Modernize NGINX installation config - #85
Conversation
The sample NGINX config was stuck on FOSSBilling's old BoxBilling-era layout: - location ~ \.php$ executed any .php file through PHP-FPM instead of only the app's real entry points (index.php, ipn.php, install/index.php, install/install.php), contradicting the app's own .htaccess/DDEV config. - Missing blocks present elsewhere in the app: /themes/*/config/ and several sensitive extensions (.htaccess, .htpasswd, .conf, .lock, .log, .old, .yaml). - A dead block referencing /css, /img, /js, /flv, /swf, /download - none of which exist in the current codebase (flv/swf are Flash formats). - The @rewrite block manually rebuilt ?_url=... for routing, which is legacy: FOSSBilling's RequestFactory::normalizeRoutePath() already falls back to Symfony's getPathInfo() when _url is absent, and the /page/ -> /custompages/ remap already happens in PHP. Replaced with the standard try_files front-controller pattern. - listen 443 ssl http2 is deprecated nginx syntax since 1.25.1; split into listen ssl + http2 on. Added IPv6 listeners and bumped the PHP-FPM socket example to reflect the PHP 8.3+ requirement. Verified against real nginx + php-fpm + the actual Symfony Request class in an isolated test harness: routing/query-string preservation, all block rules, and PATH_INFO-bypass resistance (e.g. /console.php/x.jpg does not execute console.php).
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
docs | 55635ce | Commit Preview URL Branch Preview URL |
Sep 02 2026, 04:14 PM |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 1 file
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
- Revert to the combined "listen ... ssl http2;" form. The standalone "http2 on;" directive only exists from nginx 1.25.1 (Jun 2023) onward; on older nginx (e.g. 1.18, still the default in several LTS distro repos) it's an unrecognized directive and fails config parsing entirely, which is worse than the deprecation warning it was avoiding. Verified against both nginx:alpine (latest) and nginx:1.18-alpine. - Add a callout documenting that the NGINX config doesn't replicate .htaccess's bb-ipn.php alias / bb_* legacy query-param translation for old BoxBilling PayPal IPN URLs. Confirmed via git history this gap predates this PR (the NGINX sample never had this), and via ipn.php's source that there's no PHP-side fallback for the bb_* names - .htaccess is the only place doing this translation. A faithful port needs chained if/map blocks doing manual query-string surgery, which doesn't belong in a beginner-facing starting-point config, so this documents the gap instead of shipping a fragile partial workaround.
0694cc2 to
25dc131
Compare
There was a problem hiding this comment.
0 issues found across 1 file (changes from recent commits).
Requires human review: The PR changes NGINX routing, PHP execution, and sensitive-file exposure. Human review is needed to validate the security behavior and the truncated configuration before publishing it as installation guidance.
Re-trigger cubic
The Markdoc "tabitem" node doesn't accept a nested "aside" tag as a child (astro build failed with "Node 'tabitem' is missing closing" / "Missing required attribute: 'label'" regardless of the aside's position or content - reproduced locally and bisected to confirm). Replaced it with a plain bold-prefixed paragraph, matching the existing "**OpenLiteSpeed users:** ..." callout already used the same way in the Apache tabitem right above it. Verified locally: npm run build, npm run check, and npm run format:check all pass.
There was a problem hiding this comment.
0 issues found across 1 file (changes from recent commits).
Requires human review: The PR modernizes the NGINX sample config but removes the generic PHP-FPM handler and only allows specific entry points; as a result, non-allowlisted .php files (e.g., config.php) will be served as static by try_files, exposing source code. This security regression requires human review.
Re-trigger cubic
Removed unnecessary reference to the extracted release archive directory in NGINX configuration instructions.
There was a problem hiding this comment.
0 issues found across 1 file (changes from recent commits).
Auto-approved: Updates the NGINX sample config to restrict PHP-FPM to the app's entry points and block other PHP files, fixing a security regression and improving the documentation.
Re-trigger cubic
1 participant
What
Modernizes the NGINX sample config on the installation guide.
Why it needed fixing
location ~ \.php$executed any.phpfile through PHP-FPM (includingconfig.php,cron.php,console.php,di.php,load.php, arbitrary module/theme code) instead of only the app's real entry points. FOSSBilling's own.htaccessand DDEV nginx config only allowindex.php,ipn.php,install/index.php, andinstall/install.phpthrough PHP-FPM./css,/img,/js,/flv,/swf,/download— none of which exist in the current codebase (flv/swfare Flash formats)./themes/*/config/and several sensitive extensions (.htaccess,.htpasswd,.conf,.lock,.log,.old,.yaml).@rewriteblock manually rebuilt?_url=...for routing. This is no longer necessary —RequestFactory::normalizeRoutePath()already falls back to Symfony'sgetPathInfo()when_urlis absent, and the/page/→/custompages/remap already happens in PHP. Replaced with the standardtry_filesfront-controller pattern (preserves$request_uri/query strings correctly).listen 443 ssl http2;is deprecated nginx syntax since 1.25.1 (split intolisten ssl;+http2 on;); added IPv6 listeners; bumped the PHP-FPM socket example to reflect the PHP 8.3+ requirement; dropped unusedfastcgi_split_path_info/PATH_INFOparams (routing doesn't use PATH_INFO).