Login Register

meson / tau.meson.one

Last active 3 weeks ago

Like 0
nginx static

meson revised this gist 3 weeks ago · acbc0d5

1 file changed, 96 insertions

tau.meson.one (file created)
@@ -0,0 +1,96 @@
1 + server {
2 + if ($host = tau.meson.one) {
3 + return 301 https://$host$request_uri;
4 + } # managed by Certbot
5 +
6 + listen 80 default_server;
7 + listen [::]:80 default_server;
8 + server_name tau.meson.one;
9 + return 301 https://$server_name$request_uri;
10 +
11 + access_log /var/log/nginx/tau.meson.one.log combined if=$loggable;
12 + error_log /var/log/nginx/_error_tau.meson.one.log warn;
13 +
14 + }
15 +
16 + server {
17 + # HTTP/2 over TCP
18 + listen 443 ssl default_server;
19 + listen [::]:443 ssl default_server;
20 +
21 + # HTTP/3 over QUIC/UDP
22 + listen 443 quic;
23 + listen [::]:443 quic;
24 +
25 + http2 on;
26 + http3 on;
27 +
28 + add_header Alt-Svc 'h3=":443"; ma=86400' always;
29 +
30 + server_name tau.meson.one;
31 + root /var/www/tau.meson.one;
32 + index index.html;
33 +
34 + access_log /var/log/nginx/tau.meson.one.log combined if=$loggable;
35 + error_log /var/log/nginx/_error_tau.meson.one.log warn;
36 +
37 + error_page 404 /notfound.html;
38 + error_page 401 /notauthorized.html;
39 +
40 + include /etc/letsencrypt/options-ssl-nginx.conf;
41 +
42 + client_max_body_size 0;
43 + proxy_read_timeout 300; # answer from server, 5 min
44 + proxy_send_timeout 300; # chunks to server, 5 min
45 + proxy_set_header Host $host;
46 + proxy_set_header X-Real-IP $remote_addr;
47 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
48 + proxy_set_header X-Forwarded-Proto $scheme;
49 + port_in_redirect off;
50 + ssl_certificate /etc/letsencrypt/live/tau.meson.one/fullchain.pem; # managed by Certbot
51 + ssl_certificate_key /etc/letsencrypt/live/tau.meson.one/privkey.pem; # managed by Certbot
52 + ssl_dhparam /etc/letsencrypt/dh/tau.pem;
53 +
54 + # Add headers to serve security related headers
55 + add_header Strict-Transport-Security "max-age=63072000" always;
56 + add_header X-Content-Type-Options nosniff;
57 + add_header X-Frame-Options "SAMEORIGIN";
58 + add_header X-XSS-Protection "1; mode=block";
59 + add_header X-Robots-Tag none;
60 + add_header X-Download-Options noopen;
61 + add_header X-Permitted-Cross-Domain-Policies none;
62 + add_header Referrer-Policy "strict-origin";
63 + add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
64 + # add_header Content-Security-Policy "default-src 'self' www.google-analytics.com ajax.googleapis.com www.google.com google.com gstatic.com www.gstatic.com connect.facebook.net facebook.com;";
65 +
66 + # ssl_stapling on;
67 + # ssl_stapling_verify on;
68 +
69 + ssl_trusted_certificate /etc/letsencrypt/live/tau.meson.one/chain.pem;
70 + resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 valid=300s;
71 + resolver_timeout 5s;
72 +
73 + location / {
74 + try_files $uri $uri/ /index.php?$query_string;
75 + }
76 +
77 + # config.php and data/ never need to be served directly.
78 + # These MUST come before the ~ \.php$ block below — nginx picks the
79 + # first matching regex location by order-in-file, not by specificity,
80 + # so if the generic .php block came first it would win and serve
81 + # config.php straight through PHP-FPM (returns 200, not 403/404).
82 + location = /config.php {
83 + deny all;
84 + }
85 +
86 + location ^~ /data/ {
87 + deny all;
88 + }
89 +
90 + location ~ \.php$ {
91 + include fastcgi_params;
92 + fastcgi_pass unix:/run/php/php-fpm.sock;
93 + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
94 + }
95 +
96 + }