Nginx + PHP-FPM + PHP Cache + SSL + Varnish + Drupal

Note: The below instructions are for Varnish 3 on Ubuntu 12. If you want to run Drupal with Varnish 4 on Ubuntu 16, updated instructions are here.

So, you want to set up Nginx and Drupal with all the bells and whistles on Ubuntu Server 12.04. You want caching for both PHP and Varnish and you need it to work for both SSL and non-SSL. Here’s a blueprint you might follow. This assumes you’re starting from scratch with a bare install or image, with no web server, database or anything except SSH.

Note: Although the following text references APC, it is abandoned and you should consider the Zend OPcache instead. You can install APCu if you want a userland cache as well.

1) Install MySQL and php5-mysql

$ apt-get install mysql-server php5-mysql php5-suhosin

This also installs PHP-FPM.

Give yourself a good root database password. At this point you may also want to remove any test users and databases.

2) Install the latest Nginx

$ add-apt-repository ppa:nginx/stable

(If the server image you’re using complains that add-apt-repository isn’t installed, run apt-get install python-software-properties.)

$ apt-get update
$ apt-get install nginx
$ service nginx start

As of this writing, this gives you Nginx 1.5.10. If necessary, open TCP/80 and TCP/443 on your inbound firewall (or VPC security group, if you’re using AWS) and visit your server’s hostname or IP address in your browser. You should see the generic Nginx welcome page.

This method allows Nginx to be updated by the Ubuntu package manager, but remember that Nginx, unlike Apache, requires recompilation to add new modules. This might encourage you to install Nginx from source. However, you can add modules while keeping Nginx usable with apt-get by rebuilding its .deb packages.

3) Tell PHP-FPM to listen on a Unix socket instead of TCP

vi /etc/php5/fpm/pool.d/www.conf

Comment out the default listen directive and specify a Unix socket:

; listen =
listen = /var/run/php5-fpm.sock

4) Install and configure APC

$ apt-get install php-apc php5-gd
$ vi /etc/php5/conf.d/apc.ini

At minimum I typically use these settings:

apc.shm_size = 128M
apc.mmap_file_mask = /apc.shm.XXXXXX
apc.ttl = 3600
apc.user_ttl = 7200
apc.gc_ttl = 3600

Restart php-fpm to apply your new settings.

5) Set up an SSL cert

(We’ll just generate a self-signed cert for testing here. If you buy a cert, remember to point your Nginx server block to it instead.)

Create the server key:

$ openssl genrsa -des3 -out server.key 1024

Create the CSR:

$ openssl req -new -key server.key -out server.csr

Remove the key’s password:

$ cp server.key
$ openssl rsa -in -out server.key

Sign it:

$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Move your key and cert to an appropriate place, typically /etc/ssl.

6) Set up some Nginx server blocks for your Drupal site:


$ cp /etc/nginx/sites-available/default /etc/nginx/sites-available/drupal
$ vi /etc/nginx/sites-available/drupal
server {
        # omit "default" if this isn't the default site on your server
        # and if it is, remove "default" from the default server block.
        listen 80 default;                       

        root /path/to/drupal;
        index index.php;

        location / {
           try_files $uri @rewrite;   # need this for Drupal clean_urls

        # define @rewrite
        location @rewrite {
           rewrite ^ /index.php last;

        # tell nginx to pass php scripts to php-fpm
        location ~ .php$ {
                fastcgi_split_path_info ^(.+.php)(/.+)$;
                fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_index index.php;
                include fastcgi_params;

Remember to add your symbolic link to your config file in /etc/nginx/sites-enabled and restart Nginx. We’ll worry about SSL after we get Drupal and Varnish installed. We’ll modify this file a bit later on too, but for now let’s get Drupal up and running.

7) Install Drupal in your “root” specified above using a default setup:

Refer to the official instructions if you need help. Enable clean_urls in the Drupal admin panel (or run drush vset clean_url 1 –yes if you’ve installed Drush) and visit your site to ensure they’re working.

8) Install and configure Varnish:

Add the official Varnish repo:

$ curl | sudo apt-key add -
$ echo "deb precise varnish-3.0" | sudo tee -a /etc/apt/sources.list
$ sudo apt-get update
$ sudo apt-get install varnish

This gives you Varnish 3.0.5 as of this writing.

Configure Varnish:

vi /etc/default/varnish

Make sure “start=yes” is specified, and change DAEMON_OPTS to make Varnish listen on port 80:

DAEMON_OPTS="-a :80 
             -T localhost:6082 
             -f /etc/varnish/default.vcl 
             -S /etc/varnish/secret 
             -s malloc,256m"

Set up your Drupal-specific .vcl file at /etc/varnish/default.vcl. I start with this:

acl upstream_proxy {

backend default {
    .host = "";
    .port = "8080";

sub vcl_recv {
    # Set the X-Forwarded-For header so the backend can see the original
    # IP address. If one is already set by an upstream proxy, we'll just re-use that.
    if (client.ip ~ upstream_proxy && req.http.X-Forwarded-For) {
       set req.http.X-Forwarded-For = req.http.X-Forwarded-For;
    } else {
       set req.http.X-Forwarded-For = regsub(client.ip, ":.*", "");
    ## Remove has_js and Google Analytics cookies.
    set req.http.Cookie = regsuball(req.http.Cookie, "(^|;s*)(__[a-z]+|has_js)=[^;]*", "");
    ## Remove a .;. prefix, if present.
    set req.http.Cookie = regsub(req.http.Cookie, "^;s*", "");
    ## Remove empty cookies.
    if (req.http.Cookie ~ "^s*$") {
       unset req.http.Cookie;
    # Site still uses some static files out of /files, cache them
    if (req.url ~ "^/files/site.*") {
       unset req.http.Cookie;
    # enable caching of theme files
    if (req.url ~ "^/sites/*") {
       unset req.http.Cookie;
    # Drupal js/css doesn.t need cookies, cache them
    if (req.url ~ "^/modules/.*.(js|css)?") {
       unset req.http.Cookie;
    ## Pass cron jobs and server-status
    if (req.url ~ "cron.php") {
       return (pass);
    if (req.url ~ ".*/server-status$") {
       return (pass);

sub vcl_hash {
   if (req.http.Cookie) {

8) Tell Nginx to listen on 8080 instead of 80, and set it up for SSL:

Edit your /etc/nginx/sites-available/drupal file from above, and change the listen directive:

server {
        listen default; # tells Nginx to listen for traffic passed by Varnish

Next, create a file called /etc/nginx/sites-available/drupal-ssl:

server {
        listen 443 ssl default;

        ssl_certificate /etc/ssl/certs/mycert.crt;
        ssl_certificate_key /etc/ssl/private/mykey.key;

        location / {
            # Pass the request on to Varnish.

            # Pass some headers to the downstream server, so it can identify the host.
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            # Tell any web apps like Drupal that the session is HTTPS.
            proxy_set_header X-Forwarded-Proto https;

            proxy_redirect     off;

What we’ve done here is to tell Nginx to listen on 443 for SSL traffic, then decrypt it and pass it to Varnish on 80 for caching. Varnish of course doesn’t handle SSL, so if you want your SSL traffic to be cached you need a proxy or load balancer like Nginx or Pound in front of Varnish. Effectively we’ve created an Nginx->Varnish->Nginx sandwich.

9) Get Drupal set up for SSL and Varnish:

Install the Varnish module, then configure it through the Drupal admin panel. Ensure “3.x” is selected as the Varnish version and copy in the contents of /etc/varnish/secret as the “Control Key”.

Then edit the settings.php for your Drupal site. Add a couple of statements:

// Tell Drupal to use SSL based on headers sent by Nginx and Varnish

// If you want your site to be SSL only, you can use a redirect like this
//if(!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] != 'on'){
//    header('Location: '. 'https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);

10) Finally, restart everything:

$ service nginx stop
$ service varnish restart 
$ service nginx start

To ensure Varnish is working, you can run varnishstat on the command line while you click around your site. To ensure APC is working, unzip the apc.php.gz file and put it in a web-accessible directory. You might also check out the Atlassian Varnish configuration for some additional ideas on caching Drupal sites.


Leave a Reply

Your email address will not be published. Required fields are marked *