tavib47/drupal-nginx repository overview

⁠Drupal Nginx Image

A base Nginx image for Drupal production environments with Drupal-optimized configuration and a pre-configured drupal user. Designed to pair with drupal-php⁠.

⁠Features

• Nginx running as drupal user with configurable UID/GID
• Drupal-optimized server configuration with security rules
• Environment variable templating for PHP-FPM connection
• Security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Strict-Transport-Security)
• Gzip compression enabled
• Static asset caching with Cache-Control: public, immutable
• Real IP support for reverse proxy setups
• Configurable FastCGI timeouts and buffer sizes

⁠Supported Tags

• latest

⁠Quick Start

docker pull tavib47/drupal-nginx

⁠Usage in Project Dockerfile

This image is designed to be extended in your project:

FROM tavib47/drupal-nginx

# Copy static assets
COPY --chown=drupal:drupal web/ /var/www/html/web/

# Optionally override the nginx config template
# COPY docker/nginx/default.conf.template /etc/nginx/templates/default.conf.template

ENV ROBOTS_FILE=robots.txt

⁠Environment Variables

⁠Build Arguments

⁠Docker Compose Example

services:
  php:
    image: tavib47/drupal-php:8.4
    volumes:
      - .:/var/www/html
    expose:
      - "9000"

  nginx:
    build:
      context: .
      dockerfile: docker/nginx/Dockerfile
      args:
        - DRUPAL_UID=${DRUPAL_UID:-41821}
        - DRUPAL_GID=${DRUPAL_GID:-41821}
    ports:
      - "80:80"
    volumes:
      - ./web:/var/www/html/web:ro
    environment:
      - PHP_FPM_HOST=php
      - PHP_FPM_PORT=9000
      - NGINX_CLIENT_MAX_BODY_SIZE=100M
      - NGINX_FASTCGI_READ_TIMEOUT=600s
    depends_on:
      - php

⁠Security Features

⁠Security Headers

The default configuration includes the following security headers:

• X-Frame-Options: SAMEORIGIN — Prevents clickjacking
• X-Content-Type-Options: nosniff — Prevents MIME type sniffing
• Referrer-Policy: strict-origin-when-cross-origin — Controls referrer information
• Strict-Transport-Security: max-age=31536000 — Enforces HTTPS (HSTS)

⁠Access Rules

The default configuration includes Drupal security best practices:

• Blocks access to .txt and .log files
• Blocks PHP execution in sites/*/files/
• Blocks access to private/ directories
• Blocks access to hidden files (except .well-known/)
• Blocks access to vendor/ and node_modules/ directories
• Blocks sensitive file extensions (.engine, .inc, .install, .module, .env, .yml, .yaml, .sql, .bak, etc.)
• Hides nginx version (server_tokens off)

⁠Real IP Support

Configured to extract real client IP from X-Forwarded-For header when behind a reverse proxy. Supports common private IP ranges:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16
• 127.0.0.1

⁠Customizing Nginx Configuration

To override the default server configuration, copy your template:

FROM tavib47/drupal-nginx
COPY my-default.conf.template /etc/nginx/templates/default.conf.template

The template supports environment variable substitution via nginx's envsubst.

⁠Related Images

• tavib47/drupal-php⁠ — PHP-FPM image configured for Drupal (pairs with this image)
• tavib47/php-fpm⁠ — Base production PHP-FPM image
• tavib47/drupal-ci⁠ — CI/CD image with Drush and Robo

⁠Source

GitHub Repository⁠