Nginx Installation

These instructions are for an nginx-based installation. If you prefer Apache, use the Apache installation page.

Server requirements

1. Supported PHP version >= 8.2 (8.3 recommended).
2. Web server: nginx.
3. SQL database: MySQL or MariaDB (tested with MySQL 8.0 and MariaDB 10.6+).
4. Required PHP extensions: openssl, pdo, pdo_mysql, mbstring, tokenizer, xml, dom, gd, exif, bcmath, zip, curl, redis.
5. Redis for queues/cache.
6. Tectonic for label PDF generation.
7. Pandoc for bibliographic rendering (recommended).
8. Supervisor for background jobs.

Prepare the server

The example below uses Ubuntu/Debian packages and PHP 8.3. Install nginx, PHP-FPM and the same application services and extensions required by the Apache installation:

sudo apt-get install software-properties-common
sudo add-apt-repository ppa:ondrej/php
sudo apt-get update
sudo apt-get install nginx mysql-server redis-server tectonic pandoc supervisor \
 php8.3-fpm php8.3-cli php8.3-intl php8.3-mysql php8.3-sqlite3 php8.3-gd \
 php8.3-mbstring php8.3-xml php8.3-bcmath php8.3-zip php8.3-curl php8.3-redis

sudo systemctl enable --now nginx php8.3-fpm redis-server supervisor

php -m | grep -E 'mbstring|xml|gd|mysql|redis|bcmath|pcntl|zip'
systemctl status php8.3-fpm --no-pager

Follow the dedicated-user, download, MySQL, Supervisor and permissions sections of the Apache installation. For nginx, configure both /etc/php/8.3/cli/php.ini and /etc/php/8.3/fpm/php.ini, then restart php8.3-fpm.

Nginx site config

Create your site config file (example):

sudo nano /etc/nginx/sites-available/opendatabio

Use this base server block (adjust paths/domain):

server {
    listen 80;
    server_name your-domain.example;

    root /home/odbserver/opendatabio/public;
    index index.php index.html;

    charset utf-8;
    client_max_body_size 100M;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        include fastcgi.conf;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_read_timeout 300s;
        fastcgi_send_timeout 300s;
    }

    location ~ /\. {
        deny all;
    }
}

Enable and reload:

sudo ln -s /etc/nginx/sites-available/opendatabio /etc/nginx/sites-enabled/opendatabio
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

If the symlink already exists, do not recreate it. Never reload nginx unless nginx -t succeeds.

HTTPS

The port 80 block is suitable for initial validation. A public production installation must use HTTPS. Configure a certificate directly in nginx (for example with your distribution’s Certbot integration) or terminate TLS in a trusted reverse proxy. Redirect HTTP to HTTPS only after the HTTPS virtual host has been tested.

Set the public URL consistently:

APP_URL=https://your-domain.example
ASSET_URL=https://your-domain.example
APP_FORCE_HTTPS=true

When TLS terminates at a reverse proxy, forward the original Host and X-Forwarded-Proto headers and restrict direct access to the backend.

Content Security Policy (CSP)

Edit the same nginx site file and add inside the server { ... } block:

add_header Content-Security-Policy-Report-Only "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://server.arcgisonline.com https://*.tile.openstreetmap.org; font-src 'self' data:; connect-src 'self'; media-src 'self' blob:; worker-src 'self' blob:;" always;

Then reload:

sudo nginx -t
sudo systemctl reload nginx

Notes:

1. Start with Report-Only, then move to enforced CSP after validating logs.
2. https://server.arcgisonline.com and https://*.tile.openstreetmap.org are required for map tiles.

Deployment URL

The server block above publishes OpenDataBio at the root of a dedicated host. Use matching values in .env:

APP_URL=https://your-domain.example
ASSET_URL=https://your-domain.example

Then rebuild all generated assets:

sh scripts/build-assets.sh
php artisan optimize:clear

Installing nginx under a subpath such as /opendatabio also requires subpath-aware location, alias and FastCGI rules; changing only .env is not sufficient. Prefer a dedicated host or subdomain. If a subpath is mandatory, use the tested Apache configuration or provide and test a deployment-specific nginx configuration before exposing it publicly.

Shared application setup

To avoid repeating the same instructions, use these sections from Apache installation (they also apply to nginx deployments):

1. PHP settings in Apache Installation, using the FPM path stated above
2. Configure supervisord in Apache Installation
3. Folder permissions in Apache Installation
4. Install OpenDataBio as described in Apache Installation, but run php install nginx
5. Post-install configs in Apache Installation