# юзер
user www-data;

# воркеры
worker_processes  auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 30000;

pcre_jit on;

# логи
error_log  /var/log/nginx/error.log;
pid        /var/run/nginx.pid;

# евенты
events {
    worker_connections  8192;
}

# настройка для всех страниц
http {
    # типы файлов
    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
 
    # лимиты всякие
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    reset_timedout_connection on;
    keepalive_timeout  300;
    keepalive_requests 10000;
    send_timeout        1200;
    client_body_timeout 30;
    client_header_timeout       30;
    types_hash_max_size 2048;
    server_names_hash_max_size  4096;

    client_max_body_size       10m;

    proxy_connect_timeout      5;
    proxy_send_timeout         10;
    proxy_read_timeout         10;
    proxy_temp_file_write_size 64k;
    proxy_buffer_size          4k;
    proxy_buffers              32 16k;
    proxy_busy_buffers_size    32k;

    charset_types text/xml text/plain text/css text/vnd.wap.wml application/javascript application/rss+xml;

    # настройки сжатия
    gzip                on;
    gzip_static         on;
    gzip_types          text/plain text/css text/xml application/javascript application/json application/msword application/rtf application/pdf application/vnd.ms-excel image/x-icon image/svg+xml application/font-ttf application/font-woff;
    gzip_comp_level     7;
    gzip_proxied        any;
    gzip_min_length     1000;
    gzip_disable        "msie6";
    gzip_vary           on;

    etag                off;

    open_file_cache          max=10000 inactive=60s;
    open_file_cache_valid    30s;
    open_file_cache_errors   on;
    open_file_cache_min_uses 2;

    # настройки для proxy_pass
    proxy_set_header   Host             $host;
    proxy_set_header   Connection       $http_connection;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header   X-Scheme         $scheme;
    proxy_redirect     off;
    proxy_http_version 1.1;
    proxy_cache_valid 1h;
    proxy_cache_key $scheme$proxy_host$request_uri$cookie_US;

    # защита от XSS
    add_header 'Referrer-Policy' 'strict-origin-when-cross-origin';
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Content-Security-Policy "script-src 'self'; frame-src 'self'; object-src 'self'";
    
    #хз
    limit_conn_zone $binary_remote_addr$host zone=lone:10m;
    limit_req_zone  $binary_remote_addr$host zone=ltwo:10m   rate=3r/s;
    limit_req_zone  $binary_remote_addr$host zone=highspeed:10m  rate=20r/s;

    log_format postdata '$remote_addr - $time_local - $request_body';

    # Nginx Amplify format
    log_format  main_ext '$remote_addr - $host [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer" '
                         '"$http_user_agent" "$http_x_forwarded_for" '
                         'rt=$request_time ua="$upstream_addr" '
                         'us="$upstream_status" ut="$upstream_response_time" '
                         'ul="$upstream_response_length" '
                         'cs=$upstream_cache_status' ;

    log_format  crypto  '$remote_addr - $host - [$time_local] - $ssl_protocol - $ssl_cipher'
                        ' "$http_user_agent" $ssl_early_data';


    # логи
    access_log  /var/log/nginx/access.log main_ext;
    access_log  /var/log/nginx/ssl.log crypto;

    # протоколы tls (1.1 вырублен - не безопасный)
    ssl_protocols TLSv1.2 TLSv1.3;

    # включены только безопасные алгоритмы шифрования (не нужно, если TlSv1.2 тоже вырубить)
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache    shared:SSL:10m;
    ssl_session_tickets  on;
    ssl_session_timeout  28h;
    ssl_early_data on;

    # ssl сертификаты
    ssl_certificate     /etc/letsencrypt/live/es.ukrtb.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/es.ukrtb.ru/privkey.pem;
    server_tokens off; 
	
    # hsts
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload;" always;

    ssl_buffer_size 16k;
    http2_chunk_size 8k;
    http2_idle_timeout 5m;

    resolver 77.88.8.8 valid=300s ipv6=off;
    resolver_timeout 5s;

    map $http_accept $webp_suffix {
        "~*webp"  ".webp";
    }

    map $msie $cache_control {
            default "max-age=31536000, public, no-transform, immutable";
        "1"     "max-age=31536000, private, no-transform, immutable";
    }

    map $msie $vary_header {
        default "Accept";
        "1"     "";
    }

    map $http_user_agent $limit_bots {
        default 0;
        ~*(google|bing|yandex|msnbot) 1;
        ~*(AltaVista|Googlebot|Slurp|BlackWidow|Bot|ChinaClaw|Custo|DISCo|Download|Demon|eCatch|EirGrabber|EmailSiphon|EmailWolf|SuperHTTP|Surfbot|WebWhacker) 1;
        ~*(Express|WebPictures|ExtractorPro|EyeNetIE|FlashGet|GetRight|GetWeb!|Go!Zilla|Go-Ahead-Got-It|GrabNet|Grafula|HMView|Go!Zilla|Go-Ahead-Got-It) 1;
        ~*(rafula|HMView|HTTrack|Stripper|Sucker|Indy|InterGET|Ninja|JetCar|Spider|larbin|LeechFTP|Downloader|tool|Navroad|NearSite|NetAnts|tAkeOut|WWWOFFLE) 1;
        ~*(GrabNet|NetSpider|Vampire|NetZIP|Octopus|Offline|PageGrabber|Foto|pavuk|pcBrowser|RealDownload|ReGet|SiteSnagger|SmartDownload|SuperBot|WebSpider) 1;
        ~*(Teleport|VoidEYE|Collector|WebAuto|WebCopier|WebFetch|WebGo|WebLeacher|WebReaper|WebSauger|eXtractor|Quester|WebStripper|WebZIP|Wget|Widow|Zeus) 1;
        ~*(Twengabot|htmlparser|libwww|Python|perl|urllib|scan|Curl|email|PycURL|Pyth|PyQ|WebCollector|WebCopy|webcraw) 1;
    }
    
    # ssi
    ssi on;

    # подгружает конфиги сайтов из этой папки
    # include /etc/nginx/sites-enabled/*;
	
# бэкенд некстклауда
upstream php-handler {
    server unix:/var/run/php/php8.1-fpm.sock;
}

# Set the `immutable` cache control options only for assets with a cache busting `v` argument
map $arg_v $asset_immutable {
    "" "";
    default "immutable";
}

# настройка самих страниц
server {
    # порты, которые слушаются (IPv4  и IPv6 соответственно)
    listen 80;
    listen [::]:80;
    server_name es.ukrtb.ru www.es.ukrtb.ru;
 
    # Prevent nginx HTTP Server Detection
    server_tokens off;

    # принудительный HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443      ssl http2;
    listen [::]:443 ssl http2;
    server_name es.ukrtb.ru www.es.ukrtb.ru;

    # корневая папка домена
    root /var/www;

    # кастомные странцицы ошибок
    error_page 403 401 /custom_403.html;
    error_page 404 /custom_404.html;
    error_page 500 502 503 504 /custom_50x.html;

    # для поисковых ботов
    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }
    
    # ald
    location = /ald.sh {
	return 301 https://es.ukrtb.ru/git/ukrtb/astra-ald/raw/branch/master/astra.sh;	
    }
 
    # cs 1.6
    location /cs {
        autoindex on;
        autoindex_localtime on;
        autoindex_exact_size off;
	location ~ /(.*)/.*\.cfg { # запрещаем скачивать cfg файлы
                deny all;
        }
        location ~ /(.*)/addons/ { # запрещаем доступ к addons
                deny all;
        }
        location ~ /(.*)/logs/ { # запрещаем доступ к addons
                deny all;
        }
    }

    # gitea
    location /git/ {
        add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-src 'self'; object-src 'self'";
        proxy_pass http://localhost:3000/;
    }

    # ssl
    location ~ /.well-known {
        root /usr/share/nginx/html;
        allow all;
    }

    # nextcloud
    location ^~ /nextcloud {
        # Remove X-Powered-By, which is an information leak
        fastcgi_hide_header X-Powered-By;
        add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-src 'self'; object-src 'self'";

        # Specify how to handle directories -- specifying `/nextcloud/index.php$request_uri`
        # here as the fallback means that Nginx always exhibits the desired behaviour
        # when a client requests a path that corresponds to a directory that exists
        # on the server. In particular, if that directory contains an index.php file,
        # that file is correctly served; if it doesn't, then the request is passed to
        # the front-end controller. This consistent behaviour means that we don't need
        # to specify custom rules for certain paths (e.g. images and other assets,
        # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
        # `try_files $uri $uri/ /nextcloud/index.php$request_uri`
        # always provides the desired behaviour.
        index index.php index.html /nextcloud/index.php$request_uri;

        # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
        location = /nextcloud {
            if ( $http_user_agent ~ ^DavClnt ) {
                return 302 /nextcloud/remote.php/webdav/$is_args$args;
            }
        }

        # Rules borrowed from `.htaccess` to hide certain paths from clients
        location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)    { return 404; }
        location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console)                  { return 404; }

        # Ensure this block, which passes PHP files to the PHP process, is above the blocks
        # which handle static assets (as seen below). If this block is not declared first,
        # then Nginx will encounter an infinite rewriting loop when it prepends
        # `/nextcloud/index.php` to the URI, resulting in a HTTP 500 error response.
        location ~ \.php(?:$|/) {
            # Required for legacy support
            rewrite ^/nextcloud/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /nextcloud/index.php$request_uri;

            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
            set $path_info $fastcgi_path_info;

            try_files $fastcgi_script_name =404;

            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $path_info;
            fastcgi_param HTTPS on;

            fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
            fastcgi_param front_controller_active true;     # Enable pretty urls
            fastcgi_pass php-handler;

            fastcgi_intercept_errors on;
            fastcgi_request_buffering off;

            fastcgi_max_temp_file_size 0;
        }

        location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
            try_files $uri /nextcloud/index.php$request_uri;
            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
            access_log off;     # Optional: Don't log access to assets

            location ~ \.wasm$ {
                default_type application/wasm;
            }
        }

        location ~ \.woff2?$ {
            try_files $uri /nextcloud/index.php$request_uri;
            expires 7d;         # Cache-Control policy borrowed from `.htaccess`
            access_log off;     # Optional: Don't log access to assets
        }

        # Rule borrowed from `.htaccess`
        location /nextcloud/remote {
            return 301 /nextcloud/remote.php$request_uri;
        }

        location /nextcloud {
            try_files $uri $uri/ /nextcloud/index.php$request_uri;
        }
    }
}
}