# Ficheiro template vhost do nginx para prestashop

https://3rhost.pt/base-de-conhecimento/artigo/ficheiro-template-vhost-do-nginx-para-prestashop

# =====================================================================

# TEMPLATE — vhost nginx para PrestaShop no ISPmanager

# Modo PHP do site: FastCGI (Nginx + PHP-FPM)

# Versão: v1 (baseado no garrafeira5sentidos.pt-nginx-v3)

#

# COMO USAR

# 1. No painel, mudar o site para "FastCGI (Nginx + PHP-FPM)" e gravar.

# 2. Abrir "Website configuration files" > Nginx e COPIAR do vhost

# gerado os valores dos marcadores abaixo (não inventar):

#

# {{SERVER_NAMES}} ex.: loja.pt www.loja.pt

# {{DOMAIN}} ex.: loja.pt (nome da pasta em vhosts-resources)

# {{USER}} ex.: 5sentidos (utilizador ISPmanager)

# {{ROOT}} ex.: /var/www/5sentidos/data/www/loja.pt

# {{IP}} ex.: 91.209.16.96

# {{SSL_CERT}} ex.: /var/www/httpd-cert/5sentidos/loja.pt_le2.crtca

# {{SSL_KEY}} ex.: /var/www/httpd-cert/5sentidos/loja.pt_le2.key

# {{FPM_SOCKET}} ex.: /var/www/php-fpm/100.sock (muda por site!)

#

# 3. Substituir os marcadores, apagar este cabeçalho se quiseres,

# colar tudo no editor (substituindo o conteúdo) e gravar.

# 4. Testar: homepage, categoria, produto, imagens, backoffice

# (/adminXXX/ e editar um produto), checkout, 403 em /var/ e

# /app/config/parameters.php, redirect http -> https.

#

# NOTAS

# - Só serve para lojas instaladas na raiz do domínio (não em subpasta).

# - Se o painel regenerar o vhost (mudar versão PHP, aliases, SSL...),

# confirmar que as regras continuam lá. O socket FPM pode mudar.

# - Se voltar a CGI, o painel gera outro vhost e o .htaccess volta a valer.

# - Definições PHP (error_reporting, etc.) são separadas por modo:

# redefinir no modo PHP-FPM.

# - Os blocos entre ">>> PRESTASHOP" e "<<< PRESTASHOP" são os únicos

# acrescentos ao vhost original do ISPmanager.

# =====================================================================

server {

server_name {{SERVER_NAMES}};

charset UTF-8;

disable_symlinks if_not_owner from=$root_path;

include /etc/nginx/vhosts-includes/*.conf;

include /etc/nginx/vhosts-resources/{{DOMAIN}}/*.conf;

include /etc/nginx/users-resources/{{USER}}/*.conf;

access_log /var/www/httpd-logs/{{DOMAIN}}.access.log;

error_log /var/www/httpd-logs/{{DOMAIN}}.error.log notice;

ssi on;

set $root_path {{ROOT}};

root $root_path;

gzip on;

gzip_comp_level 5;

gzip_disable "msie6";

gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;

location / {

location ~ [^/]\.ph(p\d*|tml)$ {

try_files /does_not_exists @php;

}

location ~* ^.+\.(jpg|jpeg|gif|png|svg|js|css|mp3|ogg|mpe?g|avi|zip|gz|bz2?|rar|swf|webp|woff|woff2)$ {

expires 24h;

}

}

return 301 https://$host:443$request_uri;

listen {{IP}}:80;

location @php {

include /etc/nginx/vhosts-resources/{{DOMAIN}}/dynamic/*.conf;

fastcgi_index index.php;

fastcgi_param PHP_ADMIN_VALUE "sendmail_path = /usr/sbin/sendmail -t -i -f webmaster@{{DOMAIN}}";

fastcgi_pass unix:{{FPM_SOCKET}};

fastcgi_split_path_info ^((?U).+\.ph(?:p\d*|tml))(/?.+)$;

try_files $uri =404;

include fastcgi_params;

}

}

server {

server_name {{SERVER_NAMES}};

ssl_certificate "{{SSL_CERT}}";

ssl_certificate_key "{{SSL_KEY}}";

ssl_ciphers EECDH:+AES256:-3DES:RSA+AES:!NULL:!RC4;

ssl_prefer_server_ciphers on;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

ssl_dhparam /etc/ssl/certs/dhparam4096.pem;

charset UTF-8;

disable_symlinks if_not_owner from=$root_path;

include /etc/nginx/vhosts-includes/*.conf;

include /etc/nginx/vhosts-resources/{{DOMAIN}}/*.conf;

include /etc/nginx/users-resources/{{USER}}/*.conf;

access_log /var/www/httpd-logs/{{DOMAIN}}.access.log;

error_log /var/www/httpd-logs/{{DOMAIN}}.error.log notice;

ssi on;

set $root_path {{ROOT}};

root $root_path;

# >>> PRESTASHOP: índice (sem isto a homepage dá 403)

index index.php index.html;

# <<< PRESTASHOP

gzip on;

gzip_comp_level 5;

gzip_disable "msie6";

gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;

# >>> PRESTASHOP: rewrites (equivalente ao .htaccess)

# Imagens de produto

rewrite "^/([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$1$2$3.jpg last;

rewrite "^/([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$1$2$3$4.jpg last;

rewrite "^/([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$1$2$3$4$5.jpg last;

rewrite "^/([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$4/$1$2$3$4$5$6.jpg last;

rewrite "^/([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$4/$5/$1$2$3$4$5$6$7.jpg last;

rewrite "^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$4/$5/$6/$1$2$3$4$5$6$7$8.jpg last;

rewrite "^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$" /img/p/$1/$2/$3/$4/$5/$6/$7/$1$2$3$4$5$6$7$8$9.jpg last;

# Imagens de categoria

rewrite "^/c/([0-9]+)(-[.*_a-zA-Z0-9-]*)(-[0-9]+)?/.+\.jpg$" /img/c/$1$2$3.jpg last;

rewrite "^/c/([a-zA-Z_-]+)(-[0-9]+)?/.+\.jpg$" /img/c/$1$2.jpg last;

rewrite "^/images_ie/?([^/]+)\.(jpe?g|png|gif)$" /js/jquery/plugins/fancybox/images/$1.$2 last;

# Webservice e upload

rewrite "^/api(?:/(.*))?$" /webservice/dispatcher.php?url=$1 last;

rewrite "^/upload/.+$" /index.php last;

# <<< PRESTASHOP

# >>> PRESTASHOP: pastas internas (o que os .htaccess bloqueavam)

location ^~ /app/ { deny all; }

location ^~ /bin/ { deny all; }

location ^~ /cache/ { deny all; }

location ^~ /classes/ { deny all; }

location ^~ /config/ { deny all; }

location ^~ /controllers/ { deny all; }

location ^~ /docs/ { deny all; }

location ^~ /download/ { deny all; }

location ^~ /localization/ { deny all; }

location ^~ /log/ { deny all; }

location ^~ /override/ { deny all; }

location ^~ /src/ { deny all; }

location ^~ /tests/ { deny all; }

location ^~ /tools/ { deny all; }

location ^~ /translations/ { deny all; }

location ^~ /var/ { deny all; }

location ^~ /vendor/ { deny all; }

# /img/ é público, mas nunca executa PHP

location ^~ /img/ {

expires 24h;

location ~ \.ph(p\d*|tml)$ {

deny all;

}

}

# <<< PRESTASHOP

location / {

# >>> PRESTASHOP: ficheiros ocultos e sensíveis (têm de vir primeiro)

location ~ /\.(?!well-known/) {

deny all;

}

location ~* \.(tpl|twig|yml|yaml|log|sql|md|lock|dist|sh|bak|old|orig|swp|ini|sass|scss)$ {

deny all;

}

# <<< PRESTASHOP

location ~ [^/]\.ph(p\d*|tml)$ {

try_files /does_not_exists @php;

}

location ~* ^.+\.(jpg|jpeg|gif|png|svg|js|css|mp3|ogg|mpe?g|avi|zip|gz|bz2?|rar|swf|webp|woff|woff2)$ {

expires 24h;

}

# >>> PRESTASHOP: backoffice (rotas Symfony) e dispatcher

location ~ ^/(admin[a-zA-Z0-9]*)/ {

try_files $uri $uri/ /$1/index.php$is_args$args;

}

try_files $uri $uri/ /index.php$is_args$args;

# <<< PRESTASHOP

}

listen {{IP}}:443 ssl;

location @php {

include /etc/nginx/vhosts-resources/{{DOMAIN}}/dynamic/*.conf;

fastcgi_index index.php;

fastcgi_param PHP_ADMIN_VALUE "sendmail_path = /usr/sbin/sendmail -t -i -f webmaster@{{DOMAIN}}";

fastcgi_pass unix:{{FPM_SOCKET}};

fastcgi_split_path_info ^((?U).+\.ph(?:p\d*|tml))(/?.+)$;

try_files $uri =404;

include fastcgi_params;

}

}