4d84f9d211
Cloudflare by default only permits specific ports to pass through in the security mode we use. Since PHPMyAdmin should be hard to access, by binding it to port 9000, Cloudflare does not allow traffic unless you bypass it.
71 lines
1.7 KiB
Plaintext
Executable File
71 lines
1.7 KiB
Plaintext
Executable File
# Nginx configuration for HTTP
|
|
|
|
server_tokens off;
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
add_header X-Content-Type-Options nosniff;
|
|
|
|
upstream dev_tomcat_1 {
|
|
server tomcat;
|
|
}
|
|
|
|
upstream dev_ghost_1 {
|
|
server ghost:2368;
|
|
}
|
|
|
|
# HTTP
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
gzip on;
|
|
gzip_static on;
|
|
gzip_vary on;
|
|
gzip_http_version 1.1;
|
|
gzip_min_length 700;
|
|
gzip_comp_level 6;
|
|
server_name localhost;
|
|
error_log /var/log/nginx/error.log;
|
|
access_log /var/log/nginx/access.log;
|
|
root /var/www/html/public;
|
|
index index.html index.htm index.jsp;
|
|
|
|
####### Proxies #######
|
|
# Ghost proxy
|
|
location ~ {
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Server $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_pass http://ghost:2368;
|
|
}
|
|
|
|
# Tomcat proxy
|
|
location ~ \.(do|jspa|obr|jsp|txt|zip) {
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Server $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_pass http://tomcat:8080;
|
|
}
|
|
|
|
####### Protections and efficiencies #######
|
|
# Deny access to files beginning with .ht, such as .htaccess and .htpasswd
|
|
location ~ /\.ht {
|
|
deny all;
|
|
}
|
|
|
|
# Instructs visitor browser to cache files for 1 month
|
|
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
|
|
expires 1M;
|
|
}
|
|
|
|
# Deny access to version control system directories.
|
|
location ~ /\.git {
|
|
deny all;
|
|
internal;
|
|
}
|
|
|
|
# Certbot for HTTPS cert renewal
|
|
location ^~ /.well-known {
|
|
allow all;
|
|
root /data/letsencrypt/;
|
|
}
|
|
}
|