Михаил Григорьев

listen = 127.0.0.1:9001

[site.ru]
listen = /var/lib/php5-fpm/siteru.sock
listen.owner = site
listen.group = site
listen.mode = 0660
...

location ~ \.php$ {
  ...
  fastcgi_pass unix:/var/lib/php5-fpm/siteru.sock;
  ...
}

pm = ondemand

pm = dynamic
pm.max_children = 10
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 5
pm.max_requests = 500

; Перенаправлять вывод процесса в лог
catch_workers_output = yes
; Если скрипт выполняется больше указанного времени, писать отладочную информацию в slowlog
request_slowlog_timeout = 3
; Лог-файл для медленных запросов
slowlog = /var/log/fpm-php/siteru.slow.log

...
        location /aaaa {
                root /var/www/aaaa;
                index index.php index.html index.htm;
                location ~ (.+\.php)$ {
                       try_files $uri = 404;
                       root /var/www/aaaa/;
                       include /etc/nginx/fastcgi_params;
                       fastcgi_pass unix:/var/lib/php5-fpm/aaaa.sock;
                       fastcgi_index index.php;
                       fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                }
        }
...

1. Постоянный редирект с / на index.php

location = / {
        rewrite ^ $scheme://$host/index.php permanent;
    }

    location / {
        deny all;
        return 404;
    }
    location ~* ^/index\.php$ {
        try_files $uri $uri/ =404;
        fastcgi_index index.php;
        fastcgi_pass php5-fpm-sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include /etc/nginx/fastcgi_params;
    }

$host
в порядке приоритета: имя хоста из строки запроса, или имя хоста из поля “Host” заголовка запроса, или имя сервера, соответствующего запросу

...
        error_page 404 = @cms;

        location / {
            try_files /NONEXISTENTFILE @cms;
        }

        location @cms {
                fastcgi_pass      unix:/var/lib/php5-fpm/xxxxx.sock;
                fastcgi_index    index.php;
                fastcgi_param   SCRIPT_FILENAME $document_root/index.php;
                fastcgi_param   SCRIPT_NAME /index.php;
                include             /etc/nginx/fastcgi_params;
        }
...

2. Запрещаем любую статику кроме gif|jpg|png|js|css|ttf|woff|ico

location ~* \.(gif|jpg|png|js|css|ttf|woff|ico)$ {
        try_files $uri =404;
        expires 30d;
    }

...
        error_page 404 = @cms;

        location ~* ^.+\.(gif|jpg|png|js|css|ttf|woff|ico)$ {
                expires 30d;
                access_log off;
                log_not_found off;
        }

        location / {
            try_files /NONEXISTENTFILE @cms;
        }
...

http {
....
        geo $my_client_ip $denied {
                default 1;
                127.0.0.1 0;
                XX.XX.XX.XX 0; # <- IP1 с которого можно заходить
                YY.YY.YY.YY 0;    # <- IP2 с которого можно заходить
        }

server {
        listen       443 ssl;
        server_name  site.ru;
        root         /var/www/html/;
...
        set $my_client_ip $remote_addr;
        if ($http_x_forwarded_client_ip ~ "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") {
                set $my_client_ip $http_x_forwarded_client_ip;
        }

        error_page 403 = @deny;

        location @deny {
                root /var/www/deny;
                rewrite ^(.*)$ /index.html break;
        }

        location ~* ^/json\.php$ {
                if ($denied) {
                        return 403;
                }
                try_files /NONEXISTENTFILE @json;
        }

        location @json {
                try_files       $uri = 404;
                fastcgi_pass    unix:/var/lib/php5-fpm/xxxxx.sock;
                fastcgi_index   index.php;
                fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include         /etc/nginx/fastcgi_params;
        }

}
}

4. Разрешаем доступ к /admin только с 1-го IP, для /admin/phpmyadmin

proxy_connect_timeout 120s;
proxy_send_timeout 120s;
proxy_read_timeout 120s;

http {
    ...
    log_format upstream_log '[$time_local] $remote_addr - $remote_user - $server_name to: $upstream_addr: $request upstream_response_time $upstream_response_time msec $msec request_time $request_time';

upstream servers {
                least_conn;
                server ip1;
                server ip2 max_fails=3 fail_timeout=30s;
                server ip3 max_fails=5 fail_timeout=30s;
                keepalive 16;
        }

server {
                listen 80;
                access_log /var/log/nginx/servers-access.log upstream_log;
                error_log /var/log/nginx/servers-error.log debug;

                location / {
                        proxy_pass http://servers;
                        proxy_http_version 1.1;
                        proxy_set_header Connection "";
                        proxy_connect_timeout 120s;
                        proxy_send_timeout 120s;
                        proxy_read_timeout 120s;
        }
}

server {
....
root /var/www/mysite.com;
index index.php index.html index.htm;

location / {
        try_files $uri $uri/ =404;
}
location ~ \.php$ {
        try_files $uri = 404;
        fastcgi_pass unix:/var/lib/php5-fpm/mysite.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include /etc/nginx/fastcgi_params;
}
...
}