328 lines
12 KiB
Nginx Configuration File
328 lines
12 KiB
Nginx Configuration File
|
# юзер
|
||
|
|
user www-data;
|
||
|
|
|
||
|
|
# воркеры
|
||
|
|
worker_processes auto;
|
||
|
|
worker_cpu_affinity auto;
|
||
|
|
worker_rlimit_nofile 30000;
|
||
|
|
|
||
|
|
pcre_jit on;
|
||
|
|
|
||
|
|
# логи
|
||
|
|
error_log /var/log/nginx/error.log;
|
||
|
|
pid /var/run/nginx.pid;
|
||
|
|
|
||
|
|
# евенты
|
||
|
|
events {
|
||
|
|
worker_connections 8192;
|
||
|
|
}
|
||
|
|
|
||
|
|
# настройка для всех страниц
|
||
|
|
http {
|
||
|
|
# типы файлов
|
||
|
|
include /etc/nginx/mime.types;
|
||
|
|
default_type application/octet-stream;
|
||
|
|
|
||
|
|
# лимиты всякие
|
||
|
|
sendfile on;
|
||
|
|
tcp_nopush on;
|
||
|
|
tcp_nodelay on;
|
||
|
|
reset_timedout_connection on;
|
||
|
|
keepalive_timeout 300;
|
||
|
|
keepalive_requests 10000;
|
||
|
|
send_timeout 1200;
|
||
|
|
client_body_timeout 30;
|
||
|
|
client_header_timeout 30;
|
||
|
|
types_hash_max_size 2048;
|
||
|
|
server_names_hash_max_size 4096;
|
||
|
|
|
||
|
|
client_max_body_size 10m;
|
||
|
|
|
||
|
|
proxy_connect_timeout 5;
|
||
|
|
proxy_send_timeout 10;
|
||
|
|
proxy_read_timeout 10;
|
||
|
|
proxy_temp_file_write_size 64k;
|
||
|
|
proxy_buffer_size 4k;
|
||
|
|
proxy_buffers 32 16k;
|
||
|
|
proxy_busy_buffers_size 32k;
|
||
|
|
|
||
|
|
charset_types text/xml text/plain text/css text/vnd.wap.wml application/javascript application/rss+xml;
|
||
|
|
|
||
|
|
# настройки сжатия
|
||
|
|
gzip on;
|
||
|
|
gzip_static on;
|
||
|
|
gzip_types text/plain text/css text/xml application/javascript application/json application/msword application/rtf application/pdf application/vnd.ms-excel image/x-icon image/svg+xml application/font-ttf application/font-woff;
|
||
|
|
gzip_comp_level 7;
|
||
|
|
gzip_proxied any;
|
||
|
|
gzip_min_length 1000;
|
||
|
|
gzip_disable "msie6";
|
||
|
|
gzip_vary on;
|
||
|
|
|
||
|
|
etag off;
|
||
|
|
|
||
|
|
open_file_cache max=10000 inactive=60s;
|
||
|
|
open_file_cache_valid 30s;
|
||
|
|
open_file_cache_errors on;
|
||
|
|
open_file_cache_min_uses 2;
|
||
|
|
|
||
|
|
# настройки для proxy_pass
|
||
|
|
proxy_set_header Host $host;
|
||
|
|
proxy_set_header Connection $http_connection;
|
||
|
|
proxy_set_header X-Real-IP $remote_addr;
|
||
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
|
|
proxy_set_header X-Scheme $scheme;
|
||
|
|
proxy_redirect off;
|
||
|
|
proxy_http_version 1.1;
|
||
|
|
proxy_cache_valid 1h;
|
||
|
|
proxy_cache_key $scheme$proxy_host$request_uri$cookie_US;
|
||
|
|
|
||
|
|
# защита от XSS
|
||
|
|
add_header 'Referrer-Policy' 'strict-origin-when-cross-origin';
|
||
|
|
add_header X-Frame-Options SAMEORIGIN;
|
||
|
|
add_header X-Content-Type-Options nosniff;
|
||
|
|
add_header X-XSS-Protection "1; mode=block";
|
||
|
|
add_header Content-Security-Policy "script-src 'self'; frame-src 'self'; object-src 'self'";
|
||
|
|
|
||
|
|
#хз
|
||
|
|
limit_conn_zone $binary_remote_addr$host zone=lone:10m;
|
||
|
|
limit_req_zone $binary_remote_addr$host zone=ltwo:10m rate=3r/s;
|
||
|
|
limit_req_zone $binary_remote_addr$host zone=highspeed:10m rate=20r/s;
|
||
|
|
|
||
|
|
log_format postdata '$remote_addr - $time_local - $request_body';
|
||
|
|
|
||
|
|
# Nginx Amplify format
|
||
|
|
log_format main_ext '$remote_addr - $host [$time_local] "$request" '
|
||
|
|
'$status $body_bytes_sent "$http_referer" '
|
||
|
|
'"$http_user_agent" "$http_x_forwarded_for" '
|
||
|
|
'rt=$request_time ua="$upstream_addr" '
|
||
|
|
'us="$upstream_status" ut="$upstream_response_time" '
|
||
|
|
'ul="$upstream_response_length" '
|
||
|
|
'cs=$upstream_cache_status' ;
|
||
|
|
|
||
|
|
log_format crypto '$remote_addr - $host - [$time_local] - $ssl_protocol - $ssl_cipher'
|
||
|
|
' "$http_user_agent" $ssl_early_data';
|
||
|
|
|
||
|
|
|
||
|
|
# логи
|
||
|
|
access_log /var/log/nginx/access.log main_ext;
|
||
|
|
access_log /var/log/nginx/ssl.log crypto;
|
||
|
|
|
||
|
|
# протоколы tls (1.1 вырублен - не безопасный)
|
||
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||
|
|
|
||
|
|
# включены только безопасные алгоритмы шифрования (не нужно, если TlSv1.2 тоже вырубить)
|
||
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||
|
|
ssl_prefer_server_ciphers off;
|
||
|
|
ssl_session_cache shared:SSL:10m;
|
||
|
|
ssl_session_tickets on;
|
||
|
|
ssl_session_timeout 28h;
|
||
|
|
ssl_early_data on;
|
||
|
|
|
||
|
|
# ssl сертификаты
|
||
|
|
ssl_certificate /etc/letsencrypt/live/es.ukrtb.ru/fullchain.pem;
|
||
|
|
ssl_certificate_key /etc/letsencrypt/live/es.ukrtb.ru/privkey.pem;
|
||
|
|
server_tokens off;
|
||
|
|
|
||
|
|
# hsts
|
||
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload;" always;
|
||
|
|
|
||
|
|
ssl_buffer_size 16k;
|
||
|
|
http2_chunk_size 8k;
|
||
|
|
http2_idle_timeout 5m;
|
||
|
|
|
||
|
|
resolver 77.88.8.8 valid=300s ipv6=off;
|
||
|
|
resolver_timeout 5s;
|
||
|
|
|
||
|
|
map $http_accept $webp_suffix {
|
||
|
|
"~*webp" ".webp";
|
||
|
|
}
|
||
|
|
|
||
|
|
map $msie $cache_control {
|
||
|
|
default "max-age=31536000, public, no-transform, immutable";
|
||
|
|
"1" "max-age=31536000, private, no-transform, immutable";
|
||
|
|
}
|
||
|
|
|
||
|
|
map $msie $vary_header {
|
||
|
|
default "Accept";
|
||
|
|
"1" "";
|
||
|
|
}
|
||
|
|
|
||
|
|
map $http_user_agent $limit_bots {
|
||
|
|
default 0;
|
||
|
|
~*(google|bing|yandex|msnbot) 1;
|
||
|
|
~*(AltaVista|Googlebot|Slurp|BlackWidow|Bot|ChinaClaw|Custo|DISCo|Download|Demon|eCatch|EirGrabber|EmailSiphon|EmailWolf|SuperHTTP|Surfbot|WebWhacker) 1;
|
||
|
|
~*(Express|WebPictures|ExtractorPro|EyeNetIE|FlashGet|GetRight|GetWeb!|Go!Zilla|Go-Ahead-Got-It|GrabNet|Grafula|HMView|Go!Zilla|Go-Ahead-Got-It) 1;
|
||
|
|
~*(rafula|HMView|HTTrack|Stripper|Sucker|Indy|InterGET|Ninja|JetCar|Spider|larbin|LeechFTP|Downloader|tool|Navroad|NearSite|NetAnts|tAkeOut|WWWOFFLE) 1;
|
||
|
|
~*(GrabNet|NetSpider|Vampire|NetZIP|Octopus|Offline|PageGrabber|Foto|pavuk|pcBrowser|RealDownload|ReGet|SiteSnagger|SmartDownload|SuperBot|WebSpider) 1;
|
||
|
|
~*(Teleport|VoidEYE|Collector|WebAuto|WebCopier|WebFetch|WebGo|WebLeacher|WebReaper|WebSauger|eXtractor|Quester|WebStripper|WebZIP|Wget|Widow|Zeus) 1;
|
||
|
|
~*(Twengabot|htmlparser|libwww|Python|perl|urllib|scan|Curl|email|PycURL|Pyth|PyQ|WebCollector|WebCopy|webcraw) 1;
|
||
|
|
}
|
||
|
|
|
||
|
|
# ssi
|
||
|
|
ssi on;
|
||
|
|
|
||
|
|
# подгружает конфиги сайтов из этой папки
|
||
|
|
# include /etc/nginx/sites-enabled/*;
|
||
|
|
|
||
|
|
# бэкенд некстклауда
|
||
|
|
upstream php-handler {
|
||
|
|
server unix:/var/run/php/php8.1-fpm.sock;
|
||
|
|
}
|
||
|
|
|
||
|
|
# Set the `immutable` cache control options only for assets with a cache busting `v` argument
|
||
|
|
map $arg_v $asset_immutable {
|
||
|
|
"" "";
|
||
|
|
default "immutable";
|
||
|
|
}
|
||
|
|
|
||
|
|
# настройка самих страниц
|
||
|
|
server {
|
||
|
|
# порты, которые слушаются (IPv4 и IPv6 соответственно)
|
||
|
|
listen 80;
|
||
|
|
listen [::]:80;
|
||
|
|
server_name es.ukrtb.ru www.es.ukrtb.ru;
|
||
|
|
|
||
|
|
# Prevent nginx HTTP Server Detection
|
||
|
|
server_tokens off;
|
||
|
|
|
||
|
|
# принудительный HTTPS
|
||
|
|
return 301 https://$server_name$request_uri;
|
||
|
|
}
|
||
|
|
|
||
|
|
server {
|
||
|
|
listen 443 ssl http2;
|
||
|
|
listen [::]:443 ssl http2;
|
||
|
|
server_name es.ukrtb.ru www.es.ukrtb.ru;
|
||
|
|
|
||
|
|
# корневая папка домена
|
||
|
|
root /var/www;
|
||
|
|
|
||
|
|
# кастомные странцицы ошибок
|
||
|
|
error_page 403 401 /custom_403.html;
|
||
|
|
error_page 404 /custom_404.html;
|
||
|
|
error_page 500 502 503 504 /custom_50x.html;
|
||
|
|
|
||
|
|
# для поисковых ботов
|
||
|
|
location = /robots.txt {
|
||
|
|
allow all;
|
||
|
|
log_not_found off;
|
||
|
|
access_log off;
|
||
|
|
}
|
||
|
|
|
||
|
|
# ald
|
||
|
|
location = /ald.sh {
|
||
|
|
return 301 https://es.ukrtb.ru/git/ukrtb/astra-ald/raw/branch/master/astra.sh;
|
||
|
|
}
|
||
|
|
|
||
|
|
# cs 1.6
|
||
|
|
location /cs {
|
||
|
|
autoindex on;
|
||
|
|
autoindex_localtime on;
|
||
|
|
autoindex_exact_size off;
|
||
|
|
location ~ /(.*)/.*\.cfg { # запрещаем скачивать cfg файлы
|
||
|
|
deny all;
|
||
|
|
}
|
||
|
|
location ~ /(.*)/addons/ { # запрещаем доступ к addons
|
||
|
|
deny all;
|
||
|
|
}
|
||
|
|
location ~ /(.*)/logs/ { # запрещаем доступ к addons
|
||
|
|
deny all;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# gitea
|
||
|
|
location /git/ {
|
||
|
|
add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-src 'self'; object-src 'self'";
|
||
|
|
proxy_pass http://localhost:3000/;
|
||
|
|
}
|
||
|
|
|
||
|
|
# ssl
|
||
|
|
location ~ /.well-known {
|
||
|
|
root /usr/share/nginx/html;
|
||
|
|
allow all;
|
||
|
|
}
|
||
|
|
|
||
|
|
# nextcloud
|
||
|
|
location ^~ /nextcloud {
|
||
|
|
# Remove X-Powered-By, which is an information leak
|
||
|
|
fastcgi_hide_header X-Powered-By;
|
||
|
|
add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-src 'self'; object-src 'self'";
|
||
|
|
|
||
|
|
# Specify how to handle directories -- specifying `/nextcloud/index.php$request_uri`
|
||
|
|
# here as the fallback means that Nginx always exhibits the desired behaviour
|
||
|
|
# when a client requests a path that corresponds to a directory that exists
|
||
|
|
# on the server. In particular, if that directory contains an index.php file,
|
||
|
|
# that file is correctly served; if it doesn't, then the request is passed to
|
||
|
|
# the front-end controller. This consistent behaviour means that we don't need
|
||
|
|
# to specify custom rules for certain paths (e.g. images and other assets,
|
||
|
|
# `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
|
||
|
|
# `try_files $uri $uri/ /nextcloud/index.php$request_uri`
|
||
|
|
# always provides the desired behaviour.
|
||
|
|
index index.php index.html /nextcloud/index.php$request_uri;
|
||
|
|
|
||
|
|
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
|
||
|
|
location = /nextcloud {
|
||
|
|
if ( $http_user_agent ~ ^DavClnt ) {
|
||
|
|
return 302 /nextcloud/remote.php/webdav/$is_args$args;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Rules borrowed from `.htaccess` to hide certain paths from clients
|
||
|
|
location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
|
||
|
|
location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
|
||
|
|
|
||
|
|
# Ensure this block, which passes PHP files to the PHP process, is above the blocks
|
||
|
|
# which handle static assets (as seen below). If this block is not declared first,
|
||
|
|
# then Nginx will encounter an infinite rewriting loop when it prepends
|
||
|
|
# `/nextcloud/index.php` to the URI, resulting in a HTTP 500 error response.
|
||
|
|
location ~ \.php(?:$|/) {
|
||
|
|
# Required for legacy support
|
||
|
|
rewrite ^/nextcloud/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /nextcloud/index.php$request_uri;
|
||
|
|
|
||
|
|
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||
|
|
set $path_info $fastcgi_path_info;
|
||
|
|
|
||
|
|
try_files $fastcgi_script_name =404;
|
||
|
|
|
||
|
|
include fastcgi_params;
|
||
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||
|
|
fastcgi_param PATH_INFO $path_info;
|
||
|
|
fastcgi_param HTTPS on;
|
||
|
|
|
||
|
|
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
|
||
|
|
fastcgi_param front_controller_active true; # Enable pretty urls
|
||
|
|
fastcgi_pass php-handler;
|
||
|
|
|
||
|
|
fastcgi_intercept_errors on;
|
||
|
|
fastcgi_request_buffering off;
|
||
|
|
|
||
|
|
fastcgi_max_temp_file_size 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
|
||
|
|
try_files $uri /nextcloud/index.php$request_uri;
|
||
|
|
add_header Cache-Control "public, max-age=15778463, $asset_immutable";
|
||
|
|
access_log off; # Optional: Don't log access to assets
|
||
|
|
|
||
|
|
location ~ \.wasm$ {
|
||
|
|
default_type application/wasm;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
location ~ \.woff2?$ {
|
||
|
|
try_files $uri /nextcloud/index.php$request_uri;
|
||
|
|
expires 7d; # Cache-Control policy borrowed from `.htaccess`
|
||
|
|
access_log off; # Optional: Don't log access to assets
|
||
|
|
}
|
||
|
|
|
||
|
|
# Rule borrowed from `.htaccess`
|
||
|
|
location /nextcloud/remote {
|
||
|
|
return 301 /nextcloud/remote.php$request_uri;
|
||
|
|
}
|
||
|
|
|
||
|
|
location /nextcloud {
|
||
|
|
try_files $uri $uri/ /nextcloud/index.php$request_uri;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|