GitPrep
Login
Showing 3 changed files with 228 additions and 24 deletions
+31 -24
etc/nginx/nginx.conf
View
... ... 
@@ -1,6 +1,7 @@
1 1 
 user www-data;
2 
-worker_processes 1;
2 
+worker_processes auto;
3 3 
 pid /run/nginx.pid;
4 
+include /etc/nginx/modules-enabled/*.conf;
4 5
5 6 
 events {
6 7 
 	worker_connections 768;
... ... 
@@ -15,13 +16,11 @@ http {
15 16
16 17 
 	sendfile on;
17 18 
 	tcp_nopush on;
18 
-	tcp_nodelay on;
19 
-	keepalive_timeout 65;
20 19 
 	types_hash_max_size 2048;
21 
-	server_tokens off;
20 
+	# server_tokens off;
22 21
23 22 
 	# server_names_hash_bucket_size 64;
24 
-	 server_name_in_redirect off;
23 
+	# server_name_in_redirect off;
25 24
26 25 
 	include /etc/nginx/mime.types;
27 26 
 	default_type application/octet-stream;
... ... 
@@ -30,19 +29,8 @@ http {
30 29 
 	# SSL Settings
31 30 
 	##
32 31
32 
+	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
33 33 
 	ssl_prefer_server_ciphers on;
34 
-        ssl_certificate ssl_keys/default.pem;
35 
-        ssl_certificate_key ssl_keys/default.key;
36 
-        #ssl_dhparam ssl_keys/dhparam-1024.pem;
37 
-        ssl_dhparam /etc/ssl/private/dhparams.pem;
38 
-        ssl_session_timeout 5m;
39 
-        ssl_session_cache shared:SSL:10m;
40 
-	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
41 
-        # ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
42 
-        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
43 
-#        ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:HIGH:!aNULL;
44 
-
45 
-        add_header Strict-Transport-Security "max-age=15768000; includeSubdomains;";
46 34
47 35 
 	##
48 36 
 	# Logging Settings
... ... 
@@ -56,14 +44,13 @@ http {
56 44 
 	##
57 45
58 46 
 	gzip on;
59 
-	gzip_disable "msie6";
60 47
61 
-	gzip_vary on;
62 
-	gzip_proxied any;
63 
-	gzip_comp_level 6;
64 
-	gzip_buffers 16 8k;
65 
-	gzip_http_version 1.1;
66 
-	gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
48 
+	# gzip_vary on;
49 
+	# gzip_proxied any;
50 
+	# gzip_comp_level 6;
51 
+	# gzip_buffers 16 8k;
52 
+	# gzip_http_version 1.1;
53 
+	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
67 54
68 55 
 	##
69 56 
 	# Virtual Host Configs
... ... 
@@ -74,3 +61,23 @@ http {
74 61 
 }
75 62
76 63
64 
+#mail {
65 
+#	# See sample authentication script at:
66 
+#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
67 
+#
68 
+#	# auth_http localhost/auth.php;
69 
+#	# pop3_capabilities "TOP" "USER";
70 
+#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
71 
+#
72 
+#	server {
73 
+#		listen     localhost:110;
74 
+#		protocol   pop3;
75 
+#		proxy      on;
76 
+#	}
77 
+#
78 
+#	server {
79 
+#		listen     localhost:143;
80 
+#		protocol   imap;
81 
+#		proxy      on;
82 
+#	}
83 
+#}
+71
etc/nginx/sites-available/grav
View
... ... 
@@ -0,0 +1,71 @@
1 
+server {
2 
+	listen         80;
3 
+	server_name    paris12.pcf.fr;
4 
+
5 
+	access_log off;
6 
+
7 
+    location ~ /\.well-known/acme-challenge {
8 
+        allow all;
9 
+        default_type "text/plain";
10 
+        root /var/www/grav;
11 
+    }
12 
+
13 
+    location / {
14 
+        return 301 https://$host$request_uri;
15 
+    }
16 
+}
17 
+
18 
+server {
19 
+	listen 443 ssl;
20 
+	server_name paris12.pcf.fr;
21 
+	root /var/www/grav;
22 
+    index index.html index.php;
23 
+
24 
+	access_log off;
25 
+	error_log /var/log/nginx/grav/error.log;
26 
+
27 
+	ssl_certificate /etc/letsencrypt/live/paris12.pcf.fr/fullchain.pem;
28 
+	ssl_certificate_key /etc/letsencrypt/live/paris12.pcf.fr/privkey.pem;
29 
+
30 
+    location ^~ /\.well-known/acme-challenge {
31 
+        allow all;
32 
+        default_type "text/plain";
33 
+    }
34 
+
35 
+    location ^~ /cgi-bin/mailman/admin/ {
36 
+        return 301 https://listes.pcf.fr$request_uri;
37 
+    }
38 
+
39 
+    location / {
40 
+        try_files $uri $uri/ /index.php?$query_string;
41 
+    }
42 
+
43 
+    # deny all direct access for these folders
44 
+    location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
45 
+
46 
+    # deny running scripts inside core system folders
47 
+    location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
48 
+
49 
+    # deny running scripts inside user folder
50 
+    location ~* /user/.*\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
51 
+
52 
+    # deny access to specific files in the root folder
53 
+    location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
54 
+
55 
+    location ~ \.php$ {
56 
+        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
57 
+
58 
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
59 
+        fastcgi_index index.php;
60 
+        include fastcgi_params;
61 
+        fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
62 
+    }
63 
+
64 
+    location ~* /logements-(e|%C3%A9|é)tudiants-jc {
65 
+        rewrite ^.* https://cloud.paris12.pcf.fr/index.php/apps/forms/Pgoe5oGTpwAEFP6F permanent;
66 
+    }
67 
+    location ~* /pr(e|%C3%A9|é)pa-soir(e|%C3%A9|é)e-commission-culture {
68 
+        rewrite ^.* https://cloud.paris12.pcf.fr/index.php/s/H3YPpQsxcAN5555 permanent;
69 
+    }
70 
+}
71 
+
+126
etc/nginx/sites-available/nextcloud
View
... ... 
@@ -0,0 +1,126 @@
1 
+server {
2 
+	listen         80;
3 
+	server_name    cloud.paris12.pcf.fr;
4 
+
5 
+    location ~ /\.well-known/acme-challenge {
6 
+        allow all;
7 
+        default_type "text/plain";
8 
+        root /var/www/nextcloud;
9 
+    }
10 
+
11 
+    location / {
12 
+        return 301 https://$host$request_uri;
13 
+    }
14 
+}
15 
+
16 
+server {
17 
+	listen 443 ssl;
18 
+	server_name cloud.paris12.pcf.fr;
19 
+
20 
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
21 
+
22 
+	root /var/www/nextcloud/;
23 
+
24 
+	access_log off;
25 
+	error_log /var/log/nginx/cloud/error.log;
26 
+
27 
+	client_max_body_size 10G;
28 
+	fastcgi_buffers 64 4K;
29 
+
30 
+    proxy_connect_timeout       1800;
31 
+    proxy_send_timeout          1800;
32 
+    proxy_read_timeout          1800;
33 
+    send_timeout                1800;
34 
+
35 
+	rewrite ^/caldav(.*)$ /remote.php/caldav$1 redirect;
36 
+	rewrite ^/carddav(.*)$ /remote.php/carddav$1 redirect;
37 
+	rewrite ^/webdav(.*)$ /remote.php/webdav$1 redirect;
38 
+
39 
+	index index.php;
40 
+	error_page 403 /core/templates/403.php;
41 
+	error_page 404 /core/templates/404.php;
42 
+
43 
+	ssl_certificate /etc/letsencrypt/live/cloud.paris12.pcf.fr/fullchain.pem;
44 
+	ssl_certificate_key /etc/letsencrypt/live/cloud.paris12.pcf.fr/privkey.pem;
45 
+
46 
+	location = /robots.txt {
47 
+		deny all;
48 
+		log_not_found off;
49 
+		access_log off;
50 
+	}
51 
+
52 
+	location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README){
53 
+		deny all;
54 
+	}
55 
+
56 
+	location / {
57 
+                # The following 2 rules are only needed with webfinger
58 
+		rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
59 
+		rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
60 
+
61 
+		rewrite ^/.well-known/carddav /remote.php/carddav/ redirect;
62 
+		rewrite ^/.well-known/caldav /remote.php/caldav/ redirect;
63 
+
64 
+		rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
65 
+
66 
+		try_files $uri $uri/ /index.php;
67 
+	}
68 
+
69 
+	location ~ \.php(?:$|/) {
70 
+		fastcgi_split_path_info ^(.+\.php)(/.+)$;
71 
+		include fastcgi_params;
72 
+		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
73 
+		fastcgi_param PATH_INFO $fastcgi_path_info;
74 
+		fastcgi_param HTTPS on;
75 
+		fastcgi_pass php-handler-cloud;
76 
+        fastcgi_read_timeout 1800;
77 
+	}
78 
+
79 
+    location ^~ /adminprinter {
80 
+	    auth_basic "Halte ! Qui va la ?";
81 
+	    auth_basic_user_file /etc/nginx/htpasswd;
82 
+		proxy_pass https://192.168.1.54/;
83 
+		proxy_http_version 1.1;
84 
+		proxy_set_header Upgrade $http_upgrade;
85 
+		proxy_set_header Connection 'upgrade';
86 
+		proxy_set_header Host $host;
87 
+		proxy_cache_bypass $http_upgrade;
88 
+    }
89 
+
90 
+    location ^~ /adminbdd {
91 
+        root /var/www/;
92 
+	auth_basic "Halte ! Qui va la ?";
93 
+	auth_basic_user_file /etc/nginx/htpasswd;
94 
+        location ~ \.php {
95 
+            fastcgi_split_path_info ^(.+\.php)(/.+)$;
96 
+            include fastcgi_params;
97 
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
98 
+            fastcgi_param PATH_INFO $fastcgi_path_info;
99 
+            fastcgi_param HTTPS on;
100 
+            fastcgi_pass php-handler-cloud;
101 
+        }
102 
+    }
103 
+
104 
+	# set long EXPIRES header on static assets
105 
+	location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
106 
+		expires 30d;
107 
+		access_log off;
108 
+	}
109 
+
110 
+	location ^~ /cartes-elections {
111 
+		proxy_pass http://127.0.0.1:8080;
112 
+		proxy_http_version 1.1;
113 
+		proxy_set_header Upgrade $http_upgrade;
114 
+		proxy_set_header Connection 'upgrade';
115 
+		proxy_set_header Host $host;
116 
+		proxy_cache_bypass $http_upgrade;
117 
+	}
118 
+
119 
+	location ^~ /images/ {
120 
+		alias /var/www/images/;
121 
+	}
122 
+
123 
+    location ^~ /petitions/logements-etudiants-jc {
124 
+        rewrite ^/petitions/logements-etudiants-jc /index.php/apps/forms/Pgoe5oGTpwAEFP6F permanent;
125 
+    }
126 
+}
Gitprep Version v2.6.2 build on Mojolicious