[FIXED] Nginx and PHP-FPM - Permission Denied - Windows

Issue

I am trying configure a PHP server using nginx in Windows 10, but i'm having some problems on the way.

What i'm trying to do?

If i access localhost i see phpinfo page (OK)
If i access localhost/phpmyadmin i see Access denied. (FAIL)
If i access localhost/laravel/public i see the welcome page of laravel framework.

Foder structure

D:/Server/apps/phpmyadmin (phpmyadmin app)
D:/Server/bin/nginx
D:/Server/bin/php
D:/Server/conf/nginx/nginx.conf
D:/Server/conf/php/php.ini
D:/Server/logs/nginx
D:/Server/logs/php
D:/Server/www/index.php (phpinfo page)
D:/Server/www/laravel (laravel project)

What i've tried? I add phpmyadmin.app do windows hosts file and add another server block to nginx.conf and works, but i dont want to do it this way.

error.log

2015/12/20 14:14:14 [error] 6932#10736: *1 FastCGI sent in stderr: "PHP Warning:  Unknown: failed to open stream: Permission denied in Unknown on line 0" while reading response header from upstream, client: 127.0.0.1, server: localhost, request: "GET /phpmyadmin/ HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "localhost"

host.access.log

127.0.0.1 - - [20/Dec/2015:14:35:19 -0200] "GET /phpmyadmin/ HTTP/1.1" 403 46 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36" "-"
127.0.0.1 - - [20/Dec/2015:15:59:43 -0200] "GET /phpmyadmin/index.php HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36" "-"
127.0.0.1 - - [20/Dec/2015:16:01:37 -0200] "GET / HTTP/1.1" 200 24385 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36" "-"
127.0.0.1 - - [20/Dec/2015:16:01:39 -0200] "GET /laravel/public/ HTTP/1.1" 200 402 "http://localhost/laravel/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36" "-"

nginx-start.bat

@echo off
echo Starting Nginx...
D:\Server\bin\hidec D:\Server\bin\nginx\nginx -c D:\Server\conf\nginx\nginx.conf -p D:\Server\bin\nginx
echo Starting PHP FastCGI...
D:\Server\bin\hidec D:\Server\bin\php\php-cgi -b 127.0.0.1:9000 -c D:\Server\conf\php\php.ini

nginx.conf

worker_processes  auto;

error_log  D:/Server/logs/nginx/error.log;

events {
    worker_connections  1024;
    multi_accept        off;
}

http {
    include       D:/Server/bin/nginx/conf/mime.types;
    default_type  application/octet-stream;

    fastcgi_temp_path       D:/Server/tmp/nginx/fastcgi;
    uwsgi_temp_path         D:/Server/tmp/nginx/uwsgi;
    scgi_temp_path          D:/Server/tmp/nginx/scgi;
    client_body_temp_path   D:/Server/tmp/nginx/client-body 1 2;
    proxy_temp_path         D:/Server/tmp/nginx/proxy;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

    server_name_in_redirect off;
    server_tokens           off;

    server_names_hash_bucket_size 64;
    server_names_hash_max_size    512;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    types_hash_max_size 2048;

    client_body_buffer_size     64k;
    client_header_buffer_size   4k;
    client_max_body_size        8M;
    large_client_header_buffers 4 64k;

    client_body_timeout     10;
    client_header_timeout   10;
    keepalive_timeout       30;
    send_timeout            10;
    keepalive_requests      10;

    fastcgi_connect_timeout      60;
    fastcgi_send_timeout         120;
    fastcgi_read_timeout         300;
    fastcgi_buffer_size          64k;
    fastcgi_buffers              4 64k;
    fastcgi_busy_buffers_size    128k;
    fastcgi_temp_file_write_size 128k;

    gzip                on;
    gzip_buffers        16 8k;
    gzip_comp_level     5;
    gzip_http_version   1.0;
    gzip_min_length     1000;
    gzip_proxied        any;
    gzip_types

    text/css text/javascript text/xml text/plain text/x-component
    application/x-javascript application/javascript application/json application/xml application/rss+xml
    font/truetype font/opentype application/vnd.ms-fontobject
    image/svg+xml;
    gzip_vary           on;

    autoindex on;

    upstream php {
        server 127.0.0.1:9000;
    }

    upstream php_pool {
        ip_hash;
        server 127.0.0.1:9000 weight=1 max_fails=3 fail_timeout=10s;
        server 127.0.0.1:9001 weight=1 max_fails=3 fail_timeout=10s;
        server 127.0.0.1:9002 weight=1 max_fails=3 fail_timeout=10s;
        server 127.0.0.1:9003 weight=1 max_fails=3 fail_timeout=10s;
    }

    server {
        listen       127.0.0.1:80;
        server_name  localhost;
        root         D:/Server/www;

        log_not_found off;
        charset utf-8;

        access_log  D:/Server/logs/nginx/host.access.log  main;

        location / {
            index index.php index.html;
        }

        location /phpmyadmin/ {
            alias          D:/Server/apps/phpmyadmin;
            fastcgi_pass   php;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME $request_filename;
            fastcgi_param  REMOTE_ADDR $http_x_real_ip;
            include        D:/Server/bin/nginx/conf/fastcgi_params;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        location ~ \.php$ {
            try_files      $uri =404;
            fastcgi_pass   php;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
            fastcgi_param  REMOTE_ADDR $http_x_real_ip;
            include        D:/Server/bin/nginx/conf/fastcgi_params;
        }

        location ~* ^.+.(gif|ico|jpg|jpeg|png|flv|swf|pdf|mp3|mp4|xml|txt|js|css)$ {
            expires 30d;
            add_header Vary Accept-Encoding;
        }

        if ($request_method !~ ^(GET|HEAD|POST)$ ) { return 405; }

        location ~ /(\.ht|\.git|\.svn) {
            access_log off;
            log_not_found off;
            deny  all;
        }
    }
}

From Nginx HTTP Server book:

alias Context: location. Variables are accepted. alias is a directive that you place in a location block only. It assigns a different path for Nginx to retrieve documents for a specific request. As an example, consider the following configuration: http { server { server_name localhost; root /var/www/website.com/html; location /admin/ { alias /var/www/locked/; } } } When a request for http://localhost/ is received, files are served from the /var/www/website.com/html/ folder. However, if Nginx receives a request for http://localhost/admin/, the path used to retrieve the files is var/www/locked/. Moreover, the value of the document root directive (root) is not altered. This procedure is invisible in the eyes of dynamic scripts. Syntax: Directory (do not forget the trailing /) or file path

Update

@Richard Smith suggested change alias to root and C:/Server/apps/phpmyadmin/ to C:/Server/apps and add the ^~ modifier. Now i'm using root instead alias i can back the SCRIPT_FILENAME to $document_root$fastcgi_script_name;

Solution

In your current configuration, any file with a .php extension is processed by the same location block, which is fine for laravel but fatal for phpmyadmin.

Your phpmyadmin location block has a lower precedence than the .php location block. See how nginx chooses a location to process a request.

You can give the phpmyadmin location block a higher precedence than all of the regex location blocks by using the ^~ modifier:

location ^~ /phpmyadmin/ {
    root D:/Server/apps;
    fastcgi_pass   php;
    fastcgi_index  index.php;
    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    ...
}

Also: root is more efficient than alias and fastcgi_index only operates on $fastcgi_script_name, so you need to change SCRIPT_FILENAME as above.

Answered By - Richard Smith