150 lines
3.5 KiB
Text
150 lines
3.5 KiB
Text
server {
|
|
listen 127.0.0.1:80;
|
|
listen [::1]:80;
|
|
server_name example.org;
|
|
|
|
root /srv/http/virtual/example.org/htdocs;
|
|
log_not_found off;
|
|
access_log off;
|
|
|
|
location /.well-known {
|
|
alias /srv/http/virtual/example.org/htdocs/.well-known;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
# allows for multiple tests
|
|
map "$path_fragment:$dl_fragment" $map_dl_fragment {
|
|
default 0;
|
|
"~^dl:[\S]+$" 1;
|
|
}
|
|
|
|
map "$path_fragment" $map_mime {
|
|
default 0;
|
|
"~^(txt|log|patch|raw|diff|awk|sh)$" 'text/plain';
|
|
"~^(bin|dat)$" 'application/octet-stream';
|
|
"~^(ogg|opus)$" 'audio/vorbis';
|
|
"~^jpg$" 'image/jpg';
|
|
"~^gif$" 'image/gif';
|
|
"~^png$" 'image/png';
|
|
"~^webp$" 'image/webp';
|
|
"~^svgz?$" 'image/svg+xml';
|
|
"~^json$" 'application/json';
|
|
"~^html?$" 'text/html';
|
|
"~^mp3$" 'audio/mpeg';
|
|
"~^aac$" 'audio/aac';
|
|
"~^mp4$" 'video/mp4';
|
|
"~^avi$" 'video/x-msvideo';
|
|
"~^mkv$" 'video/x-matroska';
|
|
"~^webm$" 'video/webm';
|
|
}
|
|
|
|
server {
|
|
listen 127.0.0.1:443 ssl http2;
|
|
listen [::1]:443 ssl http2;
|
|
server_name example.org;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem;
|
|
ssl_trusted_certificate /etc/letsencrypt/live/example.org/chain.pem;
|
|
|
|
log_not_found off;
|
|
|
|
error_log stderr notice;
|
|
rewrite_log off;
|
|
|
|
access_log /srv/http/virtual/example.org/logs/nginx/access.log;
|
|
|
|
root /srv/http/virtual/example.org/htdocs/root;
|
|
|
|
index index.html;
|
|
#include globals/csp-all.conf;
|
|
#include globals/robots.conf;
|
|
#include globals/noindex.conf;
|
|
#include globals/floc.conf;
|
|
|
|
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
|
add_header Cross-Origin-Embedder-Policy "require-corp" always;
|
|
|
|
# obsolete when client system time is correct
|
|
add_header Expect-CT "enforce, max-age=63072000" always;
|
|
|
|
# obsolete and replaced with strong Content-Security-Policy
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
|
|
# sniffing increases user experience dramatically in this use case
|
|
#add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
set $path_fragment '';
|
|
# $request_uri is url encoded
|
|
if ($uri ~* "^\/([\w\d\-_.]{1,16}\.?)\/([\w\d\.]{1,16})(?:\/([^\/&?#]+))?\/?$)" {
|
|
set $file_fragment $1;
|
|
set $path_fragment $2;
|
|
set $dl_fragment $3;
|
|
rewrite "^/([^\/]*)/([^\/]{1,16})(?:/.*)?$" /$1 last;
|
|
}
|
|
location /.well-known {
|
|
default_type "text/plain";
|
|
alias /srv/http/virtual/example.org/htdocs/.well-known;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location = / {
|
|
return 302 "https://betaco.de/zeno/ssh-paste";
|
|
}
|
|
|
|
location = /index.html {
|
|
return 301 /;
|
|
}
|
|
|
|
location ~ ^/\.__.*__\.__tmp__$ {
|
|
return 403;
|
|
}
|
|
|
|
location / {
|
|
root /srv/http/virtual/example.org/htdocs/paste;
|
|
|
|
etag off;
|
|
expires 1h;
|
|
disable_symlinks on;
|
|
autoindex off;
|
|
|
|
#default_type "application/octet-stream";
|
|
|
|
include mime.types;
|
|
types {
|
|
text/plain md markdown;
|
|
text/plain css js xml;
|
|
text/plain sh bash zsh fish;
|
|
text/plain awk sed;
|
|
text/plain yaml yml;
|
|
text/plain pl py lua rb;
|
|
text/plain nim hs;
|
|
text/plain java kt;
|
|
text/plain c cpp cxx h hpp hxx;
|
|
text/plain go mod sum;
|
|
text/plain patch txt;
|
|
}
|
|
|
|
set $mtype $map_mime;
|
|
if ($mtype) {
|
|
more_set_headers "Content-Type: $mtype";
|
|
}
|
|
|
|
if ($path_fragment ~ '^(bin|dat)$') {
|
|
add_header Content-Disposition "attachment; filename=$file_fragment";
|
|
}
|
|
|
|
if ($map_dl_fragment) {
|
|
more_set_headers "Content-Type: application/octet-stream";
|
|
add_header Content-Disposition "attachment; filename=$dl_fragment";
|
|
}
|
|
}
|
|
|
|
#include globals/error_pages.conf;
|
|
}
|
|
|