diff --git a/www/nginx/src/etc/nginx/views/opnsense_error_404.html b/www/nginx/src/etc/nginx/views/opnsense_error_404.html
index 274bd281a..48e45ca98 100644
--- a/www/nginx/src/etc/nginx/views/opnsense_error_404.html
+++ b/www/nginx/src/etc/nginx/views/opnsense_error_404.html
@@ -2,7 +2,7 @@
- Request Denied
+ Not Found
- Select an upstream to proxy to.
+ Select an upstream to proxy to or connect via FastCGI if chosen.location.root
@@ -103,4 +103,16 @@
checkboxForce encrypted connections.
+
+ location.php_enable
+
+ checkbox
+ Only use this setting if you know what you are doing. If not, expect your machine to get compromised. Use this setting when you want to run a local PHP application or call an external upstream, if selected, via FastCGI. Example upstreams are PHP-FPM or Rails via FastCGI API.
+
+
+ location.php_override_scriptname
+
+ text
+ If you set this setting, all requests are sent to this script instead of the request path (URL). Not using this setting on a remote instance can be dangerous.
+
diff --git a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
index fe06656c1..3e88607ee 100644
--- a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+++ b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
@@ -248,6 +248,13 @@
N
+
+ Y
+ 0
+
+
+ N
+
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
index feaf0ede8..3de6c127a 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
@@ -29,11 +29,6 @@ default_type application/octet-stream;
keepalive_timeout {{ OPNsense.Nginx.http.keepalive_timeout }};
{% endif %}
-#add_header X-Frame-Options SAMEORIGIN;
-#add_header X-Content-Type-Options nosniff;
-#add_header X-XSS-Protection "1; mode=block";
-#add_header Referrer-Policy "same-origin";
-
# TODO add when core is ready for allowing nginx to serve the web interface
# include nginx_web.conf;
@@ -84,6 +79,9 @@ server {
server_name {{ server.servername }};
charset {{ server.charset }};
access_log /var/log/nginx/{{ server.servername }}.access.log {{ server.access_log_format }};
+{% if server.root is defined and server.root != '' %}
+ root "{{server.root}}";
+{% endif %}
#include tls.conf;
error_page 404 /opnsense_error_404.html;
error_page 500 501 502 503 504 /opnsense_server_error.html;
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf
index 1f5a6c407..33169a0c5 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf
@@ -55,7 +55,32 @@ location {{ location.matchtype }} {{ location.urlpattern }} {
auth_request /opnsense-auth-request;
{% endif %}
{% endif %}
-{% if location.upstream is defined %}
+{% if location.php_enable is defined and location.php_enable == '1' %}
+ fastcgi_split_path_info ^(.+\.php)(/.+)$;
+ include fastcgi_params;
+ fastcgi_param QUERY_STRING $query_string;
+ fastcgi_param TLS-Cipher $ssl_cipher;
+ fastcgi_param TLS-Protocol $ssl_protocol;
+ fastcgi_param TLS-SNI-Host $ssl_server_name;
+ fastcgi_intercept_errors off;
+{% if location.upstream is not defined %}
+ fastcgi_pass unix:/var/run/php-www.socket;
+{% if location.php_override_scriptname is defined and location.php_override_scriptname != '' %}
+ fastcgi_param SCRIPT_FILENAME $document_root/{{ location.php_override_scriptname }};
+{% else %}
+ fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+{% endif %}
+{% else %}
+ fastcgi_pass upstream{{ location.upstream.replace('-','') }};
+ fastcgi_connect_timeout 10s;
+{% if location.php_override_scriptname is defined and location.php_override_scriptname != '' %}
+ fastcgi_param SCRIPT_FILENAME {{ location.php_override_scriptname }};
+{% else %}
+ fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+{% endif %}
+{% endif %}
+{% endif%}
+{% if location.upstream is defined and (location.php_enable is not defined or location.php_enable != '1') %}
{% set upstream = helpers.getUUID(location.upstream) %}
proxy_pass http{% if upstream.tls_enable == '1' %}s{% endif %}://upstream{{ location.upstream.replace('-','') }};
{% if upstream.tls_enable == '1' %}
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/php-webgui.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/php-webgui.conf
index 342977847..8f246cb33 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/php-webgui.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/php-webgui.conf
@@ -11,6 +11,6 @@ pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
-php_admin_value[error_log] = /var/log/fpm-php.www.log
+php_admin_value[error_log] = /var/log/fpm-php.webgui.log
php_admin_flag[log_errors] = on
{% endraw %}