Login Register

meson / tau.meson.one

Last active 3 weeks ago

Like 0
nginx static

Revision acbc0d541878d8523194d91388e606c1b3821648

tau.meson.one Raw
1server {
2 if ($host = tau.meson.one) {
3 return 301 https://$host$request_uri;
4 } # managed by Certbot
5
6 listen 80 default_server;
7 listen [::]:80 default_server;
8 server_name tau.meson.one;
9 return 301 https://$server_name$request_uri;
10
11 access_log /var/log/nginx/tau.meson.one.log combined if=$loggable;
12 error_log /var/log/nginx/_error_tau.meson.one.log warn;
13
14}
15
16server {
17 # HTTP/2 over TCP
18 listen 443 ssl default_server;
19 listen [::]:443 ssl default_server;
20
21 # HTTP/3 over QUIC/UDP
22 listen 443 quic;
23 listen [::]:443 quic;
24
25 http2 on;
26 http3 on;
27
28 add_header Alt-Svc 'h3=":443"; ma=86400' always;
29
30 server_name tau.meson.one;
31 root /var/www/tau.meson.one;
32 index index.html;
33
34 access_log /var/log/nginx/tau.meson.one.log combined if=$loggable;
35 error_log /var/log/nginx/_error_tau.meson.one.log warn;
36
37 error_page 404 /notfound.html;
38 error_page 401 /notauthorized.html;
39
40 include /etc/letsencrypt/options-ssl-nginx.conf;
41
42 client_max_body_size 0;
43 proxy_read_timeout 300; # answer from server, 5 min
44 proxy_send_timeout 300; # chunks to server, 5 min
45 proxy_set_header Host $host;
46 proxy_set_header X-Real-IP $remote_addr;
47 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
48 proxy_set_header X-Forwarded-Proto $scheme;
49 port_in_redirect off;
50 ssl_certificate /etc/letsencrypt/live/tau.meson.one/fullchain.pem; # managed by Certbot
51 ssl_certificate_key /etc/letsencrypt/live/tau.meson.one/privkey.pem; # managed by Certbot
52 ssl_dhparam /etc/letsencrypt/dh/tau.pem;
53
54 # Add headers to serve security related headers
55 add_header Strict-Transport-Security "max-age=63072000" always;
56 add_header X-Content-Type-Options nosniff;
57 add_header X-Frame-Options "SAMEORIGIN";
58 add_header X-XSS-Protection "1; mode=block";
59 add_header X-Robots-Tag none;
60 add_header X-Download-Options noopen;
61 add_header X-Permitted-Cross-Domain-Policies none;
62 add_header Referrer-Policy "strict-origin";
63 add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
64# add_header Content-Security-Policy "default-src 'self' www.google-analytics.com ajax.googleapis.com www.google.com google.com gstatic.com www.gstatic.com connect.facebook.net facebook.com;";
65
66 # ssl_stapling on;
67 # ssl_stapling_verify on;
68
69 ssl_trusted_certificate /etc/letsencrypt/live/tau.meson.one/chain.pem;
70 resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 valid=300s;
71 resolver_timeout 5s;
72
73 location / {
74 try_files $uri $uri/ /index.php?$query_string;
75 }
76
77 # config.php and data/ never need to be served directly.
78 # These MUST come before the ~ \.php$ block below — nginx picks the
79 # first matching regex location by order-in-file, not by specificity,
80 # so if the generic .php block came first it would win and serve
81 # config.php straight through PHP-FPM (returns 200, not 403/404).
82 location = /config.php {
83 deny all;
84 }
85
86 location ^~ /data/ {
87 deny all;
88 }
89
90 location ~ \.php$ {
91 include fastcgi_params;
92 fastcgi_pass unix:/run/php/php-fpm.sock;
93 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
94 }
95
96}