone $binary_remote_addr zone=addr:5m;
    limit_conn addr 100;

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

	##
	# SSL Perfect Forward Secrecy（PFS）を有効にする Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	# 安全でない暗号化スイートはサポートしない
	# ssl_ciphers  'ECDH !aNULL !eNULL !SSLv2 !SSLv3';
	ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";

	#HTTP Strict Transport Security --- HSTSの設定
	add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload';

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    gzip  on;
    gzip_vary on;
    gzip_proxied any;
    gzip_min_length 1024;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain
		 text/xml
		 text/css
		 text/javascript
		 image/gif
		 image/png
		 image/jpeg
		 application/javascript
		 application/x-javascript
		 application/json
		 application/xml
		 application/xml+rss
		 application/font-woff
		 application/font-tff
		 application/octet-stream;

    open_file_cache max=100000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;

# ブラウザキャッシュの設定
 expires 30d;
#map $sent_http_content_type $expires {
#  default         off;
#  text/css 8d;
#  text/javascript 8d;
#  application/javascript 8d;
#  ~image/         30d;
#}
#expires $expires;

server_names_hash_bucket_size 128;

    proxy_buffering         on;
    fastcgi_buffer_size     8k;
    fastcgi_buffers         100 8k;
    fastcgi_temp_path       /var/cache/nginx/temp 1 2; 
    fastcgi_connect_timeout 60;
    fastcgi_read_timeout    90;
    fastcgi_send_timeout    60;
    fastcgi_cache_valid     200 2h;
    fastcgi_cache_valid     302 2h;
    fastcgi_cache_valid     301 4h;
    fastcgi_cache_valid     any 1m;

# fastcgi cache on arakan60.com
fastcgi_cache_path /var/cache/nginx/arakan60 levels=1:2 keys_zone=arakan60:30m max_size=512M inactive=600m;

fastcgi_cache_key "$scheme$request_method$host$request_uri";

# cache 404 or other
fastcgi_ignore_headers Cache-Control Expires Set-Cookie;

# return old cache if PHP crashes
fastcgi_cache_use_stale error timeout invalid_header http_500;


    include /etc/nginx/conf.d/*.conf;
}

server {
        listen 80;
	server_name www.arakan60.com;
        return 301 https://arakan60.com$request_uri;
}

server {
	listen 443 ssl;
	server_name www.arakan60.com;
	
	# ssl on;
	ssl_certificate /etc/letsencrypt/live/www.arakan60.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/www.arakan60.com/privkey.pem;
	return 301 https://arakan60.com$request_uri;
}

server {
        listen 80;
	server_name arakan60.com;
        return 301 https://arakan60.com$request_uri;
}

server {
	listen 443 ssl;
	server_name arakan60.com;
	root /home/yaopi/www/wordpress;
	index index.htm index.php;
	
	# ssl on;
	ssl_certificate /etc/letsencrypt/live/arakan60.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/arakan60.com/privkey.pem; 

	# デフォルト 60秒を300秒までアップします。
	fastcgi_read_timeout 300; 

	client_max_body_size 500M;  # ←追加

	location / {
		try_files $uri $uri/ /index.php;
	}

	#ブラウザキャッシュの設定
	location ~ .*\.(css|js|ico|gif|jpeg|jpg|webp|png|svg|eot|otf|woff|woff2|ttf|ogg) {
		access_log off; #アクセスログをOFF
		expires 30d; #有効期限
	}

	#
	# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
	#
	location ~ \.php$ {
		fastcgi_split_path_info ^(.+\.php)(/.+)$;
	#	fastcgi_pass 127.0.0.1:9000;
		fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
		fastcgi_index index.php;
		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
		include fastcgi_params;

		set $do_not_cache 0;

		### wordpress check to do not cache.
		
		#  -- POST or HEAD ?
		if ($request_method != "GET") {
		set $do_not_cache 1;
		}
		
		#  -- Login or Comment or Post Editting ?
		if ($http_cookie ~ ^.*(comment_author_|wordpress_logged_in|wp-postpass_).*$) {
		set $do_not_cache 1;
		}

		fastcgi_cache arakan60;
		fastcgi_cache_valid 200 60m;
		fastcgi_no_cache $do_not_cache;
		fastcgi_cache_bypass $do_not_cache;
		add_header X-F-Cache $upstream_cache_status;

	}

}

nginx fastcgi キャッシュによる サイトの高速化

Webサーバー サイトの構築 PageSpeed Insights Webサイトの高速化 その-5 キャッシュによる サイトの高速化 Nginx-Wordpressで fastcgi cache

2019-12-12

2020-09-21

server {
	listen 443 ssl;
	server_name arakoki70.com;
	root /home/yaopi/www/;
	index index.html index.htm index.php;
	
	# ssl on;
	ssl_certificate /etc/letsencrypt/live/arakoki70.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/arakoki70.com/privkey.pem; 

	# デフォルト 60秒を300秒までアップします。
	fastcgi_read_timeout 300; 

	client_max_body_size 500M;  # ←追加

	location ~ ^/wp70t/(.+\.php) {
		fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
		fastcgi_index   index.php;
		fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
		include         fastcgi_params;

		set $do_not_cache 0;

		### wordpress check to do not cache.

		#  -- POST or HEAD ?
		if ($request_method != "GET") {
		set $do_not_cache 1;
		}

		#  -- Login or Comment or Post Editting ?
		if ($http_cookie ~ ^.*(comment_author_|wordpress_logged_in|wp-postpass_).*$) {
		set $do_not_cache 1;
		}

		fastcgi_cache wp70t;
		fastcgi_cache_valid 200 60m;
		fastcgi_no_cache $do_not_cache;
		fastcgi_cache_bypass $do_not_cache;
		add_header X-F-Cache $upstream_cache_status;

	}

	location ~ ^/wp70t/(.*)$ {
		index  index.php;
		try_files /wp70t/$1 /wp70t/$1/ /wp70t/index.php?$1&$args;
	}

}

②．バックアップシステムへの交換が簡単にできる。

Raspberry Pi ４台による「リバースプロキシ」システム用に作成したラック。

Raspberry Pi 4 Reverse Proxy Server SSD化による高速化

Raspberry Pi 運用・管理 Raspberry Pi 4 nginx Reverse Proxy Server USB接続の SSD化によるディスクアクセス速度の向上   Raspb

2020-08-03

2023-02-25