infrastructure/roles/archwiki/templates/nginx.d.conf.j2

# Please keep "path" and "levels" in sync with nginx-cache-purge
fastcgi_cache_path /var/lib/nginx/cache levels=1:2 keys_zone=wiki:100m inactive=720m min_free=10G;
# Please keep in sync with "cache_key" in nginx-cache-purge
fastcgi_cache_key "$scheme$request_method$host$request_uri";

# rate limit API endpoint
limit_req_zone $binary_remote_addr zone=api_zone:10m rate=5r/s;

# limit general requests to 10 r/s to block DoS attempts with a burst of 10.
limit_req_zone $binary_remote_addr zone=archwikilimit:10m rate=10r/s;

limit_req_status 429;

upstream archwiki {
    server unix://{{ archwiki_socket }};
}

include snippets/redirect-80.conf;

server {
    include      snippets/listen-443.conf;
    server_name  {{ archwiki_domain }};

    access_log off;
    error_log /dev/null;

    acme_certificate     letsencrypt;
    ssl_certificate      $acme_certificate;
    ssl_certificate_key  $acme_certificate_key;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Http-Version $server_protocol;
        proxy_redirect http://{{ archwiki_domain }}:3000/ /;
        # Anubis
        proxy_pass http://127.0.0.1:8923;
        # Bypass Anubis
        # proxy_pass http://127.0.0.1:3000;
    }
}

server {
    set_real_ip_from 127.0.0.1;
    real_ip_header X-Real-IP;
    listen 127.0.0.1:3000;

    access_log   /var/log/nginx/{{ archwiki_domain }}/access.log reduced;
    access_log   /var/log/nginx/{{ archwiki_domain }}/access.log.json json_reduced;
    error_log    /var/log/nginx/{{ archwiki_domain }}/error.log;

    root {{ archwiki_dir }}/public;
    index index.php;

    # Block search bot that apparently never heard the term rate limiting
    if ($http_user_agent ~ "Bytespider$" ) {
        return 403;
    }

    location = /robots.txt {
        alias {{ archwiki_dir }}/robots.txt;
    }

    location ^~ /. {
        log_not_found off;
        deny all;
    }

    # Redirect old URLs to the new short-url (/title/<page>)
    location ~ ^/index.php/(.*)$ {
        return 301 /title/$1$is_args$args;
    }

    # Handling for the article path (pretty URLs)
    location ^~ /title/ {
        rewrite ^ /index.php;
    }

    # Handling for MediaWiki REST API, see https://www.mediawiki.org/wiki/API:REST_API
    location ^~ /rest.php/ {
        rewrite ^ /rest.php;
    }

    # special case for '/load.php' type URLs to cache css/js in nginx to relieve php-fpm
    location = /load.php {
        access_log   /var/log/nginx/{{ archwiki_domain }}/access.log main;
        access_log   /var/log/nginx/{{ archwiki_domain }}/access.log.json json_main;
        fastcgi_pass   archwiki;
        fastcgi_param  HTTP_X_FORWARDED_PROTO https;
        fastcgi_index  index.php;
        include        fastcgi.conf;

{% block wiki_cache %}
        fastcgi_cache wiki;
        # This improves the cache hit ratio[1] and ensures that there is
        # only a single cache file. Without this, nginx will use the
        # Vary header as an secondary cache key[2], which breaks the
        # cache purge service.
        # [1] https://www.fastly.com/blog/best-practices-using-vary-header/
        # [2] https://github.com/nginx/nginx/commit/1332e76b20a6a1e871904525d42b17dcaed81eec
        fastcgi_ignore_headers Vary;
        fastcgi_cache_background_update on;
        fastcgi_cache_use_stale updating;
        fastcgi_cache_lock on;

        include snippets/headers.conf;
        add_header X-Cache $upstream_cache_status;
{% endblock %}
    }

    # mediawiki API endpoint
    location ~ ^/api\.php {
        limit_req zone=api_zone burst=10 delay=5;
        try_files $uri =404;
        access_log   /var/log/nginx/{{ archwiki_domain }}/access.log main;
        access_log   /var/log/nginx/{{ archwiki_domain }}/access.log.json json_main;
        fastcgi_pass   archwiki;
        fastcgi_param  HTTP_X_FORWARDED_PROTO https;
        fastcgi_index  index.php;
        include        fastcgi.conf;
    }

    # normal PHP FastCGI handler
    location ~ ^/[^/]+\.php$ {
        try_files $uri =404;
        access_log   /var/log/nginx/{{ archwiki_domain }}/access.log main;
        access_log   /var/log/nginx/{{ archwiki_domain }}/access.log.json json_main;
        fastcgi_pass   archwiki;
        fastcgi_param  HTTP_X_FORWARDED_PROTO https;
        fastcgi_index  index.php;
        include        fastcgi.conf;

{{ self.wiki_cache() }}
        # https://www.mediawiki.org/w/index.php?title=Manual:Varnish_caching&oldid=6230975#Configuring_Varnish
        fastcgi_cache_bypass $http_authorization $cookie_archwiki_session $cookie_archwikiToken;
        fastcgi_no_cache $http_authorization $cookie_archwiki_session $cookie_archwikiToken;

        limit_req zone=archwikilimit burst=10 nodelay;
    }

    # MediaWiki assets
    location ~ ^/(?:images|resources/(?:assets|lib|src)|(?:skins|extensions)/.+\.(?:css|js|gif|jpg|jpeg|png|svg|wasm)$) {
        expires 30d;
        include snippets/headers.conf;
        add_header Pragma public;
        add_header Cache-Control "public, must-revalidate, proxy-revalidate";
    }

    location /images/ {
        # Add the nosniff header to the images folder (required for mw 1.40+)
        include snippets/headers.conf;
        add_header X-Content-Type-Options nosniff;
    }

    location /images/deleted {
        # Deny access to deleted images folder
        deny all;
    }

    # block all other directories
    location ~ ^/[^/]+/ {
        log_not_found off;
        deny all;
    }
}