Nginx多域名全部重定向至首个域名问题排查与修复

问题根源 #

• WordPress域名iamafard.ir的Nginx配置仅监听8080端口，但用户访问时默认使用80（HTTP）和443（HTTPS）端口，Nginx找不到对应端口的server块，会自动匹配第一个定义的afardfediverse.ir配置，导致所有域名被导向它。
• 缺少iamafard.ir的80端口HTTPS跳转配置，以及443端口的完整WordPress服务规则。
• WordPress的server块缺少核心location规则，无法正确处理静态文件和PHP动态请求。

修改后的完整Nginx配置 #

proxy_cache_path /tmp/pleroma-media-cache levels=1:2 keys_zone=pleroma_media_cache:10m max_size=10g
                 inactive=720m use_temp_path=off;

upstream phoenix {
    server 127.0.0.1:4000 max_fails=5 fail_timeout=60s;
}

# afardfediverse.ir HTTP跳转至HTTPS
server {
    server_name    afardfediverse.ir;
    listen         80;
    listen         [::]:80;
    return         301 https://$server_name$request_uri;
}

# iamafard.ir HTTP跳转至HTTPS
server {
    server_name    iamafard.ir;
    listen         80;
    listen         [::]:80;
    return         301 https://$server_name$request_uri;
}

# 全局SSL缓存配置
ssl_session_cache shared:ssl_session_cache:10m;

# Pleroma服务配置（afardfediverse.ir）
server {
    server_name afardfediverse.ir;

    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # 约40000个会话容量
    ssl_session_tickets off;

    ssl_trusted_certificate   /etc/letsencrypt/live/afardfediverse.ir/chain.pem;
    ssl_certificate           /etc/letsencrypt/live/afardfediverse.ir/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/afardfediverse.ir/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    ssl_prefer_server_ciphers off;
    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
    ssl_stapling on;
    ssl_stapling_verify on;

    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;

    client_max_body_size 16m;
    ignore_invalid_headers off;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    location / {
        proxy_pass http://phoenix;
    }

    location ~ ^/(media|proxy) {
        proxy_cache        pleroma_media_cache;
        slice              1m;
        proxy_cache_key    $host$uri$is_args$args$slice_range;
        proxy_set_header   Range $slice_range;
        proxy_cache_valid  200 206 301 304 1h;
        proxy_cache_lock   on;
        proxy_ignore_client_abort on;
        proxy_buffering    on;
        chunked_transfer_encoding on;
        proxy_pass         http://phoenix;
    }
}

# WordPress服务配置（iamafard.ir）
server {
    server_name iamafard.ir;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    ssl_trusted_certificate   /etc/letsencrypt/live/iamafard.ir/chain.pem;
    ssl_certificate           /etc/letsencrypt/live/iamafard.ir/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/iamafard.ir/privkey.pem;

    # 复用全局SSL安全配置，可按需单独调整
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    ssl_prefer_server_ciphers off;
    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
    ssl_stapling on;
    ssl_stapling_verify on;

    root /var/www/html/iamafard/wordpress;
    index index.php index.html index.htm;

    # 处理WordPress伪静态规则
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # 禁止访问敏感配置文件
    location ~ /\.ht {
        deny all;
    }

    # 处理PHP动态请求（Debian12默认PHP版本为8.2，需对应调整sock路径）
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

关键修改点说明 #

1. 新增iamafard.ir的80端口跳转：添加独立server块处理HTTP请求，强制跳转到HTTPS，避免Nginx误匹配其他域名配置。
2. 调整WordPress监听端口：将原8080端口改为标准443（HTTPS）端口，确保用户正常访问时能匹配到正确的服务配置。
3. 补充WordPress核心规则：
   • location /：通过try_files实现伪静态URL重写，适配WordPermalinks需求。
   • location ~ \.php$：配置PHP-FPM处理动态请求，需根据实际安装的PHP版本调整sock文件路径。
   • 新增敏感文件拦截规则，提升站点安全性。
4. 启用afardfediverse.ir的HTTP跳转：取消原注释，确保HTTP请求正确跳转至HTTPS。

验证操作 #

1. 保存修改后的配置文件，执行nginx -t检查配置语法是否合法。
2. 若语法无错误，执行systemctl reload nginx重载Nginx服务。
3. 分别访问两个域名，确认各自指向对应的Pleroma和WordPress服务。

内容的提问来源于stack exchange，提问作者aliRezA aSadolAhiFarm