119 lines
4.2 KiB
Nginx Configuration File
119 lines
4.2 KiB
Nginx Configuration File
# Example nginx config
|
|
# for serving tkr as a subdfolder with SSL
|
|
# e.g. https://my-domain.com/tkr
|
|
#
|
|
# Use SSL in production.
|
|
# This is a minimal SSL confiuration
|
|
# For more robust SSL configuration, refer to https://ssl-config.mozilla.org/
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
|
|
# CONFIG: Replace localhost with your domain e.g. my-domain.com
|
|
server_name localhost;
|
|
|
|
# CONFIG:
|
|
# Assumes you're using letsencrypt for cert generation
|
|
# Replace with the actual paths to your cert and key
|
|
ssl_certificate /etc/letsencrypt/live/my-domain.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/my-domain.com/privkey.pem;
|
|
|
|
# Security headers
|
|
# The first rule is to prevent including in a frame on a different domain.
|
|
# Remove it if you want to do that.
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
# Deny access to hidden files
|
|
location ~ /\. {
|
|
deny all;
|
|
access_log off;
|
|
log_not_found off;
|
|
}
|
|
|
|
# PHP routing - everything under /tkr goes through index.php
|
|
location /tkr {
|
|
# CONFIG:
|
|
# replace "/var/www/tkr" with the directory you extracted the .zip file to (if different)
|
|
alias /var/www/tkr/public;
|
|
index index.php;
|
|
|
|
# Cache static files
|
|
# Note that I don't actually serve most of this (just css)
|
|
# but this prevents requests for static content from getting to the PHP handler.
|
|
#
|
|
# I've excluded /css/custom so that requests for uploaded css can be handled by the PHP app.
|
|
# That lets me store uploaded content outside of the document root,
|
|
# so it isn't served directly.
|
|
location ~* ^/tkr/(?!css/custom/).+\.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# index.php is the entry point
|
|
# It needs to be sent to php-fpm
|
|
# But if someone tries to directly access index.php, that file will throw a 404
|
|
# so bots and scanners can't tell this is a php app
|
|
location = /tkr/index.php {
|
|
# CONFIG:
|
|
# If you're running php-fpm on the same server as nginx,
|
|
# then change this to the local php-fpm socket
|
|
# e.g. fastcgi_pass unix:/run/php/php8.2-fpm.sock;
|
|
fastcgi_pass php:9000;
|
|
|
|
# CONFIG:
|
|
# replace "/var/www/tkr" with the directory you extracted the .zip file to (if different)
|
|
fastcgi_param SCRIPT_FILENAME /var/www/tkr/public/index.php;
|
|
include fastcgi_params;
|
|
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
}
|
|
|
|
# Block attempts to access all other .php files directly
|
|
# (these are bots and scanners)
|
|
location ~ ^/tkr/.+\.php$ {
|
|
return 404;
|
|
}
|
|
|
|
# forward other requests to the fallback block,
|
|
# which sends them to php-fpm for handling
|
|
try_files $uri $uri/ @tkr_fallback;
|
|
}
|
|
|
|
# Fallback for /tkr routing - all non-file requests (e.g. /login) go to index.php
|
|
location @tkr_fallback {
|
|
# CONFIG:
|
|
# If you're running php-fpm on the same server as nginx,
|
|
# then change this to the local php-fpm socket
|
|
# e.g. fastcgi_pass unix:/run/php/php8.2-fpm.sock;
|
|
fastcgi_pass php:9000;
|
|
|
|
# CONFIG:
|
|
# replace "/var/www/tkr" with the directory you extracted the .zip file to (if different)
|
|
fastcgi_param SCRIPT_FILENAME /var/www/tkr/public/index.php;
|
|
fastcgi_param SCRIPT_FILENAME /var/www/tkr/public/index.php;
|
|
include fastcgi_params;
|
|
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
}
|
|
|
|
# Deny access to sensitive directories
|
|
location ~ ^/tkr/(storage|src|templates|uploads|config) {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
|
|
return 301 https://$host$request_uri;
|
|
}
|