分享debian 13.6安裝nginx後zine-tw及phpmyadmin.conf的設定

[Brave Ye]

只適用phpmyadmin 5.2.3
nano /etc/nginx/sites-enabled/zine-tw

代碼: 選擇全部

server {
    listen 80;
    listen [::]:80;
    server_name zine-tw.com;
    return 301 https://$server_name$request_uri; # 強制轉 HTTPS
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name zine-tw.com;

    # 引用您現有的 Let's Encrypt 憑證
    ssl_certificate /etc/letsencrypt/live/zine-tw.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/zine-tw.com/privkey.pem;

    # 【核心關鍵】Nginx 完美接管子目錄 WebSocket，Firefox 從此暢行無阻
    location /wss {
        proxy_pass http://127.0.0.1:8282;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
	proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    # 聊天室前端網頁路徑 (當訪問 ://zine-tw.com 時)
    location /wm {
        root /var/www/html; # 告訴 Nginx 根目錄在 /var/www/html，這樣它才能找到 /wm/index.html
        index index.html index.htm;
        try_files $uri $uri/ /wm/index.html;
    }

    location /phpmyadmin {
    allow 127.0.0.1;
    allow ::1;
    allow 123.241.40.195;
    deny all;

    proxy_pass http://127.0.0.1:8060;
    proxy_set_header Host 127.0.0.1;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto https;
    proxy_redirect http://127.0.0.1/ https://zine-tw.com/;
}   
   
    # 一般的網頁、PHP 8.5 邏輯，無縫丟給幕後的 Apache 處理
    location / {
        proxy_pass http://127.0.0.1:8060;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        
        # 【核心關鍵】這三行能精準阻止 Apache 的無限重新導向
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Port 443;
        proxy_redirect http://zine-tw.com/ https://zine-tw.com/;   

    }

   
} # <-- 確保最外層的 server 區塊完美閉合

nano /etc/apache2/conf-available/phpmyadmin.conf

代碼: 選擇全部

SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on

Alias /phpmyadmin /var/www/html/phpmyadmin

<Directory /var/www/html/phpmyadmin>
    Options FollowSymLinks
    DirectoryIndex index.php
    AllowOverride None

    # 1. 限制只有指定 IP 可以使用
    <RequireAny>
        Require ip 127.0.0.1
        Require ip 123.241.40.195
    </RequireAny>

    # 2. 將此目錄下的所有 PHP 檔案交給 PHP 8.5-fpm 處理
    <FilesMatch \.php$>
        SetHandler "proxy:unix:/var/run/php/php8.5-fpm.sock|fcgi://localhost"
    </FilesMatch>
</Directory>

# 安全考量：禁止直接存取 phpMyAdmin 的內部目錄
<Directory /var/www/html/phpmyadmin/templates>
    Require all denied
</Directory>
<Directory /var/www/html/phpmyadmin/libraries>
    Require all denied
</Directory>
<Directory /var/www/html/phpmyadmin/setup>
    Require all denied
</Directory>