hackaust
By:
hackaust

How to definitively isolate multiple Wordpress websites with NginX, HHVM and LetsEncrypt?

December 22, 2016 248 views
Nginx Security Let's Encrypt WordPress PHP LEMP FAQ Ubuntu 16.04

I created a droplet in ubuntu 16.04 following the following tutorial and it works like a charm:
https://www.digitalocean.com/community/tutorials/how-to-install-hhvm-with-nginx-on-ubuntu-14-04.
My goal is to create a shared hosting for my clients projects to replace my current Apache server with PHP-FPM running PHP 5.6 (they will not have access to the server).
Searching I did not find a definitive way to isolate the execution of these websites in different users as it is traditionally done by PHP -FPM to increase security.
Is this isolation necessary for this scenario? how to do this?
Any help is very welcome.
Thank you!

4 Answers

If your users will have no direct access to the server this step should not be necessary. Should you choose to go forward, this guide seems to have all the bases covered on how to configure PHP-FPM for this type of use-case.

I am going to work on this same scenario on a debian 8 install. I intend to follow this - https://www.digitalocean.com/community/tutorials/how-to-set-up-nginx-server-blocks-virtual-hosts-on-ubuntu-16-04

When using the Nginx web server, server blocks (similar to the virtual hosts in Apache) can be used to encapsulate configuration details and host more than one domain off of a single server. In this guide, we'll discuss how to configure server blocks in Nginx on an Ubuntu...

Thanks ryanpq for the quick reply.
I understood your point of view regarding security, but I would like to know how to isolate the websites in the new environment that is Nginx with HHVM, maybe I was not clear enough in my initial question. Thank you anyway!

Hi, I finally go it going.
You need one hhvm installation and the rest will work. Follow these tuts:

https://www.howtoforge.com/tutorial/install-wordpress-nginx-mariadb-hhvm-debian-8/
https://www.digitalocean.com/community/tutorials/how-to-set-up-wordpress-multisite-with-nginx-on-ubuntu-14-04

I strongly recommend you use MariaDB instead of MySQL

And the Nginx will look like these FOR EACH SITE. Place the blocks at /etc/nginx/sites-available/default (you can make a copy of default and then delete everything)

#Start of server blocks FOR EACH DOMAIN

# HTTP - redirect all requests to HTTPS:
server {
        listen 80;
        #listen [::]:80 default_server ipv6only=on;
        server_name another.com;
        return 301 https://$server_name$request_uri;
}

# HTTPS - proxy requests on to wp app:
server {
        listen 443;
        server_name another.com;

        ssl on;
        # Use certificate and key provided by Let's Encrypt:
        ssl_certificate /etc/letsencrypt/live/another.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/another.com/privkey.pem;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

        root /var/www/html/wordpress;
        include hhvm.conf;

        # Add index.php to the list if you are using PHP
        index index.php index.html index.htm index.nginx-debian.html;

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ /favicon.ico {
            access_log off;
            log_not_found off;
        }

        # pass the PHP scripts to FastCGI server listening on sockets

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                # With php7.0-fpm:
                fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        }

        access_log  /var/log/nginx/$host-access.log;
        error_log   /var/log/nginx/wordpress-error.log;

}

All the best.

by Jesin A
This tutorial will show you how to set up WordPress Multisite with subdomains on an Nginx web server. This allows you to run multiple unrelated websites, with their own domains, from a single WordPress admin panel.
Have another answer? Share your knowledge.