Website and Piwik on same server produces 403

Question

i've got a site on xyz.com and piwik on xyz.com/piwik. Piwik is running fine, but unfortunately not all data - requested by piwik - are handled by the server.

I've watched behaviour like:

xyz.com/piwik/ -> error

xyz.com/piwik/index.php -> is fine

xyz.com/piwik/?module=... -> error

nginx.conf

    # Configuration containing list of application servers
upstream wsgi_cluster {
        server ***.***.112.44:5000;
}

# Default server configuration
#
server {
    listen 80;
    error_log /var/log/nginx/http.error.log warn;
    server_name xxx;
    return 301 https://$server_name$request_uri;
}

# HTTPS server
server {
  listen 443 ssl;
  server_name xxx;

  auth_basic "Restricted";

  root /usr/share/nginx/html;
  index index.html index.htm;

  ssl on;
  ssl_certificate /etc/nginx/ssl/server.crt;
  ssl_certificate_key /etc/nginx/ssl/server.key;
  error_log /var/log/nginx/https.error.log warn;

  charset utf-8;

  location /piwik/ {
    location ~ /piwik/(.*\.php)(/.*)?$ {
      fastcgi_pass unix:/var/run/php5-fpm.sock;
    }
    #fastcgi_split_path_info ^(.+\.php)(/.+)$;
    #fastcgi_pass unix:/var/run/php5-fpm.sock;
    #fastcgi_index index.php;
  }

  location ~ \.php$ {
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_pass unix:/var/run/php5-fpm.sock;
    fastcgi_index index.php;
  }



  location / {
    proxy_set_header        Host $http_host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;

    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;

    client_max_body_size    10m;
    client_body_buffer_size 128k; 
    proxy_connect_timeout   60s;
    proxy_send_timeout      90s;
    proxy_read_timeout      90s;
    proxy_buffering         off;
    proxy_temp_file_write_size 64k;
    proxy_pass http://wsgi_cluster;
    proxy_redirect          off;
  }

  # Deny certain User-Agents (case insensitive)
  # The ~* makes it case insensitive as opposed to just a ~
  if ($http_user_agent ~* "Baiduspider|Jullo|AcoiRobot" ) {
    return 403;
  }

  error_page 502 /502.html;
  location = /502.html {
    root /etc/nginx/;
    internal;
  }

  error_page 401 /401.html;
  location = /401.html {
    root /etc/nginx/;
    internal;
  }

}

my-site.conf

    # Configuration containing list of application servers
upstream wsgi_cluster {
        server ***.***.112.44:5000;
}

# Default server configuration
#
server {
    listen 80;
    error_log /var/log/nginx/http.error.log warn;
    server_name xxx;
    return 301 https://$server_name$request_uri;
}

# HTTPS server
server {
  listen 443 ssl;
  server_name xxx;

  auth_basic "Restricted";

  root /usr/share/nginx/html;
  index index.html index.htm;

  ssl on;
  ssl_certificate /etc/nginx/ssl/server.crt;
  ssl_certificate_key /etc/nginx/ssl/server.key;
  error_log /var/log/nginx/https.error.log warn;

  charset utf-8;

  location /piwik/ {
    location ~ /piwik/(.*\.php)(/.*)?$ {
      fastcgi_pass unix:/var/run/php5-fpm.sock;
    }
    #fastcgi_split_path_info ^(.+\.php)(/.+)$;
    #fastcgi_pass unix:/var/run/php5-fpm.sock;
    #fastcgi_index index.php;
  }

  location ~ \.php$ {
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_pass unix:/var/run/php5-fpm.sock;
    fastcgi_index index.php;
  }



  location / {
    proxy_set_header        Host $http_host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;

    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;

    client_max_body_size    10m;
    client_body_buffer_size 128k; 
    proxy_connect_timeout   60s;
    proxy_send_timeout      90s;
    proxy_read_timeout      90s;
    proxy_buffering         off;
    proxy_temp_file_write_size 64k;
    proxy_pass http://wsgi_cluster;
    proxy_redirect          off;
  }

  # Deny certain User-Agents (case insensitive)
  # The ~* makes it case insensitive as opposed to just a ~
  if ($http_user_agent ~* "Baiduspider|Jullo|AcoiRobot" ) {
    return 403;
  }

  error_page 502 /502.html;
  location = /502.html {
    root /etc/nginx/;
    internal;
  }

  error_page 401 /401.html;
  location = /401.html {
    root /etc/nginx/;
    internal;
  }

}

Answer 1

You are missing any default action for the /piwik/ URI. Presumably, if no other matching file is found, you would like the /piwik/index.php URI to be tried. Add a try_files directive to the outer location block, for example:

location /piwik/ {
    try_files $uri /piwik/index.php$is_args$args;

    location ~ /piwik/(.*\.php)(/.*)?$ { ... }
}