87 lines
2.4 KiB
Text
87 lines
2.4 KiB
Text
# HTTP redirect
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name .$DOMAIN;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# HTTPS server
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_name .$DOMAIN;
|
|
|
|
# SSL certificates
|
|
ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
|
|
|
|
# Apply general rate limit
|
|
limit_req zone=general burst=100 nodelay;
|
|
|
|
# Content Security Policy (needs to be per-domain)
|
|
add_header Content-Security-Policy "
|
|
default-src 'self' *.$DOMAIN;
|
|
script-src 'self' 'unsafe-inline' 'unsafe-eval' *.$DOMAIN;
|
|
style-src 'self' 'unsafe-inline' *.$DOMAIN;
|
|
img-src 'self' data: *.$DOMAIN;
|
|
font-src 'self' data: *.$DOMAIN;
|
|
connect-src 'self' *.$DOMAIN;
|
|
frame-src 'self' *.$DOMAIN;
|
|
media-src 'self' *.$DOMAIN;
|
|
object-src 'none';
|
|
base-uri 'self';
|
|
form-action 'self' *.$DOMAIN;
|
|
" always;
|
|
|
|
# Subdomain handling
|
|
set $subdomain '';
|
|
set $full_root "/var/www/$DOMAIN/_main/www";
|
|
set $access_log_path "/var/www/$DOMAIN/logs/main.access.log";
|
|
set $error_log_path "/var/www/$DOMAIN/logs/main.error.log";
|
|
if ($host ~* ^([^.]+)\.$DOMAIN$) {
|
|
set $subdomain $1;
|
|
set $full_root "/var/www/$DOMAIN/subdomains/$subdomain/www";
|
|
set $access_log_path "/var/www/$DOMAIN/logs/$subdomain.access.log";
|
|
set $error_log_path "/var/www/$DOMAIN/logs/$subdomain.error.log";
|
|
}
|
|
root $full_root;
|
|
|
|
# Basic settings
|
|
index index.html index.htm index.php;
|
|
client_max_body_size 20M;
|
|
|
|
# Block .ht* files
|
|
location ~ /\.ht {
|
|
deny all;
|
|
}
|
|
|
|
# Main location block
|
|
location / {
|
|
try_files $uri $uri/ @router;
|
|
}
|
|
|
|
# Router handling
|
|
location @router {
|
|
if (!-f $document_root/router.php) {
|
|
return 404;
|
|
}
|
|
limit_req zone=php burst=20 nodelay;
|
|
fastcgi_pass unix:/var/run/php/php-fpm.sock;
|
|
include fastcgi_params;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/router.php;
|
|
}
|
|
|
|
# Static file handling
|
|
location ~* ^.+\.((?!php).)*$ {
|
|
expires 30d;
|
|
add_header Cache-Control "public, no-transform";
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
# Logging
|
|
access_log /var/log/nginx/access.log;
|
|
error_log /var/log/nginx/error.log;
|
|
access_log $access_log_path;
|
|
error_log $error_log_path;
|
|
}
|