server { listen 80; listen [::]:80; server_name framadate-api.cipherbliss.com; # enforce https return 301 https://$server_name$request_uri; } server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name framadate-api.cipherbliss.com; # Use Mozilla's guidelines for SSL/TLS settings # https://mozilla.github.io/server-side-tls/ssl-config-generator/ # Path to the root of your installation root /home/www/tykayn/cipherbliss/framadate/; location / { # try to serve file directly, fallback to index.html to see the frontend of funky framadate try_files $uri /index.html$is_args$args; # handle OPTIONS requests # @note: don't try to DRY out this "if" block, or you're gonna have a bad time. # @see: http://wiki.nginx.org/IfIsEvil if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since'; add_header 'Access-Control-Allow-Methods' 'GET, DELETE, OPTIONS, POST, PUT'; add_header 'Access-Control-Allow-Origin' 'https://framadate-api.cipherbliss.com'; add_header 'Access-Control-Max-Age' 2592000; add_header 'Content-Length' 0; add_header 'Content-Type' 'text/plain charset=UTF-8'; return 204; } # send the CORS headers add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Origin' 'https://framadate-api.cipherbliss.com'; # set additional security headers add_header 'Cache-Control' 'no-cache, no-store, must-revalidate'; add_header 'Content-Security-Policy' 'connect-src framadate-api.cipherbliss.com'; add_header 'Expires' '0'; add_header 'Pragma' 'no-cache'; add_header 'Strict-Transport-Security' 'max-age=31536000; includeSubDomains'; add_header 'X-Content-Type-Options' 'nosniff'; add_header 'X-Frame-Options' 'DENY'; add_header 'X-XSS-Protection' '1; mode=block'; } location = /favicon.ico { log_not_found off; access_log off; } location = /robots.txt { allow all; log_not_found off; access_log off; } location ~* \.(png|jpg|jpeg|gif|ico)$ { expires max; log_not_found off; } # PROD location ~ ^/app\.php(/|$) { include fastcgi.conf; fastcgi_intercept_errors on; fastcgi_pass php-handler; # When you are using symlinks to link the document root to the # current version of your application, you should pass the real # application path instead of the path to the symlink to PHP # FPM. # Otherwise, PHP's OPcache may not properly detect changes to # your PHP files (see https://github.com/zendtech/ZendOptimizerPlus/issues/126 # for more information). fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name; fastcgi_param DOCUMENT_ROOT $realpath_root; # Prevents URIs that include the front controller. This will 404: # http://domain.tld/app.php/some-path # Remove the internal directive to allow URIs like this internal; } # return 404 for all other php files not matching the front controller # this prevents access to other php files you don't want to be accessible. location ~ \.php$ { return 404; } }