From a159c2ac3d755d79308860cfd873c4f76c4ae6a4 Mon Sep 17 00:00:00 2001 From: django Date: Sun, 17 Aug 2025 02:10:46 -0700 Subject: [PATCH] the fix --- nginx.conf | 173 +++++++++++++++++++++++++++++++++++------------------ 1 file changed, 116 insertions(+), 57 deletions(-) diff --git a/nginx.conf b/nginx.conf index 90a1c15..e684854 100644 --- a/nginx.conf +++ b/nginx.conf @@ -1,4 +1,4 @@ -user nginx; +user www-data; worker_processes auto; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; @@ -8,107 +8,166 @@ events { } http { - # Security headers - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Frame-Options SAMEORIGIN; - add_header Referrer-Policy no-referrer; - add_header Content-Security-Policy "default-src 'self';"; - - # Hide nginx version - server_tokens off; - + # Basic settings include /etc/nginx/mime.types; default_type application/octet-stream; - - # Add custom MIME types + server_tokens off; + + # Additional MIME types types { font/woff2 woff2; application/javascript mjs; } - + # Logging access_log /var/log/nginx/access.log combined; error_log /var/log/nginx/error.log error; - + # Gzip compression gzip on; - gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; - + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/vnd.ms-fontobject application/x-font-ttf font/opentype image/svg+xml image/x-icon; + + # Upstream PHP handler upstream php-handler { server nextcloud:9000; } - + + # HTTP to HTTPS redirect (optional, uncomment if needed) + # server { + # listen 80; + # listen [::]:80; + # server_name gabenszip.com; + # return 301 https://$server_name$request_uri; + # } + server { listen 80 default_server; listen [::]:80 default_server; - server_name example.com; - + server_name gabenszip.com; + + # Path to webroot root /var/www/html; - index index.php index.html index.htm; - + + # Max upload size client_max_body_size 10G; + client_body_timeout 300s; fastcgi_buffers 64 4K; - fastcgi_read_timeout 3600; - + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + # HTTP response headers - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always; add_header Referrer-Policy "no-referrer" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Download-Options "noopen" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Permitted-Cross-Domain-Policies "none" always; - add_header X-Robots-Tag "none" always; + add_header X-Robots-Tag "noindex, nofollow" always; add_header X-XSS-Protection "1; mode=block" always; - add_header Content-Security-Policy "frame-ancestors 'self'; connect-src 'self' blob: stun.nextcloud.com:443 gabenszip.com:443"; - - + + # Remove X-Powered-By, which is an information leak + fastcgi_hide_header X-Powered-By; + + # Specify how to handle directories -- first look for an index.html file + index index.php index.html /index.php$request_uri; + + # Rule borrowed from `.htaccess` to handle Microsoft DAV clients + location = / { + if ( $http_user_agent ~ ^DavClnt ) { + return 302 /remote.php/webdav/$is_args$args; + } + } + location = /robots.txt { allow all; log_not_found off; access_log off; } - - location = /.well-known/carddav { - return 301 $scheme://$host/remote.php/dav; + + # Make a regex exception for `/.well-known` so that clients can still + # access it despite the existence of the regex rule + # `location ~ /(\.|autotest|...)` which would otherwise handle requests + # for `/.well-known`. + location ^~ /.well-known { + # The rules in this block are an adaptation of the rules + # in `.htaccess` that concern `/.well-known`. + + location = /.well-known/carddav { return 301 /remote.php/dav/; } + location = /.well-known/caldav { return 301 /remote.php/dav/; } + + location /.well-known/acme-challenge { try_files $uri $uri/ =404; } + location /.well-known/pki-validation { try_files $uri $uri/ =404; } + + # Let Nextcloud's API for `/.well-known` URIs handle all other + # requests by passing them to the front-end controller. + return 301 /index.php$request_uri; } - - location = /.well-known/caldav { - return 301 $scheme://$host/remote.php/dav; - } - - location /.well-known/acme-challenge { } - - location ^~ / { - try_files $uri $uri/ /index.php$request_uri; - } - + + # Rules borrowed from `.htaccess` to hide certain paths from clients + location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } + location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } + + # Ensure this block, which passes PHP files to the PHP process, is above the blocks + # which handle static assets (as seen below). If this block is not declared first, + # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php` + # to the URI, resulting in a HTTP 500 error response. location ~ \.php(?:$|/) { - fastcgi_split_path_info ^(.+\.php)(/.+)$; + # Required for legacy support + rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri; + + fastcgi_split_path_info ^(.+?\.php)(/.*)$; + set $path_info $fastcgi_path_info; + + try_files $fastcgi_script_name =404; + include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - fastcgi_param PATH_INFO $fastcgi_path_info; - fastcgi_param modHeadersAvailable true; - fastcgi_param front_controller_active true; + fastcgi_param PATH_INFO $path_info; + fastcgi_param HTTPS on; + + fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice + fastcgi_param front_controller_active true; # Enable pretty urls fastcgi_pass php-handler; + fastcgi_intercept_errors on; fastcgi_request_buffering off; + + fastcgi_max_temp_file_size 0; fastcgi_read_timeout 3600; } - - location ~ \.(?:css|js|woff2?|svg|gif|map)$ { + + # Serve static files + location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map)$ { try_files $uri /index.php$request_uri; - expires 6M; - access_log off; + add_header Cache-Control "public, max-age=15778463, $asset_immutable"; + access_log off; # Optional: Don't log access to assets + + location ~ \.wasm$ { + default_type application/wasm; + } } - + location ~ \.woff2?$ { - expires 6M; - access_log off; + try_files $uri /index.php$request_uri; + expires 7d; # Cache-Control policy borrowed from `.htaccess` + access_log off; # Optional: Don't log access to assets } - - location ~ /(?:\.|autotest|occ|issue|indie|db_|console) { - deny all; + + # Rule borrowed from `.htaccess` + location /remote { + return 301 /remote.php$request_uri; + } + + location / { + try_files $uri $uri/ /index.php$request_uri; } } } \ No newline at end of file