Vhost Editor

Every site has an nginx configuration that admins can edit under Settings → Vhost. It is stored at /etc/nginx/sites-enabled/xaxa-<domain>.conf.

Only the admin role sees this editor. nginx (www-data) can read every site's files, so a hand-written vhost is trusted like an admin; users with the user role change their sites through the regular settings, which always produce a checked vhost.

How saving works

1. XAXA writes the new configuration.
2. It runs nginx -t.
3. If the test fails, the previous configuration is restored and the nginx error is shown. Your sites keep running.
4. If the test passes, nginx is reloaded gracefully.

Reset to default regenerates the vhost from the site's current settings.

What you can't do

Because nginx reads its configuration as root, a few things are blocked for safety:

• load_module, perl_*, lua_*, js_* and other scripting directives.
• include of anything other than fastcgi_params, proxy_params, snippets/*.conf or files in /etc/nginx/xaxa/sites/<domain>/.
• access_log / error_log outside /var/log/nginx/.
• *_temp_path, *_cache_path, user, pid, env and worker_*.

The vhost also cannot reach outside its own site:

• root and alias must point inside the site user's home (/home/<user>); the only exception is the Let's Encrypt folder /var/lib/xaxa/acme. Variables and .. are not allowed in these paths.
• File paths in try_files, index, rewrite (unless it redirects) and error_page may not contain .. or request values: only $uri, $document_uri, $fastcgi_script_name and $fastcgi_path_info (and $1… in rewrite) are allowed before the ?. nginx does not resolve .. there, so try_files /../../other-site/.env would serve another site's file.
• fastcgi_pass to a unix socket must be the site's own PHP pool (unix:/run/php/xaxa-<user>.sock). No *_pass or upstream may use any other unix socket, and the backend address may not start with a variable. PHP_VALUE / PHP_ADMIN_VALUE are set under Settings → PHP.
• server_name may only list the site's own domain and aliases. Add a name under Settings → Domain & SSL first.
• listen is limited to ports 80 and 443 with ssl, http2 or quic — no default_server.
• disable_symlinks cannot be changed: nginx does not follow a symlink to a file owned by another user, so one site cannot serve another site's files.

Useful snippets

Redirect www to the bare domain — add www.example.com as an alias, then add a separate server block:

server {
    listen 80;
    listen 443 ssl http2;
    server_name www.example.com;
    ssl_certificate /etc/nginx/xaxa/sites/example.com/cert.pem;
    ssl_certificate_key /etc/nginx/xaxa/sites/example.com/key.pem;
    return 301 https://example.com$request_uri;
}

Cache static files longer:

location ~* \.(css|js|woff2)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
}