Skip to content

Commit

Permalink
typos
Browse files Browse the repository at this point in the history
  • Loading branch information
rodber committed May 10, 2024
1 parent 703efe7 commit a8233a3
Show file tree
Hide file tree
Showing 4 changed files with 33 additions and 24 deletions.
51 changes: 30 additions & 21 deletions application/stack/web-server.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,25 +22,52 @@ Having issues? Check the following common pitfalls:
* Apache `mod_rewrite` disabled or `Allow Override All` missing in virtual hosts
* Missing writing permissions in Chevereto paths
* Bad or invalid setup (timezone, multi-views, timeout, etc.)
* Wrong NGINX server block / PHP-FPM issues
* Wrong nginx server block / PHP-FPM issues
* `mod_security` or any other artifact blocking requests from/to

## Restrict PHP

::: danger
Chevereto restricts access exclusively to `index.php` and it forbids access to any other PHP file.
:::

Built-in [Apache HTTP server](#apache-http-server) config (`.htaccess`) and provided [Nginx](#nginx) config for **Chevereto restricts access to PHP files**. Only `/index.php` is allowed to process PHP requests. This is a security measure to prevent execution of arbitrary files that an attacker or third-party may nest in the Chevereto application filesystem.

## Real connecting IP

::: danger
If real connecting IP is not configured Chevereto won't be able to detect the real visitors IPs, failing to deliver IP based restrictions and flood control.
:::

For setups under a proxy is required that the web server sets the appropriate value for the client connecting IP.

Refer to the following resources when requiring to configure real connecting IP:

* Apache HTTP Server: `mod_remoteip`
* nginx: `ngx_http_realip_module`
* [Guides for CloudFlare](https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/) (make sure to setup the appropriate [IP ranges](https://www.cloudflare.com/ips/))

## Apache HTTP server

Apache configuration `.htaccess` files are included in Chevereto files. The only requirement is to enable module [`mod_rewrite`](https://httpd.apache.org/docs/current/mod/mod_rewrite.html) must be enabled. Virtual host settings must allow URL rewriting:
Apache configuration `.htaccess` files are included in Chevereto files. The only requirement is to enable module [`mod_rewrite`](https://httpd.apache.org/docs/current/mod/mod_rewrite.html).

Virtual host settings must allow URL rewriting.

::: details vhost
```apacheconf
<Directory /var/www/html>
Options -Indexes +FollowSymLinks +MultiViews
AllowOverride All
Require all granted
</Directory>
```
:::

## NGINX
## nginx

This is the **recommended** `nginx.conf` for `server {}` block.

::: details nginx.conf
```nginx
# Disable access to sensitive application files
location ~* (app|content|lib)/.*\.(po|php|lock|sql)$ {
Expand Down Expand Up @@ -77,23 +104,5 @@ This is the **recommended** `nginx.conf` for `server {}` block.
fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
}
```

## Restrict PHP

Built-in [Apache HTTP server](#apache-http-server) config and provided [Nginx](#nginx) config for **Chevereto restricts access to PHP files**. Only `/index.php` is allowed to process PHP requests and any extra PHP file execution is forbidden.

This is a security measure to prevent execution of arbitrary files that an attacker or third-party may nest in the Chevereto application filesystem.

## Real connecting IP

For setups under a proxy is required that the web server sets the appropriate value for the client connecting IP.

::: danger
If real connecting IP is not configured Chevereto won't be able to detect the real visitors IPs, failing to deliver IP based restrictions and flood control.
:::

Refer to the following resources when requiring to configure real connecting IP:

* Apache HTTP Server: `mod_remoteip`
* NGINX: `ngx_http_realip_module`
* [Guides for CloudFlare](https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/) (make sure to setup the appropriate [IP ranges](https://www.cloudflare.com/ips/))
2 changes: 1 addition & 1 deletion developer/how-to/debug.md
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ This vary depending the server provider and how PHP runs in the server. In doubt
* Logs by default at `/var/log/apache2/error.log`
* Virtual host directive defines custom error log location
* Commonly configured for `/var/www/domain.com/logs`
* NGINX
* nginx
* Logs by default at `/var/log/nginx/error.log`
* Server block defines custom error log location
* Commonly configured for `/var/www/domain.com/logs`
Expand Down
2 changes: 1 addition & 1 deletion guides/docker/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ make env

## Setting up system

By setting up the system you will enable background processing and NGINX ingress HTTP proxy.
By setting up the system you will enable background processing and nginx ingress HTTP proxy.

To set up the system run the following command:

Expand Down
2 changes: 1 addition & 1 deletion guides/docker/pure-docker.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

This is the most basic way to run Chevereto using Docker.

Pure Docker refers to running Chevereto using Docker without the extra provisions of [Chevereto Docker](README.md) (NGINX ingress proxy, CloudFlare integration).
Pure Docker refers to running Chevereto using Docker without the extra provisions of [Chevereto Docker](README.md) (nginx ingress proxy, CloudFlare integration).

## Build image (paid edition)

Expand Down

0 comments on commit a8233a3

Please sign in to comment.