Ticket #1477: nginx.conf

File nginx.conf, 16.2 KB (added by Undone@…, 9 years ago)

Nginx configurations

Line 
1[root@ ~]# nginx -T
2nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
3nginx: configuration file /etc/nginx/nginx.conf test is successful
4# configuration file /etc/nginx/nginx.conf:
5user nginx; worker_processes auto;
6#error_log /var/log/nginx/error.log;
7error_log syslog:server=syslog.domain.org:12302 debug; pid /run/nginx.pid; include
8/usr/share/nginx/modules/*.conf; events {
9 worker_connections 1024;
10}
11http {
12 log_format main '$remote_addr - $remote_user [$time_local]
13"$request" '
14 '$status
15$body_bytes_sent "$http_referer" '
16 '"$http_user_agent"
17"$http_x_forwarded_for"';
18 log_format graylog2_format '$remote_addr - $remote_user
19[$time_local] "$request" $status $body_bytes_sent "$http_referer"
20"$http_user_agent" "$http_x_forwarded_for"
21<msec=$msec|connection=$connection|connection_requests=$connection_requests|millis=$request_time>';
22 access_log syslog:server=syslog.domain.org:12301 graylog2_format;
23
24 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
25 ssl_prefer_server_ciphers on;
26 ssl_ciphers
27"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";
28 #ssl_ecdh_curve secp384r1;
29 ssl_dhparam /etc/nginx/dhparam.pem;
30 ssl_session_cache shared:SSL:10m;
31 ssl_session_timeout 60m;
32 ssl_session_tickets off;
33 charset utf-8;
34 server_tokens off;
35 sendfile on;
36 tcp_nopush on;
37 tcp_nodelay on;
38 keepalive_timeout 15;
39 send_timeout 10;
40 client_body_timeout 12;
41 client_header_timeout 12;
42 types_hash_max_size 2048;
43
44 gzip on;
45 #gzip_static on;
46 gzip_comp_level 4;
47 gzip_min_length 1400;
48 gzip_vary on;
49 gzip_proxied expired no-cache no-store private auth;
50 gzip_types text/plain text/css application/json
51application/javascript application/x-javascript text/xml application/xml
52application/xml+rss text/javascript;
53 include /etc/nginx/mime.types;
54 default_type application/octet-stream;
55 include /etc/nginx/conf.d/*.conf;
56 server {
57 listen 80 default_server;
58 listen [::]:80 default_server;
59 server_name _;
60 root /usr/share/nginx/html;
61 log_not_found off;
62 include /etc/nginx/default.d/*.conf;
63 location / {
64 }
65 error_page 404 /404.html;
66 location = /40x.html {
67 }
68 error_page 500 502 503 504 /50x.html;
69 location = /50x.html {
70 }
71 }
72}
73
74# configuration file /etc/nginx/mime.types:
75
76types {
77 text/html html htm shtml;
78 text/css css;
79 text/xml xml;
80 image/gif gif;
81 image/jpeg jpeg jpg;
82 application/javascript js;
83 application/atom+xml atom;
84 application/rss+xml rss;
85
86 text/mathml mml;
87 text/plain txt;
88 text/vnd.sun.j2me.app-descriptor jad;
89 text/vnd.wap.wml wml;
90 text/x-component htc;
91
92 image/png png;
93 image/svg+xml svg svgz;
94 image/tiff tif tiff;
95 image/vnd.wap.wbmp wbmp;
96 image/webp webp;
97 image/x-icon ico;
98 image/x-jng jng;
99 image/x-ms-bmp bmp;
100
101 application/font-woff woff;
102 application/java-archive jar war ear;
103 application/json json;
104 application/mac-binhex40 hqx;
105 application/msword doc;
106 application/pdf pdf;
107 application/postscript ps eps ai;
108 application/rtf rtf;
109 application/vnd.apple.mpegurl m3u8;
110 application/vnd.google-earth.kml+xml kml;
111 application/vnd.google-earth.kmz kmz;
112 application/vnd.ms-excel xls;
113 application/vnd.ms-fontobject eot;
114 application/vnd.ms-powerpoint ppt;
115 application/vnd.oasis.opendocument.graphics odg;
116 application/vnd.oasis.opendocument.presentation odp;
117 application/vnd.oasis.opendocument.spreadsheet ods;
118 application/vnd.oasis.opendocument.text odt;
119 application/vnd.openxmlformats-officedocument.presentationml.presentation
120 pptx;
121 application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
122 xlsx;
123 application/vnd.openxmlformats-officedocument.wordprocessingml.document
124 docx;
125 application/vnd.wap.wmlc wmlc;
126 application/x-7z-compressed 7z;
127 application/x-cocoa cco;
128 application/x-java-archive-diff jardiff;
129 application/x-java-jnlp-file jnlp;
130 application/x-makeself run;
131 application/x-perl pl pm;
132 application/x-pilot prc pdb;
133 application/x-rar-compressed rar;
134 application/x-redhat-package-manager rpm;
135 application/x-sea sea;
136 application/x-shockwave-flash swf;
137 application/x-stuffit sit;
138 application/x-tcl tcl tk;
139 application/x-x509-ca-cert der pem crt;
140 application/x-xpinstall xpi;
141 application/xhtml+xml xhtml;
142 application/xspf+xml xspf;
143 application/zip zip;
144
145 application/octet-stream bin exe dll;
146 application/octet-stream deb;
147 application/octet-stream dmg;
148 application/octet-stream iso img;
149 application/octet-stream msi msp msm;
150
151 audio/midi mid midi kar;
152 audio/mpeg mp3;
153 audio/ogg ogg;
154 audio/x-m4a m4a;
155 audio/x-realaudio ra;
156
157 video/3gpp 3gpp 3gp;
158 video/mp2t ts;
159 video/mp4 mp4;
160 video/mpeg mpeg mpg;
161 video/quicktime mov;
162 video/webm webm;
163 video/x-flv flv;
164 video/x-m4v m4v;
165 video/x-mng mng;
166 video/x-ms-asf asx asf;
167 video/x-ms-wmv wmv;
168 video/x-msvideo avi;
169}
170
171# configuration file /etc/nginx/conf.d/default.conf:
172server {
173 listen 80;
174 server_name localhost;
175
176 #charset koi8-r;
177 #access_log /var/log/nginx/host.access.log main;
178
179 location / {
180 root /usr/share/nginx/html;
181 index index.html index.htm;
182 }
183
184 #error_page 404 /404.html;
185
186 # redirect server error pages to the static page /50x.html
187 #
188 error_page 500 502 503 504 /50x.html;
189 location = /50x.html {
190 root /usr/share/nginx/html;
191 }
192
193 # proxy the PHP scripts to Apache listening on 127.0.0.1:80
194 #
195 #location ~ \.php$ {
196 # proxy_pass http://127.0.0.1;
197 #}
198
199 # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
200 #
201 #location ~ \.php$ {
202 # root html;
203 # fastcgi_pass 127.0.0.1:9000;
204 # fastcgi_index index.php;
205 # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
206 # include fastcgi_params;
207 #}
208
209 # deny access to .htaccess files, if Apache's document root
210 # concurs with nginx's one
211 #
212 #location ~ /\.ht {
213 # deny all;
214 #}
215}
216
217
218# configuration file /etc/nginx/conf.d/cluster.conf:
219upstream cluster {
220 server localhost:8443;
221 server s2.domain.com:8443 backup;
222 server s3.domain.com:8443 backup;
223}
224
225server {
226 listen 443 ssl http2;
227 listen [::]:443 ssl http2;
228 server_name domain.com domain.net;
229 ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
230 ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;
231 index index.php;
232
233 add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
234
235 location /favicon.ico {
236 access_log off;
237 log_not_found off;
238 }
239
240 location / {
241 proxy_pass https://cluster;
242 proxy_redirect off;
243 proxy_pass_request_headers on;
244 proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
245 proxy_connect_timeout 2;
246 proxy_http_version 1.1;
247 proxy_set_header Connection "";
248 proxy_set_header Host $host;
249 proxy_set_header X-Real-IP $remote_addr;
250 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
251 }
252}
253
254upstream php-fpm {
255 server unix:/var/run/php-fpm.sock;
256}
257
258server {
259 listen 8443 ssl http2;
260listen [::]:8443 ssl http2;
261 server_name domain.com;
262 root /var/www/website;
263 ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
264 ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;
265 index index.php;
266
267 location /.git/ {
268 allow 192.168.1.0/24;
269 allow 192.168.2.0/24;
270 allow 192.168.3.0/24;
271 deny all;
272 }
273
274 location ~* /\.well-known/.*$ {
275 root /var/www/website;
276 }
277
278 location ~* /.*/img/.*\.(gif|png|jpg)$ {
279 access_log off;
280 rewrite ^/.*/img/(.*)$ /img/$1 break;
281 expires max;
282 add_header Pragma public;
283 add_header Cache-Control "public";
284 }
285
286 location ~* /.*/static/.*$ {
287 access_log off;
288 rewrite ^/.*/static/(.*)$ /static/$1 break;
289 expires max;
290 add_header Pragma public;
291 add_header Cache-Control "public";
292 }
293
294 location ~* /.*/.*\.php$ {
295 rewrite ^/(.*)/(.*\.php)$ /controller.php?account=$1&page=$2 break;
296
297 try_files $uri =404;
298 fastcgi_pass php-fpm;
299 fastcgi_index index.php;
300 fastcgi_intercept_errors on;
301 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
302 include fastcgi_params;
303 }
304
305 location ~* /.*/$ {
306 rewrite ^/(.*)/$ /controller.php?account=$1&page=index.php break;
307
308 try_files $uri =404;
309 fastcgi_pass php-fpm;
310 fastcgi_index index.php;
311 fastcgi_intercept_errors on;
312 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
313 include fastcgi_params;
314 }
315
316 location ~* /.*/.*$ {
317 rewrite ^/(.*)/(.*)/(.*)$ /tool/$2/$3 break;
318 rewrite ^/(.*)/(.*)$ /tool/$2 break;
319 }
320
321 location ~* .*\.php$ {
322 try_files $uri =404;
323 fastcgi_pass php-fpm;
324 fastcgi_index index.php;
325 fastcgi_intercept_errors on;
326 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
327 include fastcgi_params;
328 }
329
330 location ~* ^\/.*[^/]$ {
331 return 301 https://$host$request_uri/;
332 }
333
334 location / {
335 return 301 https://domain.net;
336 }
337}
338
339server {
340 listen 8443 ssl http2;
341listen [::]:8443 ssl http2;
342 server_name domain.net;
343 root /var/www/website;
344 ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
345 ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;
346 index index.php;
347
348 location /style.css {
349 rewrite /style.css /tool/style.css;
350 }
351
352 location ~* .*\.php$ {
353 try_files $uri =404;
354 fastcgi_pass php-fpm;
355 fastcgi_index index.php;
356 fastcgi_intercept_errors on;
357 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
358 include fastcgi_params;
359 }
360}
361
362server {
363 listen 80;
364 listen [::]:80;
365 listen 443 ssl http2;
366 listen [::]:443 ssl http2;
367 server_name www.domain.com;
368 ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
369 ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;
370
371 return 301 https://domain.com$request_uri;
372}
373
374server {
375 listen 80;
376 listen [::]:80;
377 listen 443 ssl http2;
378 listen [::]:443 ssl http2;
379 server_name www.domain.net;
380 ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
381 ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;
382
383 return 301 https://domain.net$request_uri;
384}
385
386server {
387 listen 80;
388 listen [::]:80;
389 server_name domain.com domain.net;
390
391 return 301 https://$host$request_uri;
392}
393
394# configuration file /etc/nginx/fastcgi_params:
395
396fastcgi_param QUERY_STRING $query_string;
397fastcgi_param REQUEST_METHOD $request_method;
398fastcgi_param CONTENT_TYPE $content_type;
399fastcgi_param CONTENT_LENGTH $content_length;
400
401fastcgi_param SCRIPT_NAME $fastcgi_script_name;
402fastcgi_param REQUEST_URI $request_uri;
403fastcgi_param DOCUMENT_URI $document_uri;
404fastcgi_param DOCUMENT_ROOT $document_root;
405fastcgi_param SERVER_PROTOCOL $server_protocol;
406fastcgi_param REQUEST_SCHEME $scheme;
407fastcgi_param HTTPS $https if_not_empty;
408
409fastcgi_param GATEWAY_INTERFACE CGI/1.1;
410fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
411
412fastcgi_param REMOTE_ADDR $remote_addr;
413fastcgi_param REMOTE_PORT $remote_port;
414fastcgi_param SERVER_ADDR $server_addr;
415fastcgi_param SERVER_PORT $server_port;
416fastcgi_param SERVER_NAME $server_name;
417
418# PHP only, required if PHP was built with --enable-force-cgi-redirect
419fastcgi_param REDIRECT_STATUS 200;
420