Skip to content

Commit 9e174dd

Browse files
khalwatkhalwat
committed
Merge branch 'release/1.0.34'
2 parents 5008e4c + 330ebdd commit 9e174dd

File tree

3 files changed

+239
-0
lines changed

3 files changed

+239
-0
lines changed

‎CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Nginx-Craft Changelog
22

3+
## 1.0.34 - 2021.04.18
4+
### Added
5+
* Added a [Forge Template](https://forge.laravel.com/docs/1.0/servers/nginx-templates.html) `NginxFastCGICacheTemplate.conf`
6+
* Opt out of Google Federated Learning of Cohorts ("FLoC") via the `Permissions-Policy` header. [ref:](https://amifloced.org/)
7+
38
## 1.0.33 - 2021.03.17
49
### Changed
510
* Updated the Forge template to use more Forge-provided variables

‎forge-templates/NginxFastCGICacheTemplate.conf

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
# FastCGI Cache
2+
fastcgi_cache_path /var/run/nginx-cache/{{ SITE }} levels=1:2 keys_zone={{ SITE }}:100m inactive=1d use_temp_path=off max_size=100m;
3+
4+
# FORGE CONFIG (DO NOT REMOVE!)
5+
include forge-conf/{{ SITE }}/before/*;
6+
7+
# Bots to ban via user agent
8+
map $http_user_agent $limit_bots {
9+
default 0;
10+
~*(AhrefsBot|Baiduspider|PaperLiBot) 1;
11+
}
12+
13+
server {
14+
# Listen for both IPv4 & IPv6 requests on port 443 with http2 enabled
15+
listen {{ PORT }};
16+
listen {{ PORT_V6 }};
17+
18+
# General virtual host settings
19+
server_name {{ DOMAINS }};
20+
server_tokens off;
21+
root {{ PATH }};
22+
index index.html index.htm index.php;
23+
charset utf-8;
24+
25+
# Enable serving of static gzip files as per: http://nginx.org/en/docs/http/ngx_http_gzip_static_module.html
26+
gzip_static on;
27+
28+
# Enable server-side includes as per: http://nginx.org/en/docs/http/ngx_http_ssi_module.html
29+
ssi on;
30+
31+
# Disable limits on the maximum allowed size of the client request body
32+
client_max_body_size 0;
33+
34+
# Ban certain bots from crawling the site
35+
if ($limit_bots = 1) {
36+
return 403;
37+
}
38+
39+
# 404 error handler
40+
error_page 404 /index.php?$query_string;
41+
42+
# 301 Redirect URLs with trailing /'s as per https://webmasters.googleblog.com/2010/04/to-slash-or-not-to-slash.html
43+
rewrite ^/(.*)/$ /$1 permanent;
44+
45+
# Change // -> / for all URLs, so it works for our php location block, too
46+
merge_slashes off;
47+
rewrite (.*)//+(.*) $1/$2 permanent;
48+
49+
# Handle Do Not Track as per https://www.eff.org/dnt-policy
50+
location /.well-known/dnt-policy.txt {
51+
try_files /dnt-policy.txt /index.php?p=/dnt-policy.txt;
52+
}
53+
54+
# For WordPress bots/users
55+
location ~ ^/(wp-login|wp-admin|wp-config|wp-content|wp-includes|xmlrpc) {
56+
return 301 https://wordpress.com/wp-login.php;
57+
}
58+
59+
#Cache everything by default
60+
fastcgi_cache_key "$scheme$request_method$host$request_uri";
61+
add_header X-Cache-Status $upstream_cache_status;
62+
set $no_cache 0;
63+
if ($request_method = POST)
64+
{
65+
set $no_cache 1;
66+
}
67+
if ($request_uri ~* "/(admin/|cpresources/)")
68+
{
69+
set $no_cache 1;
70+
}
71+
72+
# Access and error logging
73+
access_log off;
74+
error_log /var/log/nginx/{{ SITE }}-error.log error;
75+
# If you want error logging to go to SYSLOG (for services like Papertrailapp.com), uncomment the following:
76+
#error_log syslog:server=unix:/dev/log,facility=local7,tag=nginx,severity=error;
77+
78+
# FORGE SSL (DO NOT REMOVE!)
79+
ssl_certificate /etc/nginx/ssl/{{ SITE }}/XXXXXX/server.crt;
80+
ssl_certificate_key /etc/nginx/ssl/{{ SITE }}/XXXXXX/server.key;
81+
82+
# SSL/TLS configuration, with TLSv1.0 disabled because it is insecure; note that IE 8, 9 & 10 support
83+
# TLSv1.1, but it's not enabled by default clients using those browsers will not be able to connect
84+
ssl_protocols TLSv1.2 TLSv1.1;
85+
ssl_prefer_server_ciphers on;
86+
ssl_dhparam /etc/nginx/dhparams.pem;
87+
ssl_ciphers 'ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5';
88+
ssl_buffer_size 4k;
89+
ssl_session_timeout 4h;
90+
ssl_session_cache shared:SSL:40m;
91+
ssl_stapling on;
92+
ssl_stapling_verify on;
93+
ssl_trusted_certificate /etc/nginx/ssl/lets-encrypt-x3-cross-signed.pem;
94+
95+
# FORGE CONFIG (DO NOT REMOVE!)
96+
include forge-conf/{{ SITE }}/server/*;
97+
98+
# Load configuration files from nginx-partials
99+
# For this to work, you must clone the repo into /home/forge via:
100+
# git clone https://github.com/nystudio107/nginx-craft.git /home/forge
101+
include /home/forge/nginx-craft/nginx-partials/*.conf;
102+
103+
# Root directory location handler
104+
location / {
105+
try_files $uri/index.html $uri $uri/ /index.php?$query_string;
106+
}
107+
108+
# Localized sites, hat tip to Johannes -- https://gist.github.com/johanneslamers/f6d2bc0d7435dca130fc
109+
110+
# If you are creating a localized site as per: https://craftcms.com/docs/localization-guide
111+
# the directives here will help you handle the locale redirection so that requests will
112+
# be routed through the appropriate index.php wherein you set the `CRAFT_LOCALE`
113+
114+
# Enable this by un-commenting it, and changing the language codes as appropriate
115+
# Add a new location @XXrewrites and location /XX/ block for each language that
116+
# you need to support
117+
118+
#location @enrewrites {
119+
# rewrite ^/en/(.*)$ /en/index.php?$query_string? last;
120+
#}
121+
#
122+
#location /en/ {
123+
# try_files $uri $uri/ @enrewrites;
124+
#}
125+
126+
# Craft-specific location handlers to ensure AdminCP requests route through index.php
127+
# If you change your `cpTrigger`, change it here as well
128+
location ^~ /admin {
129+
try_files $uri $uri/ @phpfpm_nocache;
130+
}
131+
location ^~ /index.php/admin {
132+
try_files $uri $uri/ @phpfpm_nocache;
133+
}
134+
location ^~ /cpresources {
135+
try_files $uri $uri/ /index.php?$query_string;
136+
}
137+
location ^~ /actions {
138+
try_files $uri $uri/ /index.php?$query_string;
139+
}
140+
141+
# php-fpm configuration
142+
location ~ [^/]\.php(/|$) {
143+
try_files $uri $uri/ /index.php?$query_string;
144+
fastcgi_split_path_info ^(.+\.php)(/.+)$;
145+
# Change this to whatever version of php you are using
146+
fastcgi_pass {{ PROXY_PASS }};
147+
fastcgi_index index.php;
148+
include fastcgi_params;
149+
fastcgi_param PATH_INFO $fastcgi_path_info;
150+
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
151+
fastcgi_param DOCUMENT_ROOT $realpath_root;
152+
fastcgi_param HTTP_PROXY "";
153+
fastcgi_param HTTP_HOST {{ SITE }};
154+
155+
# Don't allow browser caching of dynamically generated content
156+
add_header Last-Modified $date_gmt;
157+
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
158+
if_modified_since off;
159+
expires off;
160+
etag off;
161+
# Load security.conf from nginx-partials again, because add_header used in this location
162+
# block removes any already added headers https://nginx.org/en/docs/http/ngx_http_headers_module.html
163+
include /home/forge/nginx-partials/security.conf;
164+
165+
# Use Dotenvy to generate the .env variables as per: https://github.com/nystudio107/dotenvy
166+
# and then uncomment this line to include them:
167+
# include /home/forge/SOMEDOMAIN/.env_nginx.txt
168+
169+
fastcgi_intercept_errors off;
170+
fastcgi_buffer_size 16k;
171+
fastcgi_buffers 4 16k;
172+
fastcgi_connect_timeout 300;
173+
fastcgi_send_timeout 300;
174+
fastcgi_read_timeout 300;
175+
176+
# FastCGI Cache settings
177+
fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
178+
fastcgi_cache {{ SITE }};
179+
fastcgi_hide_header Set-Cookie;
180+
fastcgi_cache_valid 200 1d;
181+
fastcgi_cache_use_stale updating error timeout invalid_header http_500;
182+
fastcgi_cache_bypass $no_cache;
183+
fastcgi_no_cache $no_cache;
184+
}
185+
186+
# php-fpm configuration for non-cached content
187+
location @phpfpm_nocache {
188+
fastcgi_split_path_info ^(.+\.php)(/.+)$;
189+
# Change this to whatever version of php you are using
190+
fastcgi_pass {{ PROXY_PASS }};
191+
fastcgi_index index.php;
192+
include fastcgi_params;
193+
fastcgi_param PATH_INFO $query_string;
194+
fastcgi_param SCRIPT_FILENAME $realpath_root/index.php;
195+
fastcgi_param DOCUMENT_ROOT $realpath_root;
196+
fastcgi_param HTTP_PROXY "";
197+
fastcgi_param HTTP_HOST {{ SITE }};
198+
199+
# Don't allow browser caching of dynamically generated content
200+
add_header X-Cache-Status $upstream_cache_status;
201+
add_header Last-Modified $date_gmt;
202+
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
203+
if_modified_since off;
204+
expires off;
205+
etag off;
206+
# Load security.conf from nginx-partials again, because add_header used in this location
207+
# block removes any already added headers https://nginx.org/en/docs/http/ngx_http_headers_module.html
208+
include /home/forge/nginx-craft/nginx-partials/security.conf;
209+
210+
# Use Dotenvy to generate the .env variables as per: https://github.com/nystudio107/dotenvy
211+
# and then uncomment this line to include them:
212+
# include /home/forge/SOMEDOMAIN/.env_nginx.txt
213+
214+
fastcgi_intercept_errors off;
215+
fastcgi_buffer_size 16k;
216+
fastcgi_buffers 4 16k;
217+
fastcgi_connect_timeout 300;
218+
fastcgi_send_timeout 300;
219+
fastcgi_read_timeout 300;
220+
221+
# No FastCGI Cache
222+
fastcgi_cache_bypass 1;
223+
fastcgi_no_cache 1;
224+
}
225+
226+
location ~ /\.ht {
227+
deny all;
228+
}
229+
}
230+
231+
# FORGE CONFIG (DO NOT REMOVE!)
232+
include forge-conf/{{ SITE }}/after/*;

‎nginx-partials/security.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ add_header X-Frame-Options "SAMEORIGIN" always;
55
add_header X-XSS-Protection "1; mode=block" always;
66
add_header X-Content-Type-Options "nosniff" always;
77
add_header Referrer-Policy "no-referrer-when-downgrade" always;
8+
# Opt out of Google Federated Learning of Cohorts ("FLoC"). ref:(https://amifloced.org/)
9+
add_header Permissions-Policy "interest-cohort=()" always;
810

911
# Add Content-Security-Policy HTTP response header. Helps reduce XSS risks on
1012
# modern browsers by declaring what dynamic resources are allowed to load via a

0 commit comments

Comments
 (0)