mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-11 17:20:32 +02:00
Mark HegrebergandChristian Heusel
410f59cb5a
these are all the systems that the new redirect snippet can be cleanly applied to. there are a few others not included, that will need a more manual approach: - gitlab (multiple domains) - mta.sts(multiple domains) - archweb(mutltiple domains, snippets) - buildbtw(dynamic dev domains) - redirects(different structure) - public html(multiple domains) - archweb maintenence(different structure) - maintenence(different structure) some of these might be solvable by tweaking the snippet to accept multiple domains. I'll look into this Co-authored-by: Christian Heusel <christian@heusel.eu>
97 lines
3.0 KiB
Django/Jinja
97 lines
3.0 KiB
Django/Jinja
|
|
# a limiter to stop abuse of the rss feed.
|
|
# limit to 1 requests per minute, with a burst defined when we use this
|
|
# limiter in the location directive below
|
|
limit_req_zone $binary_remote_addr zone=rsslimit:8m rate=1r/m;
|
|
limit_req_zone $binary_remote_addr zone=searchlimit:10m rate=1r/s;
|
|
limit_req_zone $binary_remote_addr zone=bbslimit:10m rate=10r/s;
|
|
limit_req_status 429;
|
|
|
|
include snippets/redirect-80.conf;
|
|
|
|
server {
|
|
include snippets/listen-443.conf;
|
|
server_name {{ fluxbb_domain }};
|
|
root {{ fluxbb_dir }};
|
|
index index.php;
|
|
|
|
access_log /var/log/nginx/{{ fluxbb_domain }}/access.log;
|
|
access_log /var/log/nginx/{{ fluxbb_domain }}/access.log.json json_reduced;
|
|
error_log /var/log/nginx/{{ fluxbb_domain }}/error.log;
|
|
|
|
acme_certificate letsencrypt;
|
|
ssl_certificate $acme_certificate;
|
|
ssl_certificate_key $acme_certificate_key;
|
|
|
|
location /.git {
|
|
deny all;
|
|
}
|
|
|
|
location = /search.php {
|
|
limit_req zone=searchlimit burst=10;
|
|
fastcgi_pass unix:/run/php-fpm/fluxbb.socket;
|
|
fastcgi_index index.php;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
try_files $uri =404;
|
|
fastcgi_param HTTPS on;
|
|
include fastcgi_params;
|
|
}
|
|
|
|
location ~ /extern\.php {
|
|
limit_req zone=rsslimit burst=10 nodelay;
|
|
fastcgi_pass unix:/run/php-fpm/fluxbb.socket;
|
|
fastcgi_index index.php;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
try_files $uri =404;
|
|
fastcgi_param HTTPS on;
|
|
include fastcgi_params;
|
|
}
|
|
|
|
location ~ ^/(?:config|header|footer)\.php {
|
|
log_not_found off;
|
|
deny all;
|
|
return 403;
|
|
}
|
|
|
|
location ~ /(cache|include|lang|plugins) {
|
|
log_not_found off;
|
|
deny all;
|
|
return 403;
|
|
}
|
|
|
|
location ^~ /style/ {
|
|
expires 7d;
|
|
include snippets/headers.conf;
|
|
add_header Pragma public;
|
|
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
|
|
}
|
|
|
|
location ^~ /img/ {
|
|
expires 7d;
|
|
include snippets/headers.conf;
|
|
add_header Pragma public;
|
|
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
|
|
}
|
|
|
|
location ~ ^/(?:db_update|install)\.php {
|
|
auth_basic "Administration";
|
|
auth_basic_user_file auth/{{ fluxbb_domain }};
|
|
fastcgi_pass unix:/run/php-fpm/fluxbb.socket;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
try_files $uri =404;
|
|
fastcgi_param HTTPS on;
|
|
include fastcgi_params;
|
|
}
|
|
|
|
location ~ ^/[^/]+\.php$ {
|
|
fastcgi_pass unix:/run/php-fpm/fluxbb.socket;
|
|
fastcgi_index index.php;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
try_files $uri =404;
|
|
fastcgi_param HTTPS on;
|
|
include fastcgi_params;
|
|
|
|
limit_req zone=bbslimit burst=10 nodelay;
|
|
}
|
|
}
|