128 lines
3.9 KiB
Plaintext
128 lines
3.9 KiB
Plaintext
# Определяем переменную для блокировки
|
||
map $remote_addr $blocked_ip {
|
||
default 0;
|
||
include /etc/nginx/blocked_ips.map;
|
||
}
|
||
|
||
server {
|
||
listen 80;
|
||
server_name _;
|
||
|
||
root /var/www/html/public;
|
||
index index.php index.html;
|
||
|
||
# ========== ОСНОВНЫЕ НАСТРОЙКИ БЕЗОПАСНОСТИ ==========
|
||
|
||
# Защитные заголовки
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||
|
||
# ========== ПРЕДВАРИТЕЛЬНЫЕ ПРОВЕРКИ ==========
|
||
|
||
# Если IP в черном списке
|
||
if ($blocked_ip) {
|
||
return 444;
|
||
}
|
||
|
||
# ========== ГЛОБАЛЬНЫЕ ОГРАНИЧЕНИЯ ==========
|
||
|
||
limit_conn conn_limit_per_ip 25;
|
||
limit_req zone=req_limit_per_ip burst=30 delay=15;
|
||
|
||
# ========== ОБРАБОТКА PHP ==========
|
||
|
||
location ~ \.php$ {
|
||
# Дефолтные лимиты для всех PHP запросов
|
||
limit_req zone=req_limit_per_ip burst=100 delay=15;
|
||
limit_conn conn_limit_per_ip 60;
|
||
|
||
try_files $uri =404;
|
||
|
||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_index index.php;
|
||
|
||
# Оптимизация из основного конфига
|
||
fastcgi_buffers 64 64k;
|
||
fastcgi_buffer_size 128k;
|
||
fastcgi_busy_buffers_size 512k;
|
||
fastcgi_temp_file_write_size 612k;
|
||
|
||
# Таймауты
|
||
fastcgi_connect_timeout 600s;
|
||
fastcgi_send_timeout 600s;
|
||
fastcgi_read_timeout 600s;
|
||
|
||
include fastcgi_params;
|
||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||
fastcgi_param PATH_INFO $fastcgi_path_info;
|
||
}
|
||
|
||
# ========== REVERB (WEBSOCKET) ==========
|
||
# Клиент бьёт в /app/{key} (WS), серверный broadcast — в /apps/{id}/... (REST).
|
||
# Оба идут на тот же домен/порт, что и само приложение.
|
||
|
||
location /app/ {
|
||
proxy_pass http://reverb:8080;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header Scheme $scheme;
|
||
proxy_set_header SERVER_PORT $server_port;
|
||
proxy_set_header REMOTE_ADDR $remote_addr;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
|
||
location /apps/ {
|
||
proxy_pass http://reverb:8080;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
|
||
# ========== Sentry ==========
|
||
location /sentry/ {
|
||
proxy_pass http://10.32.0.213:50/;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
|
||
# ========== ОСНОВНОЙ LOCATION ==========
|
||
|
||
location / {
|
||
try_files $uri $uri/ /index.php?$query_string;
|
||
|
||
gzip_static on;
|
||
gzip_vary on;
|
||
}
|
||
|
||
# ========== ЗАЩИТА ФАЙЛОВОЙ СИСТЕМЫ ==========
|
||
|
||
location ~ /\. {
|
||
deny all;
|
||
access_log off;
|
||
log_not_found off;
|
||
return 404;
|
||
}
|
||
|
||
location ~* (\.env|\.git|\.svn|\.htaccess|composer\.json|composer\.lock) {
|
||
deny all;
|
||
return 404;
|
||
}
|
||
|
||
location ~* (eval|base64_encode|system\(|shell_exec|passthru|exec|phpinfo) {
|
||
deny all;
|
||
return 444;
|
||
}
|
||
}
|