add auth file
parent
0f1588e246
commit
f64b538e84
|
|
@ -1,23 +1,23 @@
|
|||
version: "3.9"
|
||||
services:
|
||||
freeipa:
|
||||
image: "freeipa/freeipa-server:centos-8"
|
||||
restart: "unless-stopped"
|
||||
privileged: true
|
||||
read_only: true
|
||||
volumes:
|
||||
- "/var/lib/ipa-data:/data:Z"
|
||||
- "/var/lib/ipa-data/z/tmp:/tmp"
|
||||
- "/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
hostname: id.libraryofcode.org
|
||||
sysctls:
|
||||
- net.ipv6.conf.all.disable_ipv6=0
|
||||
ports:
|
||||
- "7810:80/tcp"
|
||||
- "7811:88/tcp"
|
||||
- "7812:389/tcp"
|
||||
- "7813:443/tcp"
|
||||
- "7814:123/udp"
|
||||
- "7815:464/tcp"
|
||||
- "7816:636/udp"
|
||||
- "7817:464/udp"
|
||||
version: "3.9"
|
||||
services:
|
||||
freeipa:
|
||||
image: "freeipa/freeipa-server:centos-8"
|
||||
restart: "unless-stopped"
|
||||
privileged: true
|
||||
read_only: true
|
||||
volumes:
|
||||
- "/var/lib/ipa-data:/data:Z"
|
||||
- "/var/lib/ipa-data/z/tmp:/tmp"
|
||||
- "/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||||
hostname: id.libraryofcode.org
|
||||
sysctls:
|
||||
- net.ipv6.conf.all.disable_ipv6=0
|
||||
ports:
|
||||
- "7810:80/tcp"
|
||||
- "7811:88/tcp"
|
||||
- "7812:389/tcp"
|
||||
- "7813:443/tcp"
|
||||
- "7814:123/udp"
|
||||
- "7815:464/tcp"
|
||||
- "7816:636/udp"
|
||||
- "7817:464/udp"
|
||||
|
|
|
|||
|
|
@ -1,42 +1,42 @@
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name beta.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
#include /etc/nginx/error/502;
|
||||
#include /etc/nginx/error/504;
|
||||
#include /etc/nginx/error/500;
|
||||
#include /etc/nginx/error/404;
|
||||
#include /etc/nginx/error/429;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
#limit_req zone=one burst=15;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_pass http://localhost:3000;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:3000 https://beta.libraryofcode.org;
|
||||
|
||||
}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name beta.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
#include /etc/nginx/error/502;
|
||||
#include /etc/nginx/error/504;
|
||||
#include /etc/nginx/error/500;
|
||||
#include /etc/nginx/error/404;
|
||||
#include /etc/nginx/error/429;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
#limit_req zone=one burst=15;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_pass http://localhost:3000;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:3000 https://beta.libraryofcode.org;
|
||||
|
||||
}
|
||||
}
|
||||
|
|
@ -1,44 +1,44 @@
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name commshop.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
#include /etc/nginx/error/502;
|
||||
#include /etc/nginx/error/504;
|
||||
#include /etc/nginx/error/500;
|
||||
#include /etc/nginx/error/404;
|
||||
#include /etc/nginx/error/429;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
#limit_req zone=one burst=15;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_set_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
proxy_pass http://localhost:7890;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:7890 https://commshop.libraryofcode.org;
|
||||
|
||||
}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name commshop.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
#include /etc/nginx/error/502;
|
||||
#include /etc/nginx/error/504;
|
||||
#include /etc/nginx/error/500;
|
||||
#include /etc/nginx/error/404;
|
||||
#include /etc/nginx/error/429;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
#limit_req zone=one burst=15;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_set_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
proxy_pass http://localhost:7890;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:7890 https://commshop.libraryofcode.org;
|
||||
|
||||
}
|
||||
}
|
||||
|
|
@ -1,158 +1,158 @@
|
|||
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
|
||||
# server_name libraryofcode.org;
|
||||
# ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
|
||||
#ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
#ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
|
||||
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
|
||||
#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
|
||||
|
||||
#ssl_prefer_server_ciphers on;
|
||||
#ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
# ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
|
||||
#ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||||
# ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
# ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
# ssl_ecdh_curve secp384r1;
|
||||
# location / {
|
||||
|
||||
#proxy_set_header Host $host;
|
||||
|
||||
#proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
#proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
#proxy_pass http://localhost:4567;
|
||||
|
||||
#proxy_read_timeout 90;
|
||||
|
||||
#proxy_redirect https://www.libraryofcode.us/ https://libraryofcode.org;
|
||||
|
||||
# }
|
||||
#}
|
||||
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
|
||||
# server_name www.libraryofcode.org;
|
||||
# ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
|
||||
#ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
#ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
|
||||
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
|
||||
#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
|
||||
|
||||
#ssl_prefer_server_ciphers on;
|
||||
#ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
# ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
|
||||
#ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||||
# ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
# ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
# ssl_ecdh_curve secp384r1;
|
||||
# location / {
|
||||
|
||||
#proxy_set_header Host $host;
|
||||
|
||||
#proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
#proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
#proxy_pass http://localhost:4567;
|
||||
|
||||
#proxy_read_timeout 90;
|
||||
|
||||
#proxy_redirect http://localhost:4567 https://www.libraryofcode.org;
|
||||
|
||||
# }
|
||||
#}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name ecm.libraryofcode.us;
|
||||
ssl_certificate /etc/nginx/ssl/globalsign.chain.crt;
|
||||
|
||||
ssl_certificate_key /etc/nginx/ssl/globalsign.key.pem;
|
||||
|
||||
#ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
|
||||
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
|
||||
#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
|
||||
|
||||
#ssl_prefer_server_ciphers on;
|
||||
ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
|
||||
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||||
ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
ssl_ecdh_curve secp384r1;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
proxy_pass https://localhost:7150;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect https://localhost:7150 https://ecm.libraryofcode.us;
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
|
||||
# server_name directory.libraryofcode.us;
|
||||
# ssl_certificate /etc/nginx/ssl/globalsign.chain.crt;
|
||||
|
||||
#ssl_certificate_key /etc/nginx/ssl/globalsign.key.pem;
|
||||
#ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
#ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
|
||||
#ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||||
#ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
#ssl_ecdh_curve secp384r1;
|
||||
|
||||
#location /lam {
|
||||
# index index.html;
|
||||
# alias /usr/share/ldap-account-manager;
|
||||
# autoindex off;
|
||||
#
|
||||
# location ~ \.php$ {
|
||||
# fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
# fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
|
||||
# fastcgi_index index.php;
|
||||
# include fastcgi_params;
|
||||
# }
|
||||
#
|
||||
# location ~ /lam/(tmp/internal|sess|config|lib|help|locale) {
|
||||
# deny all;
|
||||
# return 403;
|
||||
# }
|
||||
#
|
||||
#}
|
||||
#}
|
||||
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
|
||||
# server_name libraryofcode.org;
|
||||
# ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
|
||||
#ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
#ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
|
||||
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
|
||||
#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
|
||||
|
||||
#ssl_prefer_server_ciphers on;
|
||||
#ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
# ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
|
||||
#ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||||
# ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
# ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
# ssl_ecdh_curve secp384r1;
|
||||
# location / {
|
||||
|
||||
#proxy_set_header Host $host;
|
||||
|
||||
#proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
#proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
#proxy_pass http://localhost:4567;
|
||||
|
||||
#proxy_read_timeout 90;
|
||||
|
||||
#proxy_redirect https://www.libraryofcode.us/ https://libraryofcode.org;
|
||||
|
||||
# }
|
||||
#}
|
||||
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
|
||||
# server_name www.libraryofcode.org;
|
||||
# ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
|
||||
#ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
#ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
|
||||
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
|
||||
#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
|
||||
|
||||
#ssl_prefer_server_ciphers on;
|
||||
#ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
# ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
|
||||
#ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||||
# ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
# ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
# ssl_ecdh_curve secp384r1;
|
||||
# location / {
|
||||
|
||||
#proxy_set_header Host $host;
|
||||
|
||||
#proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
#proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
#proxy_pass http://localhost:4567;
|
||||
|
||||
#proxy_read_timeout 90;
|
||||
|
||||
#proxy_redirect http://localhost:4567 https://www.libraryofcode.org;
|
||||
|
||||
# }
|
||||
#}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name ecm.libraryofcode.us;
|
||||
ssl_certificate /etc/nginx/ssl/globalsign.chain.crt;
|
||||
|
||||
ssl_certificate_key /etc/nginx/ssl/globalsign.key.pem;
|
||||
|
||||
#ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
|
||||
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
|
||||
#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
|
||||
|
||||
#ssl_prefer_server_ciphers on;
|
||||
ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
|
||||
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||||
ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
ssl_ecdh_curve secp384r1;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
proxy_pass https://localhost:7150;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect https://localhost:7150 https://ecm.libraryofcode.us;
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
|
||||
# server_name directory.libraryofcode.us;
|
||||
# ssl_certificate /etc/nginx/ssl/globalsign.chain.crt;
|
||||
|
||||
#ssl_certificate_key /etc/nginx/ssl/globalsign.key.pem;
|
||||
#ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
#ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
|
||||
#ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||||
#ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
#ssl_ecdh_curve secp384r1;
|
||||
|
||||
#location /lam {
|
||||
# index index.html;
|
||||
# alias /usr/share/ldap-account-manager;
|
||||
# autoindex off;
|
||||
#
|
||||
# location ~ \.php$ {
|
||||
# fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
# fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
|
||||
# fastcgi_index index.php;
|
||||
# include fastcgi_params;
|
||||
# }
|
||||
#
|
||||
# location ~ /lam/(tmp/internal|sess|config|lib|help|locale) {
|
||||
# deny all;
|
||||
# return 403;
|
||||
# }
|
||||
#
|
||||
#}
|
||||
#}
|
||||
|
|
|
|||
|
|
@ -1,114 +1,114 @@
|
|||
upstream php-handler {
|
||||
#server 127.0.0.1:9000;
|
||||
server unix:/var/run/php/php7.2-fpm.sock;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name drive.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
fastcgi_read_timeout 300;
|
||||
proxy_read_timeout 300;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "none" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Remove X-Powered-By, which is an information leak
|
||||
fastcgi_hide_header X-Powered-By;
|
||||
|
||||
# Path to the root of your installation
|
||||
root /var/www/nextcloud;
|
||||
|
||||
index index.php index.html /index.php$request_uri;
|
||||
|
||||
# Default Cache-Control policy
|
||||
expires 1m;
|
||||
|
||||
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
|
||||
location = / {
|
||||
if ( $http_user_agent ~ ^DavClnt ) {
|
||||
return 302 /remote.php/webdav/$is_args$args;
|
||||
}
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# Make a regex exception for `/.well-known` so that clients can still
|
||||
# access it despite the existence of the regex rule
|
||||
# `location ~ /(\.|autotest|...)` which would otherwise handle requests
|
||||
# for `/.well-known`.
|
||||
location ^~ /.well-known {
|
||||
# The following 6 rules are borrowed from `.htaccess`
|
||||
|
||||
rewrite ^/\.well-known/host-meta\.json /public.php?service=host-meta-json last;
|
||||
rewrite ^/\.well-known/host-meta /public.php?service=host-meta last;
|
||||
rewrite ^/\.well-known/webfinger /public.php?service=webfinger last;
|
||||
rewrite ^/\.well-known/nodeinfo /public.php?service=nodeinfo last;
|
||||
|
||||
location = /.well-known/carddav { return 301 /remote.php/dav/; }
|
||||
location = /.well-known/caldav { return 301 /remote.php/dav/; }
|
||||
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
# Rules borrowed from `.htaccess` to hide certain paths from clients
|
||||
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
|
||||
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
|
||||
|
||||
# Ensure this block, which passes PHP files to the PHP process, is above the blocks
|
||||
# which handle static assets (as seen below). If this block is not declared first,
|
||||
# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
|
||||
# to the URI, resulting in a HTTP 500 error response.
|
||||
location ~ \.php(?:$|/) {
|
||||
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||||
set $path_info $fastcgi_path_info;
|
||||
|
||||
try_files $fastcgi_script_name =404;
|
||||
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $path_info;
|
||||
fastcgi_param HTTPS on;
|
||||
|
||||
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
|
||||
fastcgi_param front_controller_active true; # Enable pretty urls
|
||||
fastcgi_pass php-handler;
|
||||
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_request_buffering off;
|
||||
}
|
||||
|
||||
location ~ \.(?:css|js|svg|gif)$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 6M; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
location ~ \.woff2?$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 7d; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php$request_uri;
|
||||
}
|
||||
upstream php-handler {
|
||||
#server 127.0.0.1:9000;
|
||||
server unix:/var/run/php/php7.2-fpm.sock;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name drive.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
fastcgi_read_timeout 300;
|
||||
proxy_read_timeout 300;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "none" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Remove X-Powered-By, which is an information leak
|
||||
fastcgi_hide_header X-Powered-By;
|
||||
|
||||
# Path to the root of your installation
|
||||
root /var/www/nextcloud;
|
||||
|
||||
index index.php index.html /index.php$request_uri;
|
||||
|
||||
# Default Cache-Control policy
|
||||
expires 1m;
|
||||
|
||||
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
|
||||
location = / {
|
||||
if ( $http_user_agent ~ ^DavClnt ) {
|
||||
return 302 /remote.php/webdav/$is_args$args;
|
||||
}
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# Make a regex exception for `/.well-known` so that clients can still
|
||||
# access it despite the existence of the regex rule
|
||||
# `location ~ /(\.|autotest|...)` which would otherwise handle requests
|
||||
# for `/.well-known`.
|
||||
location ^~ /.well-known {
|
||||
# The following 6 rules are borrowed from `.htaccess`
|
||||
|
||||
rewrite ^/\.well-known/host-meta\.json /public.php?service=host-meta-json last;
|
||||
rewrite ^/\.well-known/host-meta /public.php?service=host-meta last;
|
||||
rewrite ^/\.well-known/webfinger /public.php?service=webfinger last;
|
||||
rewrite ^/\.well-known/nodeinfo /public.php?service=nodeinfo last;
|
||||
|
||||
location = /.well-known/carddav { return 301 /remote.php/dav/; }
|
||||
location = /.well-known/caldav { return 301 /remote.php/dav/; }
|
||||
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
# Rules borrowed from `.htaccess` to hide certain paths from clients
|
||||
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
|
||||
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
|
||||
|
||||
# Ensure this block, which passes PHP files to the PHP process, is above the blocks
|
||||
# which handle static assets (as seen below). If this block is not declared first,
|
||||
# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
|
||||
# to the URI, resulting in a HTTP 500 error response.
|
||||
location ~ \.php(?:$|/) {
|
||||
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||||
set $path_info $fastcgi_path_info;
|
||||
|
||||
try_files $fastcgi_script_name =404;
|
||||
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $path_info;
|
||||
fastcgi_param HTTPS on;
|
||||
|
||||
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
|
||||
fastcgi_param front_controller_active true; # Enable pretty urls
|
||||
fastcgi_pass php-handler;
|
||||
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_request_buffering off;
|
||||
}
|
||||
|
||||
location ~ \.(?:css|js|svg|gif)$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 6M; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
location ~ \.woff2?$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 7d; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php$request_uri;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,140 +1,140 @@
|
|||
upstream php-handler {
|
||||
#server 127.0.0.1:9000;
|
||||
server unix:/var/run/php/php7.2-fpm.sock;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name drive.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
fastcgi_read_timeout 300;
|
||||
proxy_read_timeout 300;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "none" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Remove X-Powered-By, which is an information leak
|
||||
fastcgi_hide_header X-Powered-By;
|
||||
|
||||
# Path to the root of your installation
|
||||
root /var/www/nextcloud;
|
||||
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# The following 2 rules are only needed for the user_webfinger app.
|
||||
# Uncomment it if you're planning to use this app.
|
||||
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
|
||||
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
|
||||
|
||||
# The following rule is only needed for the Social app.
|
||||
# Uncomment it if you're planning to use this app.
|
||||
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
|
||||
|
||||
location = /.well-known/carddav {
|
||||
return 301 $scheme://$host:$server_port/remote.php/dav;
|
||||
}
|
||||
location = /.well-known/caldav {
|
||||
return 301 $scheme://$host:$server_port/remote.php/dav;
|
||||
}
|
||||
|
||||
# set max upload size
|
||||
client_max_body_size 512M;
|
||||
fastcgi_buffers 64 4K;
|
||||
|
||||
# Enable gzip but do not remove ETag headers
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_comp_level 4;
|
||||
gzip_min_length 256;
|
||||
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
|
||||
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
|
||||
|
||||
# Uncomment if your server is build with the ngx_pagespeed module
|
||||
# This module is currently not supported.
|
||||
#pagespeed off;
|
||||
|
||||
location / {
|
||||
rewrite ^ /index.php;
|
||||
}
|
||||
|
||||
location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
|
||||
deny all;
|
||||
}
|
||||
location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
|
||||
fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
|
||||
set $path_info $fastcgi_path_info;
|
||||
try_files $fastcgi_script_name =404;
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $path_info;
|
||||
fastcgi_param HTTPS on;
|
||||
# Avoid sending the security headers twice
|
||||
fastcgi_param modHeadersAvailable true;
|
||||
# Enable pretty urls
|
||||
fastcgi_param front_controller_active true;
|
||||
fastcgi_pass php-handler;
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_request_buffering off;
|
||||
}
|
||||
|
||||
location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
|
||||
try_files $uri/ =404;
|
||||
index index.php;
|
||||
}
|
||||
|
||||
# Adding the cache control header for js, css and map files
|
||||
# Make sure it is BELOW the PHP block
|
||||
location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
add_header Cache-Control "public, max-age=15778463";
|
||||
# Add headers to serve security related headers (It is intended to
|
||||
# have those duplicated to the ones above)
|
||||
# Before enabling Strict-Transport-Security headers please read into
|
||||
# this topic first.
|
||||
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
|
||||
#
|
||||
# WARNING: Only add the preload option once you read about
|
||||
# the consequences in https://hstspreload.org/. This option
|
||||
# will add the domain to a hardcoded list that is shipped
|
||||
# in all major browsers and getting removed from this list
|
||||
# could take several months.
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "none" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Optional: Don't log access to assets
|
||||
access_log off;
|
||||
}
|
||||
|
||||
location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
# Optional: Don't log access to other assets
|
||||
access_log off;
|
||||
}
|
||||
upstream php-handler {
|
||||
#server 127.0.0.1:9000;
|
||||
server unix:/var/run/php/php7.2-fpm.sock;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name drive.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
fastcgi_read_timeout 300;
|
||||
proxy_read_timeout 300;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "none" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Remove X-Powered-By, which is an information leak
|
||||
fastcgi_hide_header X-Powered-By;
|
||||
|
||||
# Path to the root of your installation
|
||||
root /var/www/nextcloud;
|
||||
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# The following 2 rules are only needed for the user_webfinger app.
|
||||
# Uncomment it if you're planning to use this app.
|
||||
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
|
||||
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
|
||||
|
||||
# The following rule is only needed for the Social app.
|
||||
# Uncomment it if you're planning to use this app.
|
||||
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
|
||||
|
||||
location = /.well-known/carddav {
|
||||
return 301 $scheme://$host:$server_port/remote.php/dav;
|
||||
}
|
||||
location = /.well-known/caldav {
|
||||
return 301 $scheme://$host:$server_port/remote.php/dav;
|
||||
}
|
||||
|
||||
# set max upload size
|
||||
client_max_body_size 512M;
|
||||
fastcgi_buffers 64 4K;
|
||||
|
||||
# Enable gzip but do not remove ETag headers
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_comp_level 4;
|
||||
gzip_min_length 256;
|
||||
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
|
||||
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
|
||||
|
||||
# Uncomment if your server is build with the ngx_pagespeed module
|
||||
# This module is currently not supported.
|
||||
#pagespeed off;
|
||||
|
||||
location / {
|
||||
rewrite ^ /index.php;
|
||||
}
|
||||
|
||||
location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
|
||||
deny all;
|
||||
}
|
||||
location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
|
||||
fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
|
||||
set $path_info $fastcgi_path_info;
|
||||
try_files $fastcgi_script_name =404;
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $path_info;
|
||||
fastcgi_param HTTPS on;
|
||||
# Avoid sending the security headers twice
|
||||
fastcgi_param modHeadersAvailable true;
|
||||
# Enable pretty urls
|
||||
fastcgi_param front_controller_active true;
|
||||
fastcgi_pass php-handler;
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_request_buffering off;
|
||||
}
|
||||
|
||||
location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
|
||||
try_files $uri/ =404;
|
||||
index index.php;
|
||||
}
|
||||
|
||||
# Adding the cache control header for js, css and map files
|
||||
# Make sure it is BELOW the PHP block
|
||||
location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
add_header Cache-Control "public, max-age=15778463";
|
||||
# Add headers to serve security related headers (It is intended to
|
||||
# have those duplicated to the ones above)
|
||||
# Before enabling Strict-Transport-Security headers please read into
|
||||
# this topic first.
|
||||
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
|
||||
#
|
||||
# WARNING: Only add the preload option once you read about
|
||||
# the consequences in https://hstspreload.org/. This option
|
||||
# will add the domain to a hardcoded list that is shipped
|
||||
# in all major browsers and getting removed from this list
|
||||
# could take several months.
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "none" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Optional: Don't log access to assets
|
||||
access_log off;
|
||||
}
|
||||
|
||||
location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
# Optional: Don't log access to other assets
|
||||
access_log off;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,44 +1,44 @@
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name hrm.libraryofcode.org;
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
# ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
ssl_ecdh_curve secp384r1;
|
||||
#root /var/www/orangehrm;
|
||||
#index index.php index.html index.htm;
|
||||
#client_max_body_size 100M;
|
||||
#proxy_connect_timeout 1800s;
|
||||
#proxy_send_timeout 1800s;
|
||||
#proxy_read_timeout 1800s;
|
||||
#fastcgi_send_timeout 1800s;
|
||||
#fastcgi_read_timeout 1800s;
|
||||
location / {
|
||||
#try_files $uri $uri/ /index.php?$uri&$args;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_pass http://localhost:6969;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:6969 https://hrm.libraryofcode.org;
|
||||
}
|
||||
|
||||
#location ~ \.php$ {
|
||||
# include snippets/fastcgi-php.conf;
|
||||
# fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
|
||||
# fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
# include fastcgi_params;
|
||||
#}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name hrm.libraryofcode.org;
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
# ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
ssl_ecdh_curve secp384r1;
|
||||
#root /var/www/orangehrm;
|
||||
#index index.php index.html index.htm;
|
||||
#client_max_body_size 100M;
|
||||
#proxy_connect_timeout 1800s;
|
||||
#proxy_send_timeout 1800s;
|
||||
#proxy_read_timeout 1800s;
|
||||
#fastcgi_send_timeout 1800s;
|
||||
#fastcgi_read_timeout 1800s;
|
||||
location / {
|
||||
#try_files $uri $uri/ /index.php?$uri&$args;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_pass http://localhost:6969;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:6969 https://hrm.libraryofcode.org;
|
||||
}
|
||||
|
||||
#location ~ \.php$ {
|
||||
# include snippets/fastcgi-php.conf;
|
||||
# fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
|
||||
# fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
# include fastcgi_params;
|
||||
#}
|
||||
}
|
||||
|
|
@ -1,44 +1,44 @@
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name inbox.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
#include /etc/nginx/error/502;
|
||||
#include /etc/nginx/error/504;
|
||||
#include /etc/nginx/error/500;
|
||||
#include /etc/nginx/error/404;
|
||||
#include /etc/nginx/error/429;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
#limit_req zone=one burst=15;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_set_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
proxy_pass http://localhost:4061;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:4061 https://inbox.libraryofcode.org;
|
||||
|
||||
}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name inbox.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
#include /etc/nginx/error/502;
|
||||
#include /etc/nginx/error/504;
|
||||
#include /etc/nginx/error/500;
|
||||
#include /etc/nginx/error/404;
|
||||
#include /etc/nginx/error/429;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
#limit_req zone=one burst=15;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_set_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
proxy_pass http://localhost:4061;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:4061 https://inbox.libraryofcode.org;
|
||||
|
||||
}
|
||||
}
|
||||
|
|
@ -1,114 +1,114 @@
|
|||
upstream php-handler {
|
||||
#server 127.0.0.1:9000;
|
||||
server unix:/var/run/php/php7.2-fpm.sock;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name drive.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
fastcgi_read_timeout 300;
|
||||
proxy_read_timeout 300;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "none" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Remove X-Powered-By, which is an information leak
|
||||
fastcgi_hide_header X-Powered-By;
|
||||
|
||||
# Path to the root of your installation
|
||||
root /var/www/nextcloud;
|
||||
|
||||
index index.php index.html /index.php$request_uri;
|
||||
|
||||
# Default Cache-Control policy
|
||||
expires 1m;
|
||||
|
||||
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
|
||||
location = / {
|
||||
if ( $http_user_agent ~ ^DavClnt ) {
|
||||
return 302 /remote.php/webdav/$is_args$args;
|
||||
}
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# Make a regex exception for `/.well-known` so that clients can still
|
||||
# access it despite the existence of the regex rule
|
||||
# `location ~ /(\.|autotest|...)` which would otherwise handle requests
|
||||
# for `/.well-known`.
|
||||
location ^~ /.well-known {
|
||||
# The following 6 rules are borrowed from `.htaccess`
|
||||
|
||||
rewrite ^/\.well-known/host-meta\.json /public.php?service=host-meta-json last;
|
||||
rewrite ^/\.well-known/host-meta /public.php?service=host-meta last;
|
||||
rewrite ^/\.well-known/webfinger /public.php?service=webfinger last;
|
||||
rewrite ^/\.well-known/nodeinfo /public.php?service=nodeinfo last;
|
||||
|
||||
location = /.well-known/carddav { return 301 /remote.php/dav/; }
|
||||
location = /.well-known/caldav { return 301 /remote.php/dav/; }
|
||||
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
# Rules borrowed from `.htaccess` to hide certain paths from clients
|
||||
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
|
||||
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
|
||||
|
||||
# Ensure this block, which passes PHP files to the PHP process, is above the blocks
|
||||
# which handle static assets (as seen below). If this block is not declared first,
|
||||
# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
|
||||
# to the URI, resulting in a HTTP 500 error response.
|
||||
location ~ \.php(?:$|/) {
|
||||
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||||
set $path_info $fastcgi_path_info;
|
||||
|
||||
try_files $fastcgi_script_name =404;
|
||||
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $path_info;
|
||||
fastcgi_param HTTPS on;
|
||||
|
||||
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
|
||||
fastcgi_param front_controller_active true; # Enable pretty urls
|
||||
fastcgi_pass php-handler;
|
||||
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_request_buffering off;
|
||||
}
|
||||
|
||||
location ~ \.(?:css|js|svg|gif)$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 6M; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
location ~ \.woff2?$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 7d; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php$request_uri;
|
||||
}
|
||||
upstream php-handler {
|
||||
#server 127.0.0.1:9000;
|
||||
server unix:/var/run/php/php7.2-fpm.sock;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name drive.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
fastcgi_read_timeout 300;
|
||||
proxy_read_timeout 300;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "none" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Remove X-Powered-By, which is an information leak
|
||||
fastcgi_hide_header X-Powered-By;
|
||||
|
||||
# Path to the root of your installation
|
||||
root /var/www/nextcloud;
|
||||
|
||||
index index.php index.html /index.php$request_uri;
|
||||
|
||||
# Default Cache-Control policy
|
||||
expires 1m;
|
||||
|
||||
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
|
||||
location = / {
|
||||
if ( $http_user_agent ~ ^DavClnt ) {
|
||||
return 302 /remote.php/webdav/$is_args$args;
|
||||
}
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# Make a regex exception for `/.well-known` so that clients can still
|
||||
# access it despite the existence of the regex rule
|
||||
# `location ~ /(\.|autotest|...)` which would otherwise handle requests
|
||||
# for `/.well-known`.
|
||||
location ^~ /.well-known {
|
||||
# The following 6 rules are borrowed from `.htaccess`
|
||||
|
||||
rewrite ^/\.well-known/host-meta\.json /public.php?service=host-meta-json last;
|
||||
rewrite ^/\.well-known/host-meta /public.php?service=host-meta last;
|
||||
rewrite ^/\.well-known/webfinger /public.php?service=webfinger last;
|
||||
rewrite ^/\.well-known/nodeinfo /public.php?service=nodeinfo last;
|
||||
|
||||
location = /.well-known/carddav { return 301 /remote.php/dav/; }
|
||||
location = /.well-known/caldav { return 301 /remote.php/dav/; }
|
||||
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
# Rules borrowed from `.htaccess` to hide certain paths from clients
|
||||
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
|
||||
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
|
||||
|
||||
# Ensure this block, which passes PHP files to the PHP process, is above the blocks
|
||||
# which handle static assets (as seen below). If this block is not declared first,
|
||||
# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
|
||||
# to the URI, resulting in a HTTP 500 error response.
|
||||
location ~ \.php(?:$|/) {
|
||||
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||||
set $path_info $fastcgi_path_info;
|
||||
|
||||
try_files $fastcgi_script_name =404;
|
||||
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $path_info;
|
||||
fastcgi_param HTTPS on;
|
||||
|
||||
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
|
||||
fastcgi_param front_controller_active true; # Enable pretty urls
|
||||
fastcgi_pass php-handler;
|
||||
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_request_buffering off;
|
||||
}
|
||||
|
||||
location ~ \.(?:css|js|svg|gif)$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 6M; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
location ~ \.woff2?$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 7d; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php$request_uri;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,29 +1,29 @@
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name payments.libraryofcode.org;
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
ssl_protocols TLSv1.1 TLSv1.2;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
ssl_ecdh_curve secp384r1;
|
||||
|
||||
root /var/www/opencart;
|
||||
|
||||
index index.php index.html index.htm;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
location ~ [^/]\.php(/|$) {
|
||||
include snippets/fastcgi-php.conf;
|
||||
fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name payments.libraryofcode.org;
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
ssl_protocols TLSv1.1 TLSv1.2;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
ssl_ecdh_curve secp384r1;
|
||||
|
||||
root /var/www/opencart;
|
||||
|
||||
index index.php index.html index.htm;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
location ~ [^/]\.php(/|$) {
|
||||
include snippets/fastcgi-php.conf;
|
||||
fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,44 +1,44 @@
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name search.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
#include /etc/nginx/error/502;
|
||||
#include /etc/nginx/error/504;
|
||||
#include /etc/nginx/error/500;
|
||||
#include /etc/nginx/error/404;
|
||||
#include /etc/nginx/error/429;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
#limit_req zone=one burst=15;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_set_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
proxy_pass http://localhost:8090;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:8090 https://search.libraryofcode.org;
|
||||
|
||||
}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name search.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
ssl_session_cache builtin:1000 shared:SSL:10m;
|
||||
#include /etc/nginx/error/502;
|
||||
#include /etc/nginx/error/504;
|
||||
#include /etc/nginx/error/500;
|
||||
#include /etc/nginx/error/404;
|
||||
#include /etc/nginx/error/429;
|
||||
ssl_protocols TLSv1.2;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
#limit_req zone=one burst=15;
|
||||
location / {
|
||||
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_set_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
proxy_pass http://localhost:8090;
|
||||
|
||||
proxy_read_timeout 90;
|
||||
|
||||
proxy_redirect http://localhost:8090 https://search.libraryofcode.org;
|
||||
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name certapi.libraryofcode.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/org.chain.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/org.key.pem;
|
||||
|
||||
location / {
|
||||
|
||||
proxy_pass https://libraryofcode-cd-pbipdifect6vowsp.edge.tenants.us.auth0.com/;
|
||||
proxy_set_header cname-api-key "ca65ccfade6e79f0ea1339259a32882a90fdb11eef10c8df6323133cb607a483";
|
||||
|
||||
proxy_pass_header Set-Cookie;
|
||||
proxy_pass_header User-Agent;
|
||||
proxy_pass_header Origin;
|
||||
proxy_pass_header Referer;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,107 +1,107 @@
|
|||
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
|
||||
|
||||
# Server Information
|
||||
smtpd_banner = $myhostname Library of Code sp-us Staff Services | ESMTP (Debian/GNU)
|
||||
myhostname = staff.libraryofcode.org
|
||||
myorigin = /etc/mailname
|
||||
mydestination = $myhostname, libraryofcode.org
|
||||
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 63.141.252.130
|
||||
mail_name = Library of Code sp-us | Staff Services
|
||||
|
||||
|
||||
# Relay Settings
|
||||
relayhost =
|
||||
relay_domains = lists.libraryofcode.org
|
||||
|
||||
|
||||
# MDA & Delivery
|
||||
append_dot_mydomain = no
|
||||
biff = no
|
||||
mailbox_transport = lmtp:unix:private/dovecot-lmtp
|
||||
message_size_limit = 1073741824
|
||||
transport_maps = hash:/etc/postfix/transport
|
||||
mailbox_size_limit = 0
|
||||
recipient_delimiter = +
|
||||
|
||||
|
||||
# Authentication
|
||||
smtpd_sasl_auth_enable = yes
|
||||
broken_sasl_auth_clients = yes
|
||||
|
||||
|
||||
# TLS parameters
|
||||
smtpd_tls_cert_file=/etc/postfix/ssl/globalsign.crt
|
||||
smtpd_tls_key_file=/etc/postfix/ssl/globalsign.key.pem
|
||||
smtpd_use_tls=yes
|
||||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
||||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
||||
smtp_tls_security_level = may
|
||||
smtpd_tls_security_level = may
|
||||
smtp_tls_note_starttls_offer = yes
|
||||
smtpd_tls_CAfile = /etc/postfix/ssl/globalsign.ca.crt
|
||||
smtpd_tls_loglevel = 1
|
||||
smtpd_tls_received_header = yes
|
||||
smtpd_tls_session_cache_timeout = 3600s
|
||||
tls_random_source = dev:/dev/urandom
|
||||
|
||||
|
||||
# RESTRICTIONS
|
||||
smtpd_relay_restrictions =
|
||||
permit_mynetworks,
|
||||
permit_sasl_authenticated,
|
||||
defer_unauth_destination,
|
||||
smtpd_helo_restrictions =
|
||||
permit_mynetworks,
|
||||
reject_non_fqdn_helo_hostname,
|
||||
reject_invalid_helo_hostname,
|
||||
reject_unknown_helo_hostname,
|
||||
permit,
|
||||
smtpd_sender_restrictions =
|
||||
reject_unknown_sender_domain,
|
||||
reject_unknown_reverse_client_hostname,
|
||||
reject_unknown_client_hostname,
|
||||
reject_sender_login_mismatch,
|
||||
permit_mynetworks,
|
||||
permit_sasl_authenticated,
|
||||
permit,
|
||||
smtpd_recipient_restrictions =
|
||||
reject_unauth_pipelining,
|
||||
reject_non_fqdn_recipient,
|
||||
reject_unknown_recipient_domain,
|
||||
permit_mynetworks,
|
||||
check_policy_service inet:127.0.0.1:10023,
|
||||
reject_rbl_client sbl.spamhaus.org,
|
||||
reject_rbl_client xbl.spamhaus.org,
|
||||
permit,
|
||||
|
||||
|
||||
# Local Aliases
|
||||
alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
|
||||
alias_database = hash:/etc/aliases
|
||||
|
||||
|
||||
# Virtual Alises
|
||||
smtpd_sender_login_maps = hash:/etc/postfix/virtual-mailbox-users
|
||||
virtual_alias_maps = hash:/etc/postfix/virtual
|
||||
|
||||
|
||||
# Network Settings & Milters
|
||||
inet_interfaces = all
|
||||
inet_protocols = all
|
||||
milter_default_action = accept
|
||||
milter_protocol = 6
|
||||
smtpd_milters =
|
||||
## OpenDKIM
|
||||
inet:localhost:8891,
|
||||
## OpenDMARC
|
||||
local:/opendmarc/opendmarc.sock,
|
||||
## ClamAV
|
||||
#inet:localhost:8892
|
||||
non_smtpd_milters = $smtpd_milters
|
||||
|
||||
|
||||
# Misc
|
||||
readme_directory = no
|
||||
compatibility_level = 2
|
||||
unknown_local_recipient_reject_code = 550
|
||||
mailman_destination_recipient_limit = 1
|
||||
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
|
||||
|
||||
# Server Information
|
||||
smtpd_banner = $myhostname Library of Code sp-us Staff Services | ESMTP (Debian/GNU)
|
||||
myhostname = staff.libraryofcode.org
|
||||
myorigin = /etc/mailname
|
||||
mydestination = $myhostname, libraryofcode.org
|
||||
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 63.141.252.130
|
||||
mail_name = Library of Code sp-us | Staff Services
|
||||
|
||||
|
||||
# Relay Settings
|
||||
relayhost =
|
||||
relay_domains = lists.libraryofcode.org
|
||||
|
||||
|
||||
# MDA & Delivery
|
||||
append_dot_mydomain = no
|
||||
biff = no
|
||||
mailbox_transport = lmtp:unix:private/dovecot-lmtp
|
||||
message_size_limit = 1073741824
|
||||
transport_maps = hash:/etc/postfix/transport
|
||||
mailbox_size_limit = 0
|
||||
recipient_delimiter = +
|
||||
|
||||
|
||||
# Authentication
|
||||
smtpd_sasl_auth_enable = yes
|
||||
broken_sasl_auth_clients = yes
|
||||
|
||||
|
||||
# TLS parameters
|
||||
smtpd_tls_cert_file=/etc/postfix/ssl/globalsign.crt
|
||||
smtpd_tls_key_file=/etc/postfix/ssl/globalsign.key.pem
|
||||
smtpd_use_tls=yes
|
||||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
||||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
||||
smtp_tls_security_level = may
|
||||
smtpd_tls_security_level = may
|
||||
smtp_tls_note_starttls_offer = yes
|
||||
smtpd_tls_CAfile = /etc/postfix/ssl/globalsign.ca.crt
|
||||
smtpd_tls_loglevel = 1
|
||||
smtpd_tls_received_header = yes
|
||||
smtpd_tls_session_cache_timeout = 3600s
|
||||
tls_random_source = dev:/dev/urandom
|
||||
|
||||
|
||||
# RESTRICTIONS
|
||||
smtpd_relay_restrictions =
|
||||
permit_mynetworks,
|
||||
permit_sasl_authenticated,
|
||||
defer_unauth_destination,
|
||||
smtpd_helo_restrictions =
|
||||
permit_mynetworks,
|
||||
reject_non_fqdn_helo_hostname,
|
||||
reject_invalid_helo_hostname,
|
||||
reject_unknown_helo_hostname,
|
||||
permit,
|
||||
smtpd_sender_restrictions =
|
||||
reject_unknown_sender_domain,
|
||||
reject_unknown_reverse_client_hostname,
|
||||
reject_unknown_client_hostname,
|
||||
reject_sender_login_mismatch,
|
||||
permit_mynetworks,
|
||||
permit_sasl_authenticated,
|
||||
permit,
|
||||
smtpd_recipient_restrictions =
|
||||
reject_unauth_pipelining,
|
||||
reject_non_fqdn_recipient,
|
||||
reject_unknown_recipient_domain,
|
||||
permit_mynetworks,
|
||||
check_policy_service inet:127.0.0.1:10023,
|
||||
reject_rbl_client sbl.spamhaus.org,
|
||||
reject_rbl_client xbl.spamhaus.org,
|
||||
permit,
|
||||
|
||||
|
||||
# Local Aliases
|
||||
alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
|
||||
alias_database = hash:/etc/aliases
|
||||
|
||||
|
||||
# Virtual Alises
|
||||
smtpd_sender_login_maps = hash:/etc/postfix/virtual-mailbox-users
|
||||
virtual_alias_maps = hash:/etc/postfix/virtual
|
||||
|
||||
|
||||
# Network Settings & Milters
|
||||
inet_interfaces = all
|
||||
inet_protocols = all
|
||||
milter_default_action = accept
|
||||
milter_protocol = 6
|
||||
smtpd_milters =
|
||||
## OpenDKIM
|
||||
inet:localhost:8891,
|
||||
## OpenDMARC
|
||||
local:/opendmarc/opendmarc.sock,
|
||||
## ClamAV
|
||||
#inet:localhost:8892
|
||||
non_smtpd_milters = $smtpd_milters
|
||||
|
||||
|
||||
# Misc
|
||||
readme_directory = no
|
||||
compatibility_level = 2
|
||||
unknown_local_recipient_reject_code = 550
|
||||
mailman_destination_recipient_limit = 1
|
||||
|
|
|
|||
|
|
@ -1,30 +1,30 @@
|
|||
#!/usr/bin/env python
|
||||
"""
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) 2021 Library of Code sp-us, Department of Engineering
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
blocks = os.listdir("Nginx/Server Blocks")
|
||||
old_blocks = os.listdir("/etc/nginx/sites-available")
|
||||
path = os.path.abspath("Nginx/Server Blocks")
|
||||
|
||||
for block in blocks:
|
||||
os.symlink("%s/%s" % (path, block), "/etc/nginx/sites-available/%s" % block)
|
||||
|
||||
for block in old_blocks:
|
||||
os.unlink("/etc/nginx/sites-available/%s" % block)
|
||||
#!/usr/bin/env python
|
||||
"""
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) 2021 Library of Code sp-us, Department of Engineering
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
blocks = os.listdir("Nginx/Server Blocks")
|
||||
old_blocks = os.listdir("/etc/nginx/sites-available")
|
||||
path = os.path.abspath("Nginx/Server Blocks")
|
||||
|
||||
for block in blocks:
|
||||
os.symlink("%s/%s" % (path, block), "/etc/nginx/sites-available/%s" % block)
|
||||
|
||||
for block in old_blocks:
|
||||
os.unlink("/etc/nginx/sites-available/%s" % block)
|
||||
|
|
|
|||
Loading…
Reference in New Issue