owncloud Nginx Configuration

• You need to insert the following code into your nginx config file.
• The config assumes that ownCloud is installed in /var/www/owncloud andthat it is accessed via http(s)://cloud.example.com.
• Adjust server_name, root, ssl_certificate andssl_certificate_key to suit your needs.
• Make sure your SSL certificates are readable by the server (see Nginx HTTPSSL Module documentation).

Note

The following example assumes that your ownCloud is installed inyour webroot. If you’re using a subfolder you need to adjust the configurationaccordingly.

upstream php-handler {  server 127.0.0.1:9000;  #server unix:/var/run/php5-fpm.sock;  }server {  listen 80;  server_name cloud.example.com;  # enforce https  return 301 https://$server_name$request_uri;  }server {  listen 443 ssl;  server_name cloud.example.com;  ssl_certificate /etc/ssl/nginx/cloud.example.com.crt;  ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;  # Add headers to serve security related headers  add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";  add_header X-Content-Type-Options nosniff;  add_header X-Frame-Options "SAMEORIGIN";  add_header X-XSS-Protection "1; mode=block";  add_header X-Robots-Tag none;  # Path to the root of your installation  root /var/www/owncloud/;  # set max upload size  client_max_body_size 10G;  fastcgi_buffers 64 4K;  # Disable gzip to avoid the removal of the ETag header  gzip off;  # Uncomment if your server is build with the ngx_pagespeed module  # This module is currently not supported.  #pagespeed off;  rewrite ^/caldav(.*)$ /remote.php/caldav$1 redirect;  rewrite ^/carddav(.*)$ /remote.php/carddav$1 redirect;  rewrite ^/webdav(.*)$ /remote.php/webdav$1 redirect;  index index.php;  error_page 403 /core/templates/403.php;  error_page 404 /core/templates/404.php;  location = /robots.txt {    allow all;    log_not_found off;    access_log off;    }  location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README){    deny all;    }  location / {   # The following 2 rules are only needed with webfinger   rewrite ^/.well-known/host-meta /public.php?service=host-meta last;   rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;   rewrite ^/.well-known/carddav /remote.php/carddav/ redirect;   rewrite ^/.well-known/caldav /remote.php/caldav/ redirect;   rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;   try_files $uri $uri/ /index.php;   }   location ~ \.php(?:$|/) {   fastcgi_split_path_info ^(.+\.php)(/.+)$;   include fastcgi_params;   fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;   fastcgi_param PATH_INFO $fastcgi_path_info;   fastcgi_param HTTPS on;   fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice   fastcgi_pass php-handler;   }   # Optional: set long EXPIRES header on static assets   location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {       expires 30d;       # Optional: Don't log access to assets         access_log off;   }  }

Note

You can use ownCloud over plain http, but we strongly encourage you touse SSL/TLS to encrypt all of your server traffic, and to protectuser’s logins and data in transit.

• Remove the server block containing the redirect
• Change listen 443 ssl to listen 80;
• Remove ssl_certificate and ssl_certificate_key.
• Remove fastcgi_params HTTPS on;

Note

If you are using php-fpm please read Configuration notes to php-fpm

Suppressing Log Messages

If you’re seeing meaningless messages in your logfile, for example clientdenied by server configuration: /var/www/data/htaccesstest.txt<https://forum.owncloud.org/viewtopic.php?f=17&t=20217>_, add this section toyour Nginx configuration to suppress them:

 location = /data/htaccesstest.txt {    allow all;    log_not_found off;    access_log off;}