Skip to content

Commit 13c9e73

Browse files
bluebamusbluebamus
committed
add default.conf to block ip access, add subdomain block as comment in sample_nginx.conf, sample_nginx_https.conf.
1 parent f732bd1 commit 13c9e73

9 files changed

Lines changed: 87 additions & 47 deletions

File tree

‎config/web-server/nginx/gunicorn/conf.d/default.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# ip access drop
2+
server {
3+
listen 80 default_server;
4+
return 444;
5+
}

‎config/web-server/nginx/gunicorn/sample_nginx.conf‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
11
server {
22
listen portnumber;
33
server_name domain www.domain;
4-
4+
55
access_log /log/nginx/filename.com.gunicorn_access.log main;
66
error_log /log/nginx/filename.com.gunicorn_error.log warn;
7-
7+
8+
# if ($host !~* ^(domain\.com|www\.domain\.com)$) {
9+
# return 444;
10+
# }
11+
812
# Django media
913
location /media {
1014
autoindex off;
@@ -20,7 +24,7 @@ server {
2024
gzip_static on;
2125
expires max;
2226
#alias /www/django_sample/static;
23-
# normally static folder is named as /static
27+
# normally static folder is named as /static
2428
alias /www/webroot/static; # your Django project's static files - amend as required
2529
#include /etc/nginx/mime.types;
2630
}
@@ -31,37 +35,37 @@ server {
3135
# proxy_redirect http:// https://;
3236

3337
}
34-
38+
3539
# Allow Lets Encrypt Domain Validation Program
3640
location ^~ /.well-known/acme-challenge/ {
3741
allow all;
3842
root /www/webroot;
3943
}
40-
44+
4145
# Block dot file (.htaccess .htpasswd .svn .git .env and so on.)
4246
location ~ /\. {
4347
deny all;
4448
}
45-
49+
4650
# Block (log file, binary, certificate, shell script, sql dump file) access.
4751
location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key|yml|lock)$ {
4852
deny all;
4953
}
50-
54+
5155
# Block access
5256
location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml|access_log|error_log|gruntfile\.js)$ {
5357
deny all;
5458
}
55-
59+
5660
location = /favicon.ico {
5761
log_not_found off;
5862
access_log off;
5963
}
60-
64+
6165
location = /robots.txt {
6266
log_not_found off;
6367
access_log off;
64-
}
68+
}
6569

6670
if ($bad_bot) {
6771
return 403;

‎config/web-server/nginx/gunicorn/sample_nginx_https.conf‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ server {
33
server_name domain www.domain;
44

55
rewrite ^ https://$host$request_uri permanent;
6+
7+
# if ($host !~* ^(domain\.com|www\.domain\.com)$) {
8+
# return 444;
9+
# }
610
}
711

812
server {
@@ -59,33 +63,33 @@ server {
5963
proxy_set_header Host $host;
6064
# proxy_redirect http:// https://;
6165
}
62-
66+
6367
# Allow Lets Encrypt Domain Validation Program
6468
location ^~ /.well-known/acme-challenge/ {
6569
allow all;
6670
root /www/webroot;
6771
}
68-
72+
6973
# Block dot file (.htaccess .htpasswd .svn .git .env and so on.)
7074
location ~ /\. {
7175
deny all;
7276
}
73-
77+
7478
# Block (log file, binary, certificate, shell script, sql dump file) access.
7579
location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key|yml|lock)$ {
7680
deny all;
7781
}
78-
82+
7983
# Block access
8084
location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml|access_log|error_log|gruntfile\.js)$ {
8185
deny all;
8286
}
83-
87+
8488
location = /favicon.ico {
8589
log_not_found off;
8690
access_log off;
8791
}
88-
92+
8993
location = /robots.txt {
9094
log_not_found off;
9195
access_log off;

‎config/web-server/nginx/php/conf.d/default.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# ip access drop
2+
server {
3+
listen 80 default_server;
4+
return 444;
5+
}

‎config/web-server/nginx/php/sample_nginx.conf‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,37 +5,42 @@ server {
55

66
access_log /log/nginx/filename.com.php_access.log main;
77
error_log /log/nginx/filename.com.php_error.log warn;
8-
8+
9+
# if ($host !~* ^(domain\.com|www\.domain\.com)$) {
10+
# return 444;
11+
# }
12+
13+
914
location / {
1015
index index.php index.html;
1116
}
12-
17+
1318
# Allow Lets Encrypt Domain Validation Program
1419
location ^~ /.well-known/acme-challenge/ {
1520
allow all;
1621
root /www/webroot;
1722
}
18-
23+
1924
# Block dot file (.htaccess .htpasswd .svn .git .env and so on.)
2025
location ~ /\. {
2126
deny all;
2227
}
23-
28+
2429
# Block (log file, binary, certificate, shell script, sql dump file) access.
2530
location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key|yml|lock)$ {
2631
deny all;
2732
}
28-
33+
2934
# Block access
3035
location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml|access_log|error_log|gruntfile\.js)$ {
3136
deny all;
3237
}
33-
38+
3439
location = /favicon.ico {
3540
log_not_found off;
3641
access_log off;
3742
}
38-
43+
3944
location = /robots.txt {
4045
log_not_found off;
4146
access_log off;
@@ -44,12 +49,12 @@ server {
4449
location ~* \.(js|css|png|jpg|jpeg|gif|ico) {
4550
access_log off;
4651
}
47-
52+
4853
# Block .php file inside upload folder. uploads(wp), files(drupal), data(gnuboard).
4954
location ~* /(?:uploads|default/files|data)/.*\.php$ {
5055
deny all;
5156
}
52-
57+
5358
# Add PHP handler
5459
location ~ [^/]\.php(/|$) {
5560
fastcgi_split_path_info ^(.+?\.php)(/.*)$;

‎config/web-server/nginx/php/sample_nginx_https.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ server {
22
listen portnumber;
33
server_name domain www.domain;
44

5+
# if ($host !~* ^(domain\.com|www\.domain\.com)$) {
6+
# return 444;
7+
# }
8+
59
return 301 https://$host$request_uri;
610
}
711

‎config/web-server/nginx/uwsgi/conf.d/default.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# ip access drop
2+
server {
3+
listen 80 default_server;
4+
return 444;
5+
}

‎config/web-server/nginx/uwsgi/sample_nginx.conf‎

Lines changed: 26 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
11
server {
22
listen portnumber;
33
server_name domain www.domain;
4-
4+
55
access_log /log/nginx/filename.com.uwsgi_access.log main;
66
error_log /log/nginx/filename.com.uwsgi_error.log warn;
7-
7+
8+
# if ($host !~* ^(domain\.com|www\.domain\.com)$) {
9+
# return 444;
10+
# }
11+
812
# Django media
913
location /media {
1014
gzip_static on;
@@ -18,61 +22,61 @@ server {
1822
gzip_static on;
1923
expires max;
2024
#alias /www/django_sample/static;
21-
# normally static folder is named as /static
25+
# normally static folder is named as /static
2226
alias /www/webroot/static; # your Django project's static files - amend as required
2327
#include /etc/nginx/mime.types;
2428
}
2529

2630
location / {
2731
uwsgi_pass appname:serviceport;
2832

29-
uwsgi_max_temp_file_size 20480m;
30-
uwsgi_buffering off;
31-
uwsgi_ignore_client_abort on;
32-
uwsgi_buffers 2560 160k;
33-
uwsgi_buffer_size 2560k;
34-
uwsgi_connect_timeout 30s;
35-
uwsgi_send_timeout 30s;
36-
uwsgi_read_timeout 30s;
37-
uwsgi_busy_buffers_size 2560k;
38-
uwsgi_temp_file_write_size 2560k;
39-
proxy_read_timeout 30s;
40-
proxy_connect_timeout 75s;
33+
uwsgi_max_temp_file_size 20480m;
34+
uwsgi_buffering off;
35+
uwsgi_ignore_client_abort on;
36+
uwsgi_buffers 2560 160k;
37+
uwsgi_buffer_size 2560k;
38+
uwsgi_connect_timeout 30s;
39+
uwsgi_send_timeout 30s;
40+
uwsgi_read_timeout 30s;
41+
uwsgi_busy_buffers_size 2560k;
42+
uwsgi_temp_file_write_size 2560k;
43+
proxy_read_timeout 30s;
44+
proxy_connect_timeout 75s;
4145

4246
# proxy_redirect http:// https://;
4347

4448
}
45-
49+
4650
# Allow Lets Encrypt Domain Validation Program
4751
location ^~ /.well-known/acme-challenge/ {
4852
allow all;
4953
root /www/webroot;
5054
}
51-
55+
5256
# Block dot file (.htaccess .htpasswd .svn .git .env and so on.)
5357
location ~ /\. {
5458
deny all;
5559
}
56-
60+
5761
# Block (log file, binary, certificate, shell script, sql dump file) access.
5862
location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key|yml|lock)$ {
5963
deny all;
6064
}
61-
65+
6266
# Block access
6367
location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml|access_log|error_log|gruntfile\.js)$ {
6468
deny all;
6569
}
66-
70+
6771
location = /favicon.ico {
6872
log_not_found off;
6973
access_log off;
7074
}
71-
75+
7276
location = /robots.txt {
7377
log_not_found off;
7478
access_log off;
75-
}
79+
}
7680

7781
if ($bad_bot) {
7882
return 403;

‎config/web-server/nginx/uwsgi/sample_nginx_https.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ server {
33
server_name domain www.domain;
44

55
rewrite ^ https://$host$request_uri permanent;
6+
7+
# if ($host !~* ^(domain\.com|www\.domain\.com)$) {
8+
# return 444;
9+
# }
610
}
711

812
server {

0 commit comments

Comments
 (0)