Ficheiro template vhost do nginx para prestashop
# =====================================================================
# TEMPLATE — vhost nginx para PrestaShop no ISPmanager
# Modo PHP do site: FastCGI (Nginx + PHP-FPM)
# Versão: v1 (baseado no garrafeira5sentidos.pt-nginx-v3)
#
# COMO USAR
# 1. No painel, mudar o site para "FastCGI (Nginx + PHP-FPM)" e gravar.
# 2. Abrir "Website configuration files" > Nginx e COPIAR do vhost
# gerado os valores dos marcadores abaixo (não inventar):
#
# {{SERVER_NAMES}} ex.: loja.pt www.loja.pt
# {{DOMAIN}} ex.: loja.pt (nome da pasta em vhosts-resources)
# {{USER}} ex.: 5sentidos (utilizador ISPmanager)
# {{ROOT}} ex.: /var/www/5sentidos/data/www/loja.pt
# {{IP}} ex.: 91.209.16.96
# {{SSL_CERT}} ex.: /var/www/httpd-cert/5sentidos/loja.pt_le2.crtca
# {{SSL_KEY}} ex.: /var/www/httpd-cert/5sentidos/loja.pt_le2.key
# {{FPM_SOCKET}} ex.: /var/www/php-fpm/100.sock (muda por site!)
#
# 3. Substituir os marcadores, apagar este cabeçalho se quiseres,
# colar tudo no editor (substituindo o conteúdo) e gravar.
# 4. Testar: homepage, categoria, produto, imagens, backoffice
# (/adminXXX/ e editar um produto), checkout, 403 em /var/ e
# /app/config/parameters.php, redirect http -> https.
#
# NOTAS
# - Só serve para lojas instaladas na raiz do domínio (não em subpasta).
# - Se o painel regenerar o vhost (mudar versão PHP, aliases, SSL...),
# confirmar que as regras continuam lá. O socket FPM pode mudar.
# - Se voltar a CGI, o painel gera outro vhost e o .htaccess volta a valer.
# - Definições PHP (error_reporting, etc.) são separadas por modo:
# redefinir no modo PHP-FPM.
# - Os blocos entre ">>> PRESTASHOP" e "<<< PRESTASHOP" são os únicos
# acrescentos ao vhost original do ISPmanager.
# =====================================================================
server {
server_name {{SERVER_NAMES}};
charset UTF-8;
disable_symlinks if_not_owner from=$root_path;
include /etc/nginx/vhosts-includes/*.conf;
include /etc/nginx/vhosts-resources/{{DOMAIN}}/*.conf;
include /etc/nginx/users-resources/{{USER}}/*.conf;
access_log /var/www/httpd-logs/{{DOMAIN}}.access.log;
error_log /var/www/httpd-logs/{{DOMAIN}}.error.log notice;
ssi on;
set $root_path {{ROOT}};
root $root_path;
gzip on;
gzip_comp_level 5;
gzip_disable "msie6";
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;
location / {
location ~ [^/]\.ph(p\d*|tml)$ {
try_files /does_not_exists @php;
}
location ~* ^.+\.(jpg|jpeg|gif|png|svg|js|css|mp3|ogg|mpe?g|avi|zip|gz|bz2?|rar|swf|webp|woff|woff2)$ {
expires 24h;
}
}
return 301 https://$host:443$request_uri;
listen {{IP}}:80;
location @php {
include /etc/nginx/vhosts-resources/{{DOMAIN}}/dynamic/*.conf;
fastcgi_index index.php;
fastcgi_param PHP_ADMIN_VALUE "sendmail_path = /usr/sbin/sendmail -t -i -f webmaster@{{DOMAIN}}";
fastcgi_pass unix:{{FPM_SOCKET}};
fastcgi_split_path_info ^((?U).+\.ph(?:p\d*|tml))(/?.+)$;
try_files $uri =404;
include fastcgi_params;
}
}
server {
server_name {{SERVER_NAMES}};
ssl_certificate "{{SSL_CERT}}";
ssl_certificate_key "{{SSL_KEY}}";
ssl_ciphers EECDH:+AES256:-3DES:RSA+AES:!NULL:!RC4;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_dhparam /etc/ssl/certs/dhparam4096.pem;
charset UTF-8;
disable_symlinks if_not_owner from=$root_path;
include /etc/nginx/vhosts-includes/*.conf;
include /etc/nginx/vhosts-resources/{{DOMAIN}}/*.conf;
include /etc/nginx/users-resources/{{USER}}/*.conf;
access_log /var/www/httpd-logs/{{DOMAIN}}.access.log;
error_log /var/www/httpd-logs/{{DOMAIN}}.error.log notice;
ssi on;
set $root_path {{ROOT}};
root $root_path;
# >>> PRESTASHOP: índice (sem isto a homepage dá 403)
index index.php index.html;
# <<< PRESTASHOP
gzip on;
gzip_comp_level 5;
gzip_disable "msie6";
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;
# >>> PRESTASHOP: rewrites (equivalente ao .htaccess)
# Imagens de produto
rewrite "^/([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$1$2$3.jpg last;
rewrite "^/([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$1$2$3$4.jpg last;
rewrite "^/([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$1$2$3$4$5.jpg last;
rewrite "^/([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$4/$1$2$3$4$5$6.jpg last;
rewrite "^/([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$4/$5/$1$2$3$4$5$6$7.jpg last;
rewrite "^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$4/$5/$6/$1$2$3$4$5$6$7$8.jpg last;
rewrite "^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$4/$5/$6/$7/$1$2$3$4$5$6$7$8$9.jpg last;
# Imagens de categoria
rewrite "^/c/([0-9]+)(-[.*_a-zA-Z0-9-]*)(-[0-9]+)?/.+\.jpg$" /img/c/$1$2$3.jpg last;
rewrite "^/c/([a-zA-Z_-]+)(-[0-9]+)?/.+\.jpg$" /img/c/$1$2.jpg last;
rewrite "^/images_ie/?([^/]+)\.(jpe?g|png|gif)$" /js/jquery/plugins/fancybox/images/$1.$2 last;
# Webservice e upload
rewrite "^/api(?:/(.*))?$" /webservice/dispatcher.php?url=$1 last;
rewrite "^/upload/.+$" /index.php last;
# <<< PRESTASHOP
# >>> PRESTASHOP: pastas internas (o que os .htaccess bloqueavam)
location ^~ /app/ { deny all; }
location ^~ /bin/ { deny all; }
location ^~ /cache/ { deny all; }
location ^~ /classes/ { deny all; }
location ^~ /config/ { deny all; }
location ^~ /controllers/ { deny all; }
location ^~ /docs/ { deny all; }
location ^~ /download/ { deny all; }
location ^~ /localization/ { deny all; }
location ^~ /log/ { deny all; }
location ^~ /override/ { deny all; }
location ^~ /src/ { deny all; }
location ^~ /tests/ { deny all; }
location ^~ /tools/ { deny all; }
location ^~ /translations/ { deny all; }
location ^~ /var/ { deny all; }
location ^~ /vendor/ { deny all; }
# /img/ é público, mas nunca executa PHP
location ^~ /img/ {
expires 24h;
location ~ \.ph(p\d*|tml)$ {
deny all;
}
}
# <<< PRESTASHOP
location / {
# >>> PRESTASHOP: ficheiros ocultos e sensíveis (têm de vir primeiro)
location ~ /\.(?!well-known/) {
deny all;
}
location ~* \.(tpl|twig|yml|yaml|log|sql|md|lock|dist|sh|bak|old|orig|swp|ini|sass|scss)$ {
deny all;
}
# <<< PRESTASHOP
location ~ [^/]\.ph(p\d*|tml)$ {
try_files /does_not_exists @php;
}
location ~* ^.+\.(jpg|jpeg|gif|png|svg|js|css|mp3|ogg|mpe?g|avi|zip|gz|bz2?|rar|swf|webp|woff|woff2)$ {
expires 24h;
}
# >>> PRESTASHOP: backoffice (rotas Symfony) e dispatcher
location ~ ^/(admin[a-zA-Z0-9]*)/ {
try_files $uri $uri/ /$1/index.php$is_args$args;
}
try_files $uri $uri/ /index.php$is_args$args;
# <<< PRESTASHOP
}
listen {{IP}}:443 ssl;
location @php {
include /etc/nginx/vhosts-resources/{{DOMAIN}}/dynamic/*.conf;
fastcgi_index index.php;
fastcgi_param PHP_ADMIN_VALUE "sendmail_path = /usr/sbin/sendmail -t -i -f webmaster@{{DOMAIN}}";
fastcgi_pass unix:{{FPM_SOCKET}};
fastcgi_split_path_info ^((?U).+\.ph(?:p\d*|tml))(/?.+)$;
try_files $uri =404;
include fastcgi_params;
}
}
Agradecemos pelo feedback!