API tools faq
paste
Guest User

Untitled

a guest
Dec 14th, 2011
94
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.51 KB | None | 0 0
raw download clone embed print report
  1. #######################################################
  2. ### nginx.conf site standard vhost include start
  3. #######################################################
  4.  
  5. ###
  6. ### Deny crawlers without 403 response.
  7. ###
  8. if ($is_crawler) {
  9. return 444;
  10. }
  11.  
  12. ###
  13. ### Deny not compatible request methods without 405 response.
  14. ###
  15. if ( $request_method !~ ^(?:GET|HEAD|POST)$ ) {
  16. return 444;
  17. }
  18.  
  19. ###
  20. ### Deny listed requests for security reasons without 403 response.
  21. ###
  22. location ~* (?:delete.+from|insert.+into|select.+from|union.+select|onload|\.php.+src|system\(.+|iframe|document\.cookie|\;|\.\.) {
  23. return 444;
  24. }
  25.  
  26. ###
  27. ### If favicon else return error 204.
  28. ###
  29. location ^~ /favicon.ico {
  30. access_log off;
  31. log_not_found off;
  32. expires 30d;
  33. try_files /sites/$host/files/favicon.ico $uri =204;
  34. }
  35.  
  36. ###
  37. ### Support for http://drupal.org/project/robotstxt module
  38. ### and static file in the sites/domain/files directory.
  39. ###
  40. location ~* /robots.txt {
  41. access_log off;
  42. try_files /sites/$host/files/robots.txt $uri @cache;
  43. }
  44.  
  45. ###
  46. ### Allow local access to support wget method in Aegir settings
  47. ### for running sites cron.
  48. ###
  49. location ^~ /cron.php {
  50. access_log off;
  51. allow 173.230.my.ip;
  52. deny all;
  53. try_files $uri =404;
  54. fastcgi_pass 127.0.0.1:9000; ### php-fpm listening on port 9000
  55. }
  56.  
  57. ###
  58. ### Send search to php-fpm early so searching for node.js will work.
  59. ### Deny bots on search uri without 403 response.
  60. ###
  61. location ~* /search {
  62. if ($is_bot) {
  63. return 444;
  64. }
  65. try_files $uri @cache;
  66. }
  67.  
  68. ###
  69. ### Upload progress support.
  70. ### http://drupal.org/project/filefield_nginx_progress
  71. ### http://github.com/masterzen/nginx-upload-progress-module
  72. ###
  73. location ~ (?:.*)/x-progress-id:(?:\w*) {
  74. access_log off;
  75. rewrite ^(.*)/x-progress-id:(\w*) $1?X-Progress-ID=$2;
  76. }
  77. location ^~ /progress {
  78. access_log off;
  79. report_uploads uploads;
  80. }
  81.  
  82. ###
  83. ### Deny access to Hostmaster web/db server node.
  84. ### It is still possible to edit or break web/db server
  85. ### node at /node/2/edit, if you know what are you doing.
  86. ###
  87. location ^~ /hosting/c/server_master {
  88. access_log off;
  89. rewrite ^ $scheme://$host/hosting/sites permanent;
  90. }
  91.  
  92. ###
  93. ### Deny access to Hostmaster db server node.
  94. ### It is still possible to edit or break db server
  95. ### node at /node/4/edit, if you know what are you doing.
  96. ###
  97. location ^~ /hosting/c/server_localhost {
  98. access_log off;
  99. rewrite ^ $scheme://$host/hosting/sites permanent;
  100. }
  101.  
  102. ###
  103. ### Fix for Aegir & .info .pl domain extensions.
  104. ###
  105. location ~* /hosting {
  106. access_log off;
  107. try_files $uri @cache;
  108. }
  109.  
  110. ###
  111. ### Deny php env display d5.
  112. ###
  113. location ^~ /admin/logs/status/ {
  114. access_log off;
  115. rewrite ^ $scheme://$host/admin/logs/status permanent;
  116. }
  117.  
  118. ###
  119. ### Deny cache details display.
  120. ###
  121. location ^~ /admin/reports/cache {
  122. access_log off;
  123. rewrite ^ $scheme://$host/admin/reports/status permanent;
  124. }
  125.  
  126. ###
  127. ### Deny php/sql env display d6 & d7.
  128. ###
  129. location ~* /admin/reports/status/(?:php|sql) {
  130. access_log off;
  131. rewrite ^ $scheme://$host/admin/reports/status permanent;
  132. }
  133.  
  134. ###
  135. ### Support for backup_migrate module download/restore/delete actions.
  136. ###
  137. location ~* /admin {
  138. if ($is_bot) {
  139. return 444;
  140. }
  141. access_log off;
  142. try_files $uri @cache;
  143. }
  144.  
  145. ###
  146. ### Deny listed requests for security reasons without 403 response.
  147. ###
  148. location ~* (/\..*|settings\.php$|\.(?:git|htaccess|engine|inc|info|install|module|profile|pl|po|sh|.*sql|theme|tpl(?:\.php)?|xtmpl)$|^(?:Entries.*|Repository|Root|Tag|Template))$ {
  149. return 444;
  150. }
  151.  
  152. ###
  153. ### Deny some not supported URI like cgi-bin on the Nginx level.
  154. ###
  155. location ~* (?:cgi-bin|vti-bin|wp-content) {
  156. access_log off;
  157. return 444;
  158. }
  159.  
  160. ###
  161. ### Deny bots on some weak modules uri without 403 response.
  162. ###
  163. location ~* (?:calendar|event|validation) {
  164. if ($is_bot) {
  165. return 444;
  166. }
  167. try_files $uri @cache;
  168. }
  169.  
  170. ###
  171. ### Responsive Images support.
  172. ### http://drupal.org/project/responsive_images
  173. ###
  174. location ~* \.r\.(?:jpe?g|png|gif) {
  175. if ( $http_cookie ~* "rwdimgsize=large" ) {
  176. rewrite ^/(.*)/mobile/(.*)\.r(\.(?:jpe?g|png|gif))$ /$1/desktop/$2$3 last;
  177. }
  178. rewrite ^/(.*)\.r(\.(?:jpe?g|png|gif))$ /$1$2 last;
  179. access_log off;
  180. add_header X-Header "RI Generator 1.0";
  181. try_files $uri @drupal;
  182. }
  183.  
  184. ###
  185. ### Imagecache and imagecache_external support.
  186. ###
  187. location ~* /(?:external|system|files/imagecache|files/styles)/ {
  188. access_log off;
  189. log_not_found off;
  190. expires 30d;
  191. # fix common problems with old paths after import from standalone to Aegir multisite
  192. rewrite ^/sites/(.*)/files/imagecache/(.*)/sites/default/files/(.*)$ /sites/$host/files/imagecache/$2/$3 last;
  193. rewrite ^/files/imagecache/(.*)$ /sites/$host/files/imagecache/$1 last;
  194. rewrite ^/files/styles/(.*)$ /sites/$host/files/styles/$1 last;
  195. add_header X-Header "IC Generator 1.0";
  196. try_files $uri @drupal;
  197. }
  198.  
  199. ###
  200. ### Deny direct access to backups.
  201. ###
  202. location ~* ^/sites/.*/files/backup_migrate/ {
  203. access_log off;
  204. deny all;
  205. }
  206.  
  207. ###
  208. ### Include local configuration override if exists.
  209. ###
  210. include /data/disk/EDIT_USER/config/server_master/nginx/post.d/nginx_vhost_include*;
  211.  
  212. ###
  213. ### Private downloads are always sent to the drupal backend.
  214. ### Note: this location doesn't work with X-Accel-Redirect.
  215. ###
  216. location ~* ^/sites/.*/files/private/ {
  217. access_log off;
  218. rewrite ^/sites/.*/files/private/(.*)$ $scheme://$host/system/files/private/$1 permanent;
  219. add_header X-Header "Private Generator 1.0a";
  220. try_files $uri @drupal;
  221. }
  222.  
  223. ###
  224. ### Deny direct access to private downloads in sites/domain/private.
  225. ### Note: this location works with X-Accel-Redirect.
  226. ###
  227. location ~* ^/sites/.*/private/ {
  228. access_log off;
  229. internal;
  230. }
  231.  
  232. ###
  233. ### Deny direct access to private downloads also for short, rewritten URLs.
  234. ### Note: this location works with X-Accel-Redirect.
  235. ###
  236. location ~* /files/private/ {
  237. access_log off;
  238. internal;
  239. }
  240.  
  241. ###
  242. ### Advagg_css and Advagg_js support.
  243. ###
  244. location ~* files/advagg_(?:css|js)/ {
  245. access_log off;
  246. expires 365d;
  247. limit_conn gulag 50;
  248. rewrite ^/files/advagg_(.*)/(.*)$ /sites/$host/files/advagg_$1/$2 last;
  249. add_header Pragma "";
  250. add_header Accept-Ranges "";
  251. add_header Cache-Control "public";
  252. add_header X-Header "AdvAgg Generator 1.0";
  253. try_files $uri @drupal;
  254. }
  255.  
  256. ###
  257. ### Make css files compatible with boost caching.
  258. ###
  259. location ~* \.css$ {
  260. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  261. return 405;
  262. }
  263. if ( $http_cookie ~ "DRUPAL_UID" ) {
  264. return 405;
  265. }
  266. error_page 405 = @uncached;
  267. access_log off;
  268. tcp_nodelay off;
  269. expires max; #if using aggregator
  270. add_header X-Header "Boost Citrus 2.1";
  271. try_files /cache/perm/$host${uri}_.css $uri =404;
  272. }
  273.  
  274. ###
  275. ### Make js files compatible with boost caching.
  276. ###
  277. location ~* \.(?:js|htc)$ {
  278. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  279. return 405;
  280. }
  281. if ( $http_cookie ~ "DRUPAL_UID" ) {
  282. return 405;
  283. }
  284. error_page 405 = @uncached;
  285. access_log off;
  286. tcp_nodelay off;
  287. expires max; # if using aggregator
  288. add_header X-Header "Boost Citrus 2.2";
  289. try_files /cache/perm/$host${uri}_.js $uri =404;
  290. }
  291.  
  292. ###
  293. ### Make json compatible with boost caching.
  294. ###
  295. location ~* \.json$ {
  296. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  297. return 405;
  298. }
  299. if ( $http_cookie ~ "DRUPAL_UID" ) {
  300. return 405;
  301. }
  302. error_page 405 = @uncached;
  303. access_log off;
  304. tcp_nodelay off;
  305. expires max; ### if using aggregator
  306. add_header X-Header "Boost Citrus 2.3";
  307. try_files /cache/$device/$host${uri}_.json $uri =404;
  308. }
  309.  
  310. ###
  311. ### Helper location to bypass boost static files cache for logged in users.
  312. ###
  313. location @uncached {
  314. access_log off;
  315. expires max; # max if using aggregator, otherwise sane expire time
  316. }
  317.  
  318. ###
  319. ### Serve & no-log static files & images directly,
  320. ### without all standard drupal rewrites, php-fpm etc.
  321. ###
  322. location ~* ^.+\.(?:jpe?g|gif|png|ico|bmp|svg|swf|pdf|docx?|xlsx?|pptx?|tiff?|txt|rtf|cgi|bat|pl|dll|aspx?|exe|class|otf|ttf|woff)$ {
  323. access_log off;
  324. tcp_nodelay off;
  325. expires 30d;
  326. # allow files/images/downloads to be accessed without /sites/fqdn/
  327. rewrite ^/files/(.*)$ /sites/$host/files/$1 last;
  328. rewrite ^/images/(.*)$ /sites/$host/files/images/$1 last;
  329. rewrite ^/downloads/(.*)$ /sites/$host/files/downloads/$1 last;
  330. rewrite ^/.+/sites/.+/files/(.*)$ /sites/$host/files/$1 last;
  331. try_files $uri =404;
  332. }
  333.  
  334. ###
  335. ### Serve & log bigger media/static/archive files directly,
  336. ### without all standard drupal rewrites, php-fpm etc.
  337. ###
  338. location ~* ^.+\.(?:avi|mpe?g|mov|wmv|mp3|mp4|m4a|ogg|ogv|flv|wav|midi|zip|tar|t?gz|rar)$ {
  339. expires 30d;
  340. tcp_nodelay off;
  341. # allow files/downloads to be accessed without /sites/fqdn/
  342. rewrite ^/files/(.*)$ /sites/$host/files/$1 last;
  343. rewrite ^/downloads/(.*)$ /sites/$host/files/downloads/$1 last;
  344. rewrite ^/.+/sites/.+/files/(.*)$ /sites/$host/files/$1 last;
  345. try_files $uri =404;
  346. }
  347.  
  348. ###
  349. ### Serve & no-log some static files as is, without forcing default_type.
  350. ###
  351. location ~* /(?:cross-?domain)\.xml$ {
  352. access_log off;
  353. tcp_nodelay off;
  354. expires 30d;
  355. add_header X-Header "XML Generator 1.0";
  356. try_files $uri =404;
  357. }
  358.  
  359. ###
  360. ### Allow some known php files (like serve.php in the ad module).
  361. ###
  362. location ~* ^/sites/.*/(?:modules|libraries)/(?:contrib/)?(?:ad|tinybrowser|f?ckeditor|tinymce|wysiwyg_spellcheck|ecc|civicrm|fbconnect)/.*\.php$ {
  363. access_log off;
  364. try_files $uri =404;
  365. fastcgi_pass 127.0.0.1:9000; ### php-fpm listening on port 9000
  366. }
  367.  
  368. ###
  369. ### Serve & no-log static helper files used in some wysiwyg editors.
  370. ###
  371. location ~* ^/sites/.*/(?:modules|libraries)/(?:tinybrowser|f?ckeditor|tinymce)/.*\.(?:html?|xml)$ {
  372. access_log off;
  373. tcp_nodelay off;
  374. expires 30d;
  375. try_files $uri =404;
  376. }
  377.  
  378. ###
  379. ### Serve & no-log any not specified above static files directly.
  380. ###
  381. location ~* ^/sites/.*/files/ {
  382. access_log off;
  383. tcp_nodelay off;
  384. expires 30d;
  385. try_files $uri =404;
  386. }
  387.  
  388. ###
  389. ### Make feeds compatible with boost caching and set correct mime type.
  390. ###
  391. location ~* \.xml$ {
  392. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  393. return 405;
  394. }
  395. if ( $http_cookie ~ "DRUPAL_UID" ) {
  396. return 405;
  397. }
  398. error_page 405 = @drupal;
  399. access_log off;
  400. add_header Expires "Tue, 24 Jan 1984 08:00:00 GMT";
  401. add_header Cache-Control "must-revalidate, post-check=0, pre-check=0";
  402. add_header X-Header "Boost Citrus 2.4";
  403. charset utf-8;
  404. types { }
  405. default_type application/rss+xml;
  406. try_files /cache/$device/$host${uri}_.xml /cache/$device/$host${uri}_.html $uri @drupal;
  407. }
  408.  
  409. ###
  410. ### Make feeds compatible with Boost caching and set correct mime type.
  411. ###
  412. location ~* /feed {
  413. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  414. return 405;
  415. }
  416. if ( $http_cookie ~ "DRUPAL_UID" ) {
  417. return 405;
  418. }
  419. error_page 405 = @drupal;
  420. access_log off;
  421. add_header Expires "Tue, 24 Jan 1984 08:00:00 GMT";
  422. add_header Cache-Control "must-revalidate, post-check=0, pre-check=0";
  423. add_header X-Header "Boost Citrus 2.5";
  424. charset utf-8;
  425. types { }
  426. default_type application/rss+xml;
  427. try_files /cache/$device/$host${uri}_.xml /cache/$device/$host${uri}_.html $uri @drupal;
  428. }
  429.  
  430. ###
  431. ### Deny phpinfo details display.
  432. ###
  433. location ~* /devel/(?:phpinfo|php) {
  434. access_log off;
  435. rewrite ^ $scheme://$host/admin/reports/status permanent;
  436. }
  437.  
  438. ###
  439. ### Deny bots on never cached uri without 403 response.
  440. ###
  441. location ~* ^/(?:.*/)?(?:user|cart|checkout|logout) {
  442. if ($is_bot) {
  443. return 444;
  444. }
  445. access_log off;
  446. try_files $uri @cache;
  447. }
  448.  
  449. ###
  450. ### Deny bots on never cached uri without 403 response - og compatible.
  451. ###
  452. location ~* /(?:node/[0-9]+/edit|node/add|comment/reply|approve|users) {
  453. if ($is_bot) {
  454. return 444;
  455. }
  456. access_log off;
  457. try_files $uri @cache;
  458. }
  459.  
  460. ###
  461. ### Catch all unspecified requests.
  462. ###
  463. location / {
  464. if ( $http_user_agent ~* wget ) {
  465. return 444;
  466. }
  467. try_files $uri @cache;
  468. }
  469.  
  470. ###
  471. ### Boost compatible cache check.
  472. ###
  473. location @cache {
  474. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  475. return 405;
  476. }
  477. if ( $http_cookie ~ "DRUPAL_UID" ) {
  478. return 405;
  479. }
  480. error_page 405 = @drupal;
  481. add_header Expires "Tue, 24 Jan 1984 08:00:00 GMT";
  482. add_header Cache-Control "must-revalidate, post-check=0, pre-check=0";
  483. add_header X-Header "Boost Citrus 1.9";
  484. charset utf-8;
  485. try_files /cache/$device/$host${uri}_$args.html @drupal;
  486. }
  487.  
  488. ###
  489. ### Send all not cached requests to drupal with clean URLs support.
  490. ###
  491. location @drupal {
  492. rewrite ^/(.*)$ /index.php?q=$1 last;
  493. }
  494.  
  495. ###
  496. ### Send all non-static requests to php-fpm, restricted to known php file.
  497. ###
  498. location ~* ^/index\.php$ {
  499. add_header X-Header "Barracuda Engine 1.0 Turbo";
  500. add_header X-Device "$device";
  501. try_files $uri =404; ### check for existence of php file first
  502. fastcgi_pass 127.0.0.1:9000; ### php-fpm listening on port 9000
  503. track_uploads uploads 60s; ### required for upload progress
  504. ###
  505. ### use Nginx cache for all visitors
  506. ###
  507. if ( $request_method ~ ^(?:HEAD|POST)$ ) {
  508. set $nocache "Y";
  509. }
  510. fastcgi_cache speed;
  511. fastcgi_cache_min_uses 1;
  512. fastcgi_cache_key "$device$host$key_uri$cookie_OctopusCacheID";
  513. fastcgi_cache_valid 200 301 302 50m;
  514. fastcgi_cache_valid 404 1m;
  515. fastcgi_ignore_headers Cache-Control Expires;
  516. fastcgi_pass_header Set-Cookie;
  517. fastcgi_pass_header X-Accel-Expires;
  518. fastcgi_pass_header X-Accel-Redirect;
  519. fastcgi_no_cache $cookie_OctopusNoCacheID;
  520. fastcgi_no_cache $nocache;
  521. fastcgi_cache_bypass $cookie_OctopusNoCacheID;
  522. fastcgi_cache_bypass $nocache;
  523. fastcgi_cache_use_stale error timeout invalid_header http_500 http_503 updating;
  524. }
  525.  
  526. ###
  527. ### Send other known php requests/files to php-fpm without any caching.
  528. ###
  529. location ~* ^/(?:boost_stats|update|authorize|rtoc|xmlrpc)\.php$ {
  530. access_log off;
  531. try_files $uri =404; ### check for existence of php file first
  532. fastcgi_pass 127.0.0.1:9000; ### php-fpm listening on port 9000
  533. }
  534.  
  535. ###
  536. ### Deny access to any not listed above php files.
  537. ###
  538. location ~* ^.+\.php$ {
  539. deny all;
  540. }
  541.  
  542. #######################################################
  543. ### nginx.conf site standard vhost include end
  544. #######################################################
  545.  
  546.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!