KBeezie

Putting it all together

Here's the complete server block with everything included. The listen.conf snippet consolidates SSL, HSTS, and ACME renewal — covered in detail in the Securing Nginx and PHP guide:

server {
    include snippets/listen.conf;
    server_name mysite.com;

    ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem;

    root /var/www/mysite.com/public_html;

    access_log /var/log/nginx/mysite.access.log combined if=$log_ip;
    error_log /var/log/nginx/mysite.error.log;

    # --- Bludit-specific blocks ---
    include snippets/bludit.conf;

    # --- Bludit front controller ---
    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }

    # --- Housekeeping ---
    include snippets/drop.conf;

    # --- Static caching ---
    include snippets/static.conf;

    # --- PHP processing ---
    include snippets/php.conf;
}

The sitemap is handled inside bludit.conf (see Step 3), so there's no separate block needed in the server config. The client_max_body_size lives in the /admin location inside bludit.conf — scoped to where uploads actually happen.

Step 8: Redirect www to non-www (and HTTP to HTTPS)

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.mysite.com;

    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem;

    return 301 https://mysite.com$request_uri;
}

# Also redirect plain HTTP to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name mysite.com www.mysite.com;
    return 301 https://mysite.com$request_uri;
}

Step 9: Run the Bludit installer

Visit https://mysite.com and Bludit's installer will walk you through setting up an admin user. No database credentials needed — it's all flat files from here.

Optional: Behind Cloudflare

If you use Cloudflare, you'll want to restore real visitor IPs so your access logs and any IP-based features see the actual client, not Cloudflare's proxy addresses. The full setup — real-IP module configuration, IP range auto-updates, and the $binary_remote_addr vs $realip_remote_addr distinction for rate limiting — is covered in the Cloudflare Real IP with Nginx guide.

That's it. Bludit is now running behind Nginx with sensible security defaults, clean URLs, and aggressive static caching — all with flat files and no database.