Configure the components

By Tilo Schröder (external link) on Aug 27th, 2026 6:39pm
Last modified 2026-08-31

Here you’ll learn, among other things, how to set up a vHost, transfer rewrite rules from .htaccess to Nginx, add MIME types, and change the upload limit.

Virtual Host

In this step, we’ll set up the vHost where Sym8 (or another application) can be installed later.

We’ll create two vHosts:

one vHost for Sym8 and
one vHost for the generic hostname and IP address with a simple index.html.

This prevents the application from being displayed when the server is accessed via its IP address or an unknown hostname. The structure should look like this:

              /var/www/html
           ├── default
           └── example-domain.net

Create the two directories and assign them to www-data:

              sudo mkdir /var/www/html/default
sudo mkdir /var/www/html/example-domain.net
sudo chown www-data:www-data /var/www/html/default
sudo chown www-data:www-data /var/www/html/example-domain.net

Configuration of the Default Host

The default vHost serves as a simple placeholder for the generic hostname and IP address.

Create and edit the index.html. Make sure the file is owned by www-data:

              sudo vi /var/www/html/default/index.html
sudo chown www-data:www-data /var/www/html/default/index.html

Paste the following content to the file via an editor (nano or vim):

              <!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="robots" content="noindex">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="color-scheme" content="dark light">
    <title>It works!</title>
  </head>
  <body>
    <main>
      <code>It works!</code>
    </main>
  </body>
</html>

Now edit the configuration file of the default vHost and change the root to the new default site:

              sudo vi /etc/nginx/sites-available/default

server {
    ...
    # Change default root to the new directory
    # root /var/www/html;
    root /var/www/html/default;
    ...
}

Configuration of the Application Host

Then, we’ll create the vHost file for Sym8. Copy the default vHost file. It is recommended to use the domain name for the file too:

              sudo cp /etc/nginx/sites-available/default /etc/nginx/sites-available/example-domain.net

Next, we need to edit the new vHost file and change the following values in the server block:

              sudo vi /etc/nginx/sites-available/example-domain.net

server {
    listen 80;  # remove default_server
    listen [::]:80;  # remove default_server

    # Change default root to the new directory
    # root /var/www/html;
    root /var/www/html/example-domain.net;

    # Add index.php to the list if you are using PHP
    index index.php index.html
    server_name example-domain.net;

    ...
}

Executing PHP Files

To process PHP files, Nginx needs to pass them to PHP-FPM. As a reminder, we are using PHP-FPM version 8.4 in this example.

Insert the following location to the server block:

                location ~ \.php$ {
    include snippets/fastcgi-php.conf;

    fastcgi_pass unix:/run/php/php8.4-fpm.sock;
  }

Create a symbolic link to the vHost configuration in /etc/nginx/sites-enabled:

              sudo ln -s /etc/nginx/sites-available/example-domain.net /etc/nginx/sites-enabled/example-domain.net

Test the settings and reload Nginx:

              sudo nginx -t
sudo systemctl reload nginx

After Nginx is reloaded, test the vHosts now in a browser:

Entering the IP address should display our simple “It works!“ site ✅
Entering the domain (example-domain.net) should return a 403 error, as no content (index file) is present yet. ✅

Certbot

To obtain an SSL/TLS certificate from Let’s Encrypt, run Certbot with the domain (example-domain.net):

              sudo certbot --nginx -d example-domain.net

Certbot will perform the following steps:

Reads the Nginx configuration
Performs the HTTP challenge
Retrieves the certificate
Updates the Nginx configuration
Executes a reload

Certbot will change the configuration file for the vHost automatically. All changes are marked with a comment (# managed by Certbot). If you open the file example-domain.net located in /etc/nginx/sites-available in an editor (nano or vim) you can find lines like the following:

                  listen 443 ssl; # managed by Certbot
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example-domain.net/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example-domain.net/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

Note: The exact configuration may vary depending on the Certbot version and your Nginx configuration.

On Debian, Certbot typically sets up automatic renewal using a systemd timer. Test it with the following command:

              sudo certbot renew --dry-run

Rewrite Rules

Now let’s add the rules translated from Apache’s .htaccess file to the Nginx configuration.

Open the configuration file for the vHost in an editor (nano or vim):

              sudo vi /etc/nginx/sites-available/example-domain.net

Insert the following lines to the server block:

                  ###
    # Symphony rewrites
    ###
    ### SECURITY - Protect crucial files
    location ~ "^/(.*)\.(bak|config|ini|log|sh|swp|inc|old|orig)$" {
        deny all;
    }
    location ~ "^/manifest/(.*)$" {
        deny all;
    }
    location ~ "^/workspace/(pages|utilities)/(.*)\.xsl$" {
        deny all;
    }
    location ~ "^/(.*)\.sql$" {
        deny all;
    }
    location ~ "(^|/)\." {
        deny all;
    }
    ### IMAGE RULES
    location ^~ /image/ {
        rewrite ^/image\/(.+)$ /extensions/jit_image_manipulation/lib/image.php?param=$1 last;
    }
    ### URL Correction
    rewrite ^/(symphony/)?index.php(/.*/?) /$1$2 last;
    ### ADMIN REWRITE
    rewrite ^/symphony\/?$ /index.php?mode=administration&$query_string last;
    location ~ "^/symphony(\/(.*\/?))?$" {
        try_files $uri $uri/ /index.php?symphony-page=$1&mode=administration&$query_string;
    }
    ### FRONTEND REWRITE - Will ignore files and directories
    location ~ "^/(.*\/?)$" {
        try_files $uri $uri/ /index.php?symphony-page=$1&$query_string;
    }

Save and test the configuration file and reload Nginx:

              sudo nginx -t
sudo systemctl reload nginx

The rewrite rules can be tested after Sym8 has been installed and the application is available.

MIME Types

To ensure that README files are served correctly as Markdown files (MIME type text/markdown), add this file type to the MIME type configuration.

To do this, open the file /etc/nginx/mime.types in an editor (nano or vim):

              sudo vi /etc/nginx/mime.types

Then add the following line after text/mathml (typically within the block for text documents):

                  text/markdown                                    md markdown;

Save the file and reload Nginx:

              sudo systemctl reload nginx

Upload Limits

PHP’s default configuration uses a relatively conservative upload limit. Therefore, we’ll increase the limit to, for example, 32 MB.

For PHP-FPM, change the settings for post_max_size and upload_max_filesize. Open the file php.ini (located in /etc/php/8.4/fpm):

              sudo vi /etc/php/8.4/fpm/php.ini

Search for post_max_size and upload_max_filesize and change the values to e.g. 32M (32 MB):

              post_max_size = 32M
...
upload_max_filesize = 32M

Save the file and restart or reload PHP-FPM:

              sudo systemctl reload php8.4-fpm

Nginx has its own request body limit, which must be increased as well.

Open the configuration file for the vHost:

              sudo vi /etc/nginx/sites-available/example-domain.net

Add the following line in the server block:

                  ##
    # Adjust limit of uploads
    ##
    client_max_body_size 32m;

Restart or reload Nginx:

              sudo systemctl reload nginx

Upload and install Sym8

Get the latest version of Sym8 (external link), extract the archive, and upload all files and directories to the vHost directory (/var/www/html/example-domain.net).

Change the ownership to www-data:

              sudo chown -R www-data:www-data /var/www/html/example-domain.net

Now you can open a new browser tab and open the URL example-domain.net. The Symphony installer page should be displayed.

Fill out all the required fields and set the credentials you are set for the database.

Additional optimizations

Here are a few more optimization tips for the vHost. All settings are configured in the vHost’s configuration file.

Open the vHost configuration file in an editor (nano or vim):

              sudo vi /etc/nginx/sites-available/example-domain.net

Enable HTTP/2

To enable HTTP/2 insert the following line, e.g. below server_name:

                  ##
    # Enable HTTP/2
    ##
    http2 on;

Deny access to the .htaccess file

To prevent the .htaccess file from being accessed—which was created during the installation process—add the following location block:

                  ##
    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    ##
    location ~ /\.ht {
        deny all;
    }

Directory .well-known

If you’re using the .well-known directory and want to serve extensionless files such as atproto-did, you can set their MIME type to text/plain. Otherwise, Nginx may serve them as application/octet-stream, causing browsers to download them instead of displaying them as text.

                  ##
    # .well-known directory
    ##
    location  ^~ /.well-known/ {
        default_type text/plain;
        try_files $uri =404;
    }

Save the configuration, test the Nginx settings and restart or reload Nginx:

              sudo nginx -t
sudo systemctl reload nginx