I experience a weird error with my nginx/php5-fpm configuration. I already posted this question on the owncloud forums and asked the nginx forum, but they have no idea. As i searched serverfault, the suggestions about this topic did not directly apply to my problem, because they all share a wrongly configured location block, which i think, is not the case here (i took the config directly from the owncloud documentation).
So what is the problem?
My nginx error.log is filled with these:
"FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: MY IP, server: MY DOMAIN, request: "GET /core/img/actions/history.svg HTTP/1.1", upstream: "fastcgi://unix:/var/run/php5-fpm.sock:", host: "MY HOSTNAME/DOMAIN", referrer: "MY DOMAIN"
Owncloud runs in a subdirectory, /srv/www/owncloud, the root points to /srv/www. If i point the same configuration to root /srv/www/owncloud; the same error is caused, but this time it reads:
FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: IP, server: HOSTNAME, request: "GET /owncloud/owncloud/status.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php5-fpm.sock:", host: "HOSTNAME"
Notice the duplicate "owncloud" path...the file, php is looking for, is located at /srv/www/owncloud/status.php (may as well be the .gif from the error above, it is kind of random), not at /owncloud/owncloud...but when i revert the document root to /src/www, php omits the /owncloud path completely! It is driving me nuts...
My nginx config looks this way:
user nginx;
worker_processes auto;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
multi_accept on;
use epoll;
}
http {
include /etc/nginx/sites-enabled/*;
include mime.types;
default_type application/octet-stream;
error_log /var/log/nginx/error.log;
access_log /var/log/nginx/access.log;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
}
And my owncloud - site config:
upstream php-handler {
server unix:/var/run/php5-fpm.sock;
}
server {
listen MY IP:4433 ssl;
server_name MY DOMAIN;
ssl_certificate /etc/ssl/owncloud/owncloud_full.crt;
ssl_certificate_key /etc/ssl/owncloud/owncloud.key;
ssl_dhparam /etc/ssl/owncloud/dhparam.pem;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/owncloud/comodo_full_chain.pem;
resolver DNS SERVERS valid=300s;
resolver_timeout 10s;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_trusted_certificate /etc/ssl/owncloud/comodo_full_chain.pem;
resolver 95.129.51.51 80.244.244.244 valid=300s;
resolver_timeout 10s;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_ciphers *LIST OF SECURE CIPHERS*;
ssl_session_timeout 10m;
ssl_session_cache off;
ssl_session_tickets on;
ssl_session_ticket_key /etc/nginx/ticketkey;
# Add headers to serve security related headers
add_header Strict-Transport-Security 'max-age=15768000; includeSubDomains; preload' always;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
# Path to the root of your installation
root /srv/www;
# set max upload size
client_max_body_size 10G;
fastcgi_buffers 64 4K;
# Disable gzip to avoid the removal of the ETag header
gzip off;
index index.php;
error_page 403 /core/templates/403.php;
error_page 404 /core/templates/404.php;
rewrite ^/.well-known/carddav /remote.php/carddav/ permanent;
rewrite ^/.well-known/caldav /remote.php/caldav/ permanent;
# set max upload size
client_max_body_size 10G;
fastcgi_buffers 64 4K;
# Disable gzip to avoid the removal of the ETag header
gzip off;
index index.php;
error_page 403 /core/templates/403.php;
error_page 404 /core/templates/404.php;
rewrite ^/.well-known/carddav /remote.php/carddav/ permanent;
rewrite ^/.well-known/caldav /remote.php/caldav/ permanent;
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location ~ ^/(build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location ~ ^/(build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location / {
rewrite ^/remote/(.*) /remote.php last;
rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
try_files $uri $uri/ =404;
}
location ~ \.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
fastcgi_param modHeadersAvailable true;
fastcgi_pass php-handler;
fastcgi_intercept_errors on;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the location ~ \.php(?:$|/) { block
location ~* \.(?:css|js)$ {
add_header Cache-Control "public, max-age=7200";
# Add headers to serve security related headers
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
# Optional: Don't log access to assets
access_log off;
}
location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$ {
access_log off;
}
}
If anyone of you had an idea, i would be glad.
My environment is: Ubuntu 14.04 VPS, nginx 1.9.11, PHP5-FPM (latest with ubuntu), apparmor is off (switched it off as i experienced this error), files in /srv are readable by nginx user, i even chowned them for resolving this error, but it has no effect. Open_basedir in php has no effect (includes all relevant locations anyway, but does not resolve the error when turned off).
