API tools faq
paste
Guest User

Untitled

a guest
Sep 5th, 2011
129
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.35 KB | None | 0 0
raw download clone embed print report
  1. #######################################################
  2. ### nginx.conf site standard vhost include start
  3. #######################################################
  4.  
  5. ###
  6. ### Deny crawlers without 403 response.
  7. ###
  8. if ( $http_user_agent ~* (?:HTTrack|HTMLParser|libwww|PECL|AutomaticSiteMap|ClickSense|ValueClick|SiteBot|BuzzTracker|sistrix|Offline) ) {
  9. return 444;
  10. }
  11.  
  12. ###
  13. ### Deny not compatible request methods without 405 response.
  14. ###
  15. if ( $request_method !~ ^(?:GET|HEAD|POST)$ ) {
  16. return 444;
  17. }
  18.  
  19. ###
  20. ### If favicon else return error 204.
  21. ###
  22. location ^~ /favicon.ico {
  23. access_log off;
  24. expires 30d;
  25. try_files /sites/$host/files/favicon.ico $uri =204;
  26. }
  27.  
  28. ###
  29. ### Support for http://drupal.org/project/robotstxt module
  30. ### and static file in the sites/domain/files directory.
  31. ###
  32. location ^~ /robots.txt {
  33. access_log off;
  34. try_files /sites/$host/files/robots.txt $uri @cache;
  35. }
  36.  
  37. ###
  38. ### Allow local access to support wget method in Aegir settings
  39. ### for running sites cron.
  40. ###
  41. location ^~ /cron.php {
  42. access_log off;
  43. allow 209.147.126.116;
  44. deny all;
  45. try_files $uri =404;
  46. fastcgi_pass 127.0.0.1:9000; ### php-fpm listening on port 9000
  47. }
  48.  
  49. ###
  50. ### Send search to php-fpm early so searching for node.js will work.
  51. ### Deny bots on search uri without 403 response.
  52. ###
  53. location ^~ /search {
  54. if ( $http_user_agent ~* (?:crawl|goog|yahoo|spider|bot|tracker|click|parser) ) {
  55. return 444;
  56. }
  57. try_files $uri @cache;
  58. }
  59.  
  60. ###
  61. ### Upload progress support.
  62. ### http://drupal.org/project/filefield_nginx_progress
  63. ### http://github.com/masterzen/nginx-upload-progress-module
  64. ###
  65. location ~ (?:.*)/x-progress-id:(?:\w*) {
  66. access_log off;
  67. rewrite ^(.*)/x-progress-id:(\w*) $1?X-Progress-ID=$2;
  68. }
  69. location ^~ /progress {
  70. access_log off;
  71. report_uploads uploads;
  72. }
  73.  
  74. ###
  75. ### Deny access to Hostmaster web/db server node.
  76. ### It is still possible to edit or break web/db server
  77. ### node at /node/2/edit, if you know what are you doing.
  78. ###
  79. location ^~ /hosting/c/server_master {
  80. access_log off;
  81. rewrite ^ $scheme://$host/hosting/sites permanent;
  82. }
  83.  
  84. ###
  85. ### Deny access to Hostmaster db server node.
  86. ### It is still possible to edit or break db server
  87. ### node at /node/4/edit, if you know what are you doing.
  88. ###
  89. location ^~ /hosting/c/server_localhost {
  90. access_log off;
  91. rewrite ^ $scheme://$host/hosting/sites permanent;
  92. }
  93.  
  94. ###
  95. ### Fix for Aegir & .info .pl domain extensions.
  96. ###
  97. location ^~ /hosting {
  98. access_log off;
  99. try_files $uri @cache;
  100. }
  101.  
  102. ###
  103. ### Deny php env display d6 & d7.
  104. ###
  105. location ^~ /admin/reports/status/ {
  106. access_log off;
  107. rewrite ^ $scheme://$host/admin/reports/status permanent;
  108. }
  109.  
  110. ###
  111. ### Deny php env display d5.
  112. ###
  113. location ^~ /admin/logs/status/ {
  114. access_log off;
  115. rewrite ^ $scheme://$host/admin/logs/status permanent;
  116. }
  117.  
  118. ###
  119. ### Deny cache details display.
  120. ###
  121. location ^~ /admin/reports/cache {
  122. access_log off;
  123. rewrite ^ $scheme://$host/admin/reports/status permanent;
  124. }
  125.  
  126. ###
  127. ### Support for backup_migrate module download/restore/delete actions.
  128. ###
  129. location ^~ /admin {
  130. if ( $http_user_agent ~* (?:crawl|goog|yahoo|spider|bot|tracker|click|parser) ) {
  131. return 444;
  132. }
  133. access_log off;
  134. try_files $uri @cache;
  135. }
  136.  
  137. ###
  138. ### Deny listed requests for security reasons without 403 response.
  139. ###
  140. location ~* (/\..*|settings\.php$|\.(?:git|htaccess|engine|inc|info|install|module|profile|pl|po|sh|.*sql|theme|tpl(?:\.php)?|xtmpl)$|^(?:Entries.*|Repository|Root|Tag|Template))$ {
  141. return 444;
  142. }
  143.  
  144. ###
  145. ### Deny some not supported URI like cgi-bin on the Nginx level.
  146. ###
  147. location ~* (?:cgi-bin|vti-bin) {
  148. access_log off;
  149. return 444;
  150. }
  151.  
  152. ###
  153. ### Deny bots on some weak modules uri without 403 response.
  154. ###
  155. location ~* (?:calendar|event|validation) {
  156. if ( $http_user_agent ~* (?:crawl|goog|yahoo|spider|bot) ) {
  157. return 444;
  158. }
  159. try_files $uri @cache;
  160. }
  161.  
  162. ###
  163. ### Imagecache and imagecache_external support.
  164. ###
  165. location ~* /(?:external|system|files/imagecache|files/styles)/ {
  166. access_log off;
  167. expires 30d;
  168. # fix common problems with old paths after import from standalone to Aegir multisite
  169. rewrite ^/sites/(.*)/files/imagecache/(.*)/sites/default/files/(.*)$ /sites/$host/files/imagecache/$2/$3 last;
  170. rewrite ^/files/imagecache/(.*)$ /sites/$host/files/imagecache/$1 last;
  171. rewrite ^/files/styles/(.*)$ /sites/$host/files/styles/$1 last;
  172. add_header X-Header "IC Generator 1.0";
  173. try_files $uri @drupal;
  174. }
  175.  
  176. ###
  177. ### Deny direct access to backups.
  178. ###
  179. location ~* ^/sites/.*/files/backup_migrate/ {
  180. access_log off;
  181. deny all;
  182. }
  183.  
  184. ###
  185. ### Include local configuration override if exists.
  186. ###
  187. include /data/disk/EDIT_USER/config/server_master/nginx/post.d/nginx_vhost_include*;
  188.  
  189. ###
  190. ### Private downloads are always sent to the drupal backend.
  191. ### Note: this location doesn't work with X-Accel-Redirect.
  192. ###
  193. location ~* ^/sites/.*/files/private/ {
  194. access_log off;
  195. rewrite ^/sites/.*/files/private/(.*)$ $scheme://$host/system/files/private/$1 permanent;
  196. add_header X-Header "Private Generator 1.0a";
  197. try_files $uri @drupal;
  198. }
  199.  
  200. ###
  201. ### Deny direct access to private downloads in sites/domain/private.
  202. ### Note: this location works with X-Accel-Redirect.
  203. ###
  204. location ~* ^/sites/.*/private/ {
  205. access_log off;
  206. internal;
  207. }
  208.  
  209. ###
  210. ### Deny direct access to private downloads also for short, rewritten URLs.
  211. ### Note: this location works with X-Accel-Redirect.
  212. ###
  213. location ~* /files/private/ {
  214. access_log off;
  215. internal;
  216. }
  217.  
  218. ###
  219. ### Advagg_css and Advagg_js support.
  220. ###
  221. location ~* files/advagg_(?:css|js)/ {
  222. access_log off;
  223. expires 365d;
  224. limit_conn gulag 50;
  225. rewrite ^/files/advagg_(.*)/(.*)$ /sites/$host/files/advagg_$1/$2 last;
  226. add_header Pragma "";
  227. add_header Cache-Control "public";
  228. add_header X-Header "AdvAgg Generator 1.0";
  229. try_files $uri @drupal;
  230. }
  231.  
  232. ###
  233. ### Make css files compatible with boost caching.
  234. ###
  235. location ~* \.css$ {
  236. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  237. return 405;
  238. }
  239. if ( $http_cookie ~ "DRUPAL_UID" ) {
  240. return 405;
  241. }
  242. error_page 405 = @uncached;
  243. access_log off;
  244. tcp_nodelay off;
  245. expires max; #if using aggregator
  246. add_header X-Header "Boost Citrus 2.1";
  247. try_files /cache/perm/$host${uri}_.css $uri =404;
  248. }
  249.  
  250. ###
  251. ### Make js files compatible with boost caching.
  252. ###
  253. location ~* \.(?:js|htc)$ {
  254. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  255. return 405;
  256. }
  257. if ( $http_cookie ~ "DRUPAL_UID" ) {
  258. return 405;
  259. }
  260. error_page 405 = @uncached;
  261. access_log off;
  262. tcp_nodelay off;
  263. expires max; # if using aggregator
  264. add_header X-Header "Boost Citrus 2.2";
  265. try_files /cache/perm/$host${uri}_.js $uri =404;
  266. }
  267.  
  268. ###
  269. ### Make json compatible with boost caching.
  270. ###
  271. location ~* \.json$ {
  272. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  273. return 405;
  274. }
  275. if ( $http_cookie ~ "DRUPAL_UID" ) {
  276. return 405;
  277. }
  278. error_page 405 = @uncached;
  279. access_log off;
  280. tcp_nodelay off;
  281. expires max; ### if using aggregator
  282. add_header X-Header "Boost Citrus 2.3";
  283. try_files /cache/normal/$host${uri}_.json $uri =404;
  284. }
  285.  
  286. ###
  287. ### Helper location to bypass boost static files cache for logged in users.
  288. ###
  289. location @uncached {
  290. access_log off;
  291. expires max; # max if using aggregator, otherwise sane expire time
  292. }
  293.  
  294. ###
  295. ### Serve & no-log static files & images directly,
  296. ### without all standard drupal rewrites, php-fpm etc.
  297. ###
  298. location ~* ^.+\.(?:jpe?g|gif|png|ico|bmp|svg|swf|pdf|docx?|xlsx?|pptx?|tiff?|txt|rtf|cgi|bat|pl|dll|aspx?|exe|class|otf|ttf|woff)$ {
  299. access_log off;
  300. tcp_nodelay off;
  301. expires 30d;
  302. # allow files/images/downloads to be accessed without /sites/fqdn/
  303. rewrite ^/files/(.*)$ /sites/$host/files/$1 last;
  304. rewrite ^/images/(.*)$ /sites/$host/files/images/$1 last;
  305. rewrite ^/downloads/(.*)$ /sites/$host/files/downloads/$1 last;
  306. rewrite ^/.+/sites/.+/files/(.*)$ /sites/$host/files/$1 last;
  307. try_files $uri =404;
  308. }
  309.  
  310. ###
  311. ### Serve & log bigger media/static/archive files directly,
  312. ### without all standard drupal rewrites, php-fpm etc.
  313. ###
  314. location ~* ^.+\.(?:avi|mpe?g|mov|wmv|mp3|mp4|m4a|ogg|flv|wav|midi|zip|tar|t?gz|rar)$ {
  315. expires 30d;
  316. tcp_nodelay off;
  317. # allow files/downloads to be accessed without /sites/fqdn/
  318. rewrite ^/files/(.*)$ /sites/$host/files/$1 last;
  319. rewrite ^/downloads/(.*)$ /sites/$host/files/downloads/$1 last;
  320. rewrite ^/.+/sites/.+/files/(.*)$ /sites/$host/files/$1 last;
  321. try_files $uri =404;
  322. }
  323.  
  324. ###
  325. ### Serve & no-log some static files as is, without forcing default_type.
  326. ###
  327. location ~* /(?:cross-?domain)\.xml$ {
  328. access_log off;
  329. tcp_nodelay off;
  330. expires 30d;
  331. add_header X-Header "XML Generator 1.0";
  332. try_files $uri =404;
  333. }
  334.  
  335. ###
  336. ### Allow some known php files (like serve.php in the ad module).
  337. ###
  338. location ~* ^/sites/.*/(?:modules|libraries)/(?:ad|tinybrowser|f?ckeditor|tinymce|wysiwyg_spellcheck|ecc|civicrm)/.*\.php$ {
  339. access_log off;
  340. try_files $uri =404;
  341. fastcgi_pass 127.0.0.1:9000; ### php-fpm listening on port 9000
  342. }
  343.  
  344. ###
  345. ### Serve & no-log static helper files used in some wysiwyg editors.
  346. ###
  347. location ~* ^/sites/.*/(?:modules|libraries)/(?:tinybrowser|f?ckeditor|tinymce)/.*\.(?:html?|xml)$ {
  348. access_log off;
  349. tcp_nodelay off;
  350. expires 30d;
  351. try_files $uri =404;
  352. }
  353.  
  354. ###
  355. ### Serve & no-log any not specified above static files directly.
  356. ###
  357. location ~* ^/sites/.*/files/ {
  358. access_log off;
  359. tcp_nodelay off;
  360. expires 30d;
  361. try_files $uri =404;
  362. }
  363.  
  364. ###
  365. ### Deny listed requests for security reasons without 403 response.
  366. ###
  367. location ~* (?:delete.+from|insert.+into|select.+from|union.+select|onload|\.php.+src|system\(.+|iframe|document\.cookie|\;|\.\.) {
  368. return 444;
  369. }
  370.  
  371. ###
  372. ### Make feeds compatible with boost caching and set correct mime type.
  373. ###
  374. location ~* \.xml$ {
  375. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  376. return 405;
  377. }
  378. if ( $http_cookie ~ "DRUPAL_UID" ) {
  379. return 405;
  380. }
  381. error_page 405 = @drupal;
  382. access_log off;
  383. add_header Expires "Tue, 24 Jan 1984 08:00:00 GMT";
  384. add_header Cache-Control "must-revalidate, post-check=0, pre-check=0";
  385. add_header X-Header "Boost Citrus 2.4";
  386. charset utf-8;
  387. types { }
  388. default_type application/rss+xml;
  389. try_files /cache/normal/$host${uri}_.xml /cache/normal/$host${uri}_.html $uri @drupal;
  390. }
  391.  
  392. ###
  393. ### Make feeds compatible with Boost caching and set correct mime type.
  394. ###
  395. location ^~ /feed {
  396. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  397. return 405;
  398. }
  399. if ( $http_cookie ~ "DRUPAL_UID" ) {
  400. return 405;
  401. }
  402. error_page 405 = @drupal;
  403. access_log off;
  404. add_header Expires "Tue, 24 Jan 1984 08:00:00 GMT";
  405. add_header Cache-Control "must-revalidate, post-check=0, pre-check=0";
  406. add_header X-Header "Boost Citrus 2.5";
  407. charset utf-8;
  408. types { }
  409. default_type application/rss+xml;
  410. try_files /cache/normal/$host${uri}_.xml /cache/normal/$host${uri}_.html $uri @drupal;
  411. }
  412.  
  413. ###
  414. ### Deny phpinfo details display.
  415. ###
  416. location ~* /devel/(?:phpinfo|php) {
  417. access_log off;
  418. rewrite ^ $scheme://$host/admin/reports/status permanent;
  419. }
  420.  
  421. ###
  422. ### Deny bots on never cached uri without 403 response.
  423. ###
  424. location ~* ^/(?:user|cart|checkout|logout) {
  425. if ( $http_user_agent ~* (?:crawl|goog|yahoo|spider|bot|tracker|click|parser) ) {
  426. return 444;
  427. }
  428. access_log off;
  429. try_files $uri @cache;
  430. }
  431.  
  432. ###
  433. ### Deny bots on never cached uri without 403 response - og compatible.
  434. ###
  435. location ~* /(?:node/[0-9]+/edit|node/add|comment/reply|approve|users) {
  436. if ( $http_user_agent ~* (?:crawl|goog|yahoo|spider|bot|tracker|click|parser) ) {
  437. return 444;
  438. }
  439. access_log off;
  440. try_files $uri @cache;
  441. }
  442.  
  443. ###
  444. ### Catch all unspecified requests.
  445. ###
  446. location / {
  447. if ( $http_user_agent ~* wget ) {
  448. return 444;
  449. }
  450. try_files $uri @cache;
  451. }
  452.  
  453. ###
  454. ### Boost compatible cache check.
  455. ###
  456. location @cache {
  457. if ( $request_method !~ ^(?:GET|HEAD)$ ) {
  458. return 405;
  459. }
  460. if ( $http_cookie ~ "DRUPAL_UID" ) {
  461. return 405;
  462. }
  463. error_page 405 = @drupal;
  464. add_header Expires "Tue, 24 Jan 1984 08:00:00 GMT";
  465. add_header Cache-Control "must-revalidate, post-check=0, pre-check=0";
  466. add_header X-Header "Boost Citrus 1.9";
  467. charset utf-8;
  468. try_files /cache/normal/$host${uri}_$args.html @drupal;
  469. }
  470.  
  471. ###
  472. ### Send all not cached requests to drupal with clean URLs support.
  473. ###
  474. location @drupal {
  475. rewrite ^/(.*)$ /index.php?q=$1 last;
  476. }
  477.  
  478. ###
  479. ### Send all non-static requests to php-fpm, restricted to known php file.
  480. ###
  481. location ~* ^/(?:index)\.php$ {
  482. add_header X-Header "Barracuda Engine 1.0 Turbo";
  483. try_files $uri =404; ### check for existence of php file first
  484. fastcgi_pass 127.0.0.1:9000; ### php-fpm listening on port 9000
  485. track_uploads uploads 60s; ### required for upload progress
  486. ###
  487. ### use Nginx cache for all visitors
  488. ###
  489. if ( $request_method ~ ^(?:HEAD|POST)$ ) {
  490. set $nocache "Y";
  491. }
  492. fastcgi_cache speed;
  493. fastcgi_cache_min_uses 1;
  494. fastcgi_cache_key "$host$request_uri$cookie_OctopusCacheID";
  495. fastcgi_cache_valid 200 301 302 60m;
  496. fastcgi_cache_valid 404 1m;
  497. fastcgi_ignore_headers Cache-Control Expires;
  498. fastcgi_pass_header Set-Cookie;
  499. fastcgi_pass_header X-Accel-Expires;
  500. fastcgi_pass_header X-Accel-Redirect;
  501. fastcgi_no_cache $cookie_OctopusNoCacheID;
  502. fastcgi_no_cache $nocache;
  503. fastcgi_cache_bypass $cookie_OctopusNoCacheID;
  504. fastcgi_cache_bypass $nocache;
  505. fastcgi_cache_use_stale error timeout invalid_header http_500 http_503 updating;
  506. }
  507.  
  508. ###
  509. ### Send other known php requests/files to php-fpm without any caching.
  510. ###
  511. location ~* ^/(?:boost_stats|update|authorize|rtoc|xmlrpc)\.php$ {
  512. access_log off;
  513. try_files $uri =404; ### check for existence of php file first
  514. fastcgi_pass 127.0.0.1:9000; ### php-fpm listening on port 9000
  515. }
  516.  
  517. ###
  518. ### Deny access to any not listed above php files.
  519. ###
  520. location ~* ^.+\.php$ {
  521. deny all;
  522. }
  523.  
  524. #######################################################
  525. ### nginx.conf site standard vhost include end
  526. #######################################################
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!