Stuck on nginx multisite Wordpress (LEMP)

Thanks so much to everyone!!

Hi, thanks for the answer. I’m having now this issue: Connection refused (111), your cache admin is root. It seems to have a problem with the permissions for the new users.

@francarranza

When it comes to PHP-FPM, it’s best to setup a new user for each site, and in turn, a separate config file for each.

Side Note – Take your time on this, it’s lengthy and easy to overlook a step.

The default configuration should be located in:

/etc/php/7.0/fpm/pool.d

In that directory, you should see a file (if you’ve not changed the name) named www.conf. That’s the base configuration file that’ll help you get started.

…

To get started, what I would do is create three users:

useradd -d /var/www/wargostudio wargostudio

useradd -d /var/www/oncativosa oncativosa

useradd -d /var/www/jaliscopaletas jaliscopaletas

What these commands do is create a new user, which we’ll use to setup individual PHP-FPM pools. The -d defines the home directory for the user.

…

Now, with our new users, we’ll create our individual pool files by copying the current pool.

cp /etc/php/7.0/fpm/pool.d/www.conf /etc/php/7.0/fpm/pool.d/wargostudio.conf

cp /etc/php/7.0/fpm/pool.d/www.conf /etc/php/7.0/fpm/pool.d/oncativosa.conf

cp /etc/php/7.0/fpm/pool.d/www.conf /etc/php/7.0/fpm/pool.d/jaliscopaletas.conf

Now, we can simply remove www.conf unless you want to keep it (you can always copy one of the others to a new file using the same command, so it’s not really needed):

rm /etc/php/7.0/fpm/pool.d/www.conf

Now, inside of each of those files, you’ll want to modify the fourth line, which should be:

[www]

Change that to [wargostudio], [oncativosa], or [jaliscopaletas] depending on the file.

Now you’ll want to find:

user = www-data
group = www-data

Change that to:

user = wargostudio
group = wargostudio

user = oncativosa
group = oncativosa

user = jaliscopaletas
group = jaliscopaletas

Now you’ll want to find:

listen = /run/php/php7.0-fpm.sock

And change that to:

listen = /run/php/php7.0-fpm.wargostudio.sock

listen = /run/php/php7.0-fpm.oncativosa.sock

listen = /run/php/php7.0-fpm.jaliscopaletas.sock

As above, the line corresponds to the user we created. This helps us to keep things separated.

Now, finally, in each of the files, find:

listen.owner = www-data
listen.group = www-data

And, much like we did with the previous, change that to:

listen.owner = wargostudio
listen.group = wargostudio

listen.owner = oncativosa
listen.group = oncativosa

listen.owner = jaliscopaletas
listen.group = jaliscopaletas

That’s all we need to change in the PHP-FPM configuration files. We then need to make sure that we set our NGINX server block up to reflect the new sockets.

Find each instance of:

fastcgi_pass unix:/run/php/php7.0-fpm.sock;

And change the path to the socket so that it corresponds with the new user / socket.

fastcgi_pass unix:/run/php/php7.0-fpm.wargostudio.sock;

fastcgi_pass unix:/run/php/php7.0-fpm.oncativosa.sock;

fastcgi_pass unix:/run/php/php7.0-fpm.jaliscopaletas.sock;

The reason for doing all this extra work is to ensure that we have actual separation. It’s not just extra work, rather, it’s adding a layer of security. It separates each user by process as well as prevents one user form modifying the files of another – that’s not possible if every site uses www-data.

Now, we need to make sure permissions are correct. Since we setup new users, we need to make sure our directories and files are owned by these users.

chown -R wargostudio:wargostudio /var/www/wargostudio

chown -R oncativosa:oncativosa /var/www/oncativosa

chown -R jaliscopaletas:jaliscopaletas /var/www/jaliscopaletas

…

At this point, you need to restart PHP-FPM and NGINX:

service php7.0-fpm restart

service nginx restart

…

With proper separation and proper permissions, if there are any errors that pop up, they should be more specific.

It’s not recommended to run every site under the same user (i.e. www-data), which is the point of doing all this – and it should be done for each site, ideally.

Beyond the above, I would start with the most basic NGINX configuration possible until you’re up and running 100%. Then add extras to tighten security, work with SSL, etc.

So what I would do is reduce those server blocks down to:

server {
    listen [::]:80 default_server;
    server_name wargostudio.com www.wargostudio.com;
    
    root /var/www/wargostudio;

    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.wargostudio.sock;
    }
}

server {
    listen [::]:80;
    server_name oncativosa.wargostudio.com;

    root /var/www/oncativosa;

    index index.php index.html index.htm index.nginx-debian.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.oncativosa.sock;
    }
}

server {
    listen [::]:80;
    server_name jalisco.wargostudio.com;

    root /var/www/jaliscopaletas;

    index index.php index.html index.htm index.nginx-debian.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.jaliscopaletas.sock;
    }
}

I’ve already modified the socket line in the above for you, so you should be able to just copy and paste.

Make Sure you backup the others first, just in case you need them for reference. The above should work, but it’s nice to have something to fall back to.