Vesta Control Panel - Forum

Code: Select all

server {
    listen      %ip%:%web_port%;
    listen      [::]:%web_port%;
    server_name %domain_idn% %alias_idn%;
    root        %docroot%;
    index       index.php index.html index.htm;
    access_log  /var/log/nginx/domains/%domain%.log combined;
    access_log  /var/log/nginx/domains/%domain%.bytes bytes;
    error_log   /var/log/nginx/domains/%domain%.error.log error;

    location '/.well-known/acme-challenge' {
       default_type "text/plain";
       allow all;
       break;
    }

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    location / {
        rewrite ^(.*) https://%domain%$1 permanent;
    }

    include     %home%/%user%/conf/web/nginx.%domain%.conf*;
}

Code: Select all

server {
    listen      %ip%:%web_ssl_port% ssl http2;
    listen      [::]:%web_ssl_port% ssl http2;
    server_name %domain_idn% %alias_idn%;
    root        %docroot%;
    index       index.php index.html index.htm;
    access_log  /var/log/nginx/domains/%domain%.log combined;
    access_log  /var/log/nginx/domains/%domain%.bytes bytes;
    error_log   /var/log/nginx/domains/%domain%.error.log error;

    #ssl         on;
    ssl_certificate      %ssl_pem%;
    ssl_certificate_key  %ssl_key%;

    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Robots-Tag none always;
    add_header X-Download-Options noopen always;
    add_header X-Permitted-Cross-Domain-Policies none always;
    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload" always;


  location = /data/htaccesstest.txt {
      allow all;
      log_not_found off;
      access_log off;
  }

  location = /data/\.ocdata {
      access_log off;
  }

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

      location / {
          rewrite ^ /index.php$uri;
      }

      location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
          return 404;
      }
      location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
          return 404;
      }

      location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|ocm-provider/.+|core/templates/40[34])\.php(?:$|/) {
          fastcgi_split_path_info ^(.+\.php)(/.*)$;
          include fastcgi_params;
          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
          fastcgi_param SCRIPT_NAME $fastcgi_script_name; # necessary for owncloud to detect the contextroot https://github.com/owncloud/core/blob/v10.0.0/lib/private/AppFramework/Http/Request.php#L603
          fastcgi_param PATH_INFO $fastcgi_path_info;
          fastcgi_param HTTPS on;
          fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
          fastcgi_param front_controller_active true;
          fastcgi_read_timeout 180; # increase default timeout e.g. for long running carddav/ caldav syncs with 1000+ entries

          #fastcgi_pass php-handler;
          fastcgi_intercept_errors on;
          fastcgi_request_buffering off; #Available since NGINX 1.7.11


           location ~ [^/]\.php(/|$) {
               fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
               if (!-f $document_root$fastcgi_script_name) {
                   return  404;
               }

               fastcgi_pass    %backend_lsnr%;
               fastcgi_index   index.php;
               include         /etc/nginx/fastcgi_params;
           }

      }

      location ~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|/) {
          try_files $uri $uri/ =404;
          index index.php;
      }

      # Adding the cache control header for js and css files
      # Make sure it is BELOW the PHP block
      location ~ \.(?:css|js)$ {
          try_files $uri /index.php$uri$is_args$args;
          add_header Cache-Control "max-age=15778463" always;

          # Add headers to serve security related headers (It is intended to have those duplicated to the ones above)
          # The always parameter ensures that the header is set for all responses, including internally generated error responses.
          # Before enabling Strict-Transport-Security headers please read into this topic first.
          # https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/

          add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload" always;
          add_header X-Content-Type-Options nosniff always;
          add_header X-Frame-Options "SAMEORIGIN" always;
          add_header X-XSS-Protection "1; mode=block" always;
          add_header X-Robots-Tag none always;
          add_header X-Download-Options noopen always;
          add_header X-Permitted-Cross-Domain-Policies none always;
          # Optional: Don't log access to assets
          access_log off;
      }

      location ~ \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg|map|json)$ {
          add_header Cache-Control "public, max-age=7200" always;
          try_files $uri /index.php$uri$is_args$args;
          # Optional: Don't log access to other assets
          access_log off;
      }

#    location / {
#
#        include     %home%/%user%/conf/web/nginx.%domain%.rules.conf*;

#        try_files $uri $uri/ /index.php?$args;

#        location ~* ^.+\.(jpeg|jpg|png|gif|bmp|ico|svg|css|js)$ {
#            expires     max;
#        }
#
#        location ~ [^/]\.php(/|$) {
#            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#            if (!-f $document_root$fastcgi_script_name) {
#                return  404;
#            }
#
#            fastcgi_pass    %backend_lsnr%;
#            fastcgi_index   index.php;
#            include         /etc/nginx/fastcgi_params;
#        }
#    }

    error_page  403 /error/404.html;
    error_page  404 /error/404.html;
    error_page  500 502 503 504 /error/50x.html;

    location /error/ {
        alias   %home%/%user%/web/%domain%/document_errors/;
    }

    location ~* "/\.(htaccess|htpasswd)$" {
        deny    all;
        return  404;
    }



    include     /etc/nginx/conf.d/phpmyadmin.inc*;
    include     /etc/nginx/conf.d/phppgadmin.inc*;
    include     /etc/nginx/conf.d/webmail.inc*;

    include     %home%/%user%/conf/web/nginx.%domain%.conf*;
}