NGINX config for MediaWiki

MediaWiki.conf

server {
    listen 80;
    server_name example.wiki;
    
    # this config assumes that MediaWiki is installed into /var/www/yourwiki/html,
    # so LocalSettings.php would be located at /var/www/yourwiki/html/LocalSettings.php

    root /var/www/yourwiki/html; 
 
    index index.php;

    # allow larger file uploads and longer script runtimes
    client_max_body_size 100m;
    client_body_timeout 60;

    # Location for wiki's entry points
    location ~ ^/(index|load|api|thumb|opensearch_desc|rest|img_auth)\.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock; # or whatever port your PHP-FPM listens on
    }

    # Images
    location /images {
        # Separate location for images/ so .php execution won't apply
        add_header X-Content-Type-Options "nosniff";
    }

    location ~ ^/(cache|includes|maintenance|languages|serialized|tests)/ {
        deny all;
    }

    location ~ ^/(bin|docs)/ {
        internal;
    }
 
    # Ideally move the deleted images directory OUTSIDE of the html directory (so outside of the root path)
    # meaning the images can never be retrieved anyways.
    location /images/deleted {
        deny all;
    }

    # MediaWiki assets (usually images)
    location ~ ^/resources/(assets|lib|src) {
        try_files $uri 404;
        expires    30d;
        add_header Access-Control-Allow-Origin "*";
        add_header Cache-Control "public, no-transform";
        access_log off;
    }
    # Assets, scripts and styles from skins and extensions
    location ~ ^/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg|wasm)$ {
        try_files $uri 404;
        expires    30d;
        add_header Access-Control-Allow-Origin "*";
        add_header Cache-Control "public, no-transform";
        access_log off;

    }
    # License and credits files
    location ~ ^/(COPYING|CREDITS) {
        default_type text/plain;
    }

    ## Uncomment the following code if you wish to use the installer/updater
    ## installer/updater
    #location /mw-config/ {
    #    # Do this inside of a location so it can be negated
    #    location ~ \.php$ {
    #        include /etc/nginx/fastcgi_params;
    #        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    #        fastcgi_pass 127.0.0.1:9000; # or whatever port your PHP-FPM listens on
    #    }
    #}

    # Handling for Mediawiki REST API, see [[mw:API:REST_API]]
    location /rest.php/ {
        try_files $uri $uri/ /rest.php?$query_string;
    }

    ## Uncomment the following code for handling image authentication
    ## Also add "deny all;" in the location for /images above
    #location /img_auth.php/ {
    #    try_files $uri $uri/ /img_auth.php?$query_string;
    #}

    # Handling for the article path (pretty URLs)
    location /wiki/ {
        rewrite ^/wiki/(?<pagename>.*)$ /index.php;
    }

    # Allow robots.txt in case you have one
    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log    off;
    }

    # Explicit access to the root website, redirect to main page (adapt as needed)
    location = / {
        return 301 /wiki//Main_Page;
    }

    # Every other entry point will be disallowed.
    # Add specific rules for other entry points/images as needed above this
    location / {
        return 404;
    }
}