Nginx is an alternative web server that is fast becoming popular. Nginx is famed for its ability to handle thousands of concurrent connections while using very little memory. In this post I look at how to install Nginx, PHP-FPM, MySQL and WordPress on a brand new CentOS 6.x Linux installation.

Installing Servers

The default CentOS repositories do not have Nginx so we need to add the Atomic Corp. repository. Adding this repository is easy. As root type:

wget -qO - http://www.atomicorp.com/installers/atomic | sh

Accept the license that shows up on-screen and it will install the repo for you.

To begin installing Nginx, PHP-FPM and MySQL you need to type the following as root:

yum install nginx php-fpm php-gd php-mysqlnd php-mbstring php-xmlrpc mysql mysql-server

After the above has been installed it’s time to begin configuring stuff.

Configuring MySQL

Let’s begin with MySQL. Start up the MySQL service and set it to run at boot:

service mysqld start
chkconfig mysqld on

Then do a secure installation to set the root password:

mysql_secure_installation

Login into the mysql shell using the root password:

mysql -p -uroot

And add a database and user for WordPress:

CREATE DATABASE wp;
GRANT ALL privileges ON wp.* TO wpdbuser@localhost IDENTIFIED BY 'enter_password_here';

Adding a user

Next let’s add a user to our system. This user will own the WordPress installation. As root:

useradd wpuser

Also create directories for website files:

su wpuser
cd ~
mkdir www
mkdir www/example.com

All websites owned by this user will be stored in sub-directories under the /home/wpuser/www directory.

You also need to add nginx to the user’s group so that Nginx can access files in the user’s directory. As root:

gpasswd -a nginx wpuser
cd /home
chmod 750 wpuser

Configuring PHP-FPM

PHP-FPM processes can run in separate process pools. The processes of a single pool all run as a single user on your system. This allows you to isolate PHP processes of different users.

The first step is to disable the default www pool. As root:

cd /etc/php-fpm.d
mv www.conf www.disabled

Then create a new pool configuration file named wpuser.conf in the /etc/php-fpm.d directory and add the following in it:

[wpuser]
listen = /var/run/php-fpm/wpuser.sock
listen.owner = nginx
listen.group = nginx
listen.mode = 0660
user = wpuser
group = wpuser
pm = dynamic
pm.max_children = 10
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 3
pm.max_requests = 500
chdir = /home/wpuser/www/
php_admin_value[open_basedir] = /home/wpuser/www:/tmp

A few things are going on here:

• First up you have the pool name wpuser
• Next there is the definition of the unix socket to listen on. PHP-FPM processes can listen on TCP ports or unix sockets. Unix sockets tend to be faster so we are defining a socket and giving it the same permissions as the nginx user so that Nginx can access it.
• Then we are defining the user that the PHP-FPM processes will have. This is the same user we added to the system before. This restricts the PHP-FPM processes to only accessing files that the wpuser has permission to access.
• The pm.* options define how many processes are started and how they are spawned. Fine tuning these is a topic for another article.
• Finally we are specifying a directory to change to when starting up and also limiting access to the wpuser’s www directory.

The directory for the PHP-FPM socket will have to be created:

mkdir /var/run/php-fpm

Before you can start up PHP-FPM you also have to fine tune some settings in /etc/php.ini:

cgi.fix_pathinfo=0
upload_max_filesize = 64M

Now you can start up the php-fpm daemon and set it to run at boot up:

service php-fpm start
chkconfig php-fpm on

Nginx Configuration

As root edit the file /etc/nginx/conf.d/default.conf and make sure the following line contains default_server:

listen       80 default_server;

The above ensures that requests to your server’s IP address don’t end up serving any real website. We want people to use your domain name to access your site.

Next create a new file name example.com.conf in the /etc/nginx/conf.d directory:

server {
        listen       80;
        server_name  example.com www.example.com;
        root /home/wpuser/www/example.com ;
 
	client_max_body_size 64M;
 
	# Deny access to any files with a .php extension in the uploads directory
        location ~* /(?:uploads|files)/.*\.php$ {
                deny all;
        }
 
        location / {
                index index.php index.html index.htm;
                try_files $uri $uri/ /index.php?$args;
        }
 
        location ~* \.(gif|jpg|jpeg|png|css|js)$ {
                expires max;
        }
 
        location ~ \.php$ {
                try_files $uri =404;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_index index.php;
                fastcgi_pass  unix:/var/run/php-fpm/wpuser.sock;
                fastcgi_param   SCRIPT_FILENAME
                                $document_root$fastcgi_script_name;
                include       fastcgi_params;
        }
}

Let’s see what’s going on here:

• First we have Nginx listen on port 80 for requests for files from the domain name www.example.com and example.com. We are also defining the document root as /home/wpuser/www/example.com.
• Then you have a setting that increases the default max request size to 64MB. This is required so that we can upload large image files in WordPress.
• Next we have a location block that blocks access to php files in the uploads directory. This is a security setting.
• In the two location blocks that follow you have the default index file specified and a block for static files.
• In the last block you are passing .php file requests to PHP-FPM via the unix socket we configured earlier.

Let’s start Nginx now:

service nginx start
chkconfig nginx on

You’ll also want to poke a hole in the firewall to allow web traffic:

iptables -I INPUT -p tcp --dport=80 -j ACCEPT
/etc/init.d/iptables save

WordPress installation

Finally we get to the WordPress installation:

su wpuser
cd ~
wget wordpress.org/latest.zip
unzip -q latest.zip
mv wordpress/* www/example.com/
rm -rf wordpress latest.zip

Then just visit your site example.com in your browser and follow the on-screen prompts to install WordPress. You will need the MySQL database name, database username and password that you created earlier.

Two security tips to keep in mind when installing WordPress are:

• Set a different database table prefix than the default wp_.
• Set an administrator username that is not “admin”.

Enabling search engine friendly permalinks

To enable search engine friendly permalinks go to WordPress administration > Settings > Permalinks and choose Custom Structure. Then follow the guide here and add a permalink structure like this:

/%postname%/

Conclusion

WordPress plus Nginx and PHP-FPM can be a pretty powerful combination in a low memory footprint. It helps to do things right the first time and I’ve tried to show you how to do that in this guide.