adphi/Nextcloud-Docker
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

examples: docker-compose: Update nginx configs (#912)

Browse Source 
* examples: docker-compose: insecure: postgres: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: insecure: mariadb-cron-redis: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: insecure: mariadb: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: with-nginx-proxy: mariadb: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: with-nginx-proxy: mariadb-cron-redis: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: with-nginx-proxy: postgres: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: with-nginx-proxy-self-signed-ssl: mariadb: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>
This commit is contained in:
alexschroth 2019-11-07 20:30:48 +01:00 committed by J0WI
parent 6a173a4daa
commit 269a081138
7 changed files with 308 additions and 224 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
.examples/docker-compose/insecure/mariadb-cron-redis/fpm/web/nginx.conf
View File

@ -36,21 +36,25 @@ http {
# Add headers to serve security related headers # Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this # Before enabling Strict-Transport-Security headers please read into this
# topic first. # topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Path to the root of your installation
root /var/www/html; root /var/www/html;
location = /robots.txt { location = /robots.txt {
@ -62,14 +66,18 @@ http {
# The following 2 rules are only needed for the user_webfinger app. # The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app. # Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last; #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
# last;
# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
location = /.well-known/carddav { location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
location = /.well-known/caldav { location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
# set max upload size # set max upload size
@ -89,68 +97,72 @@ http {
#pagespeed off; #pagespeed off;
location / { location / {
rewrite ^ /index.php$request_uri; rewrite ^ /index.php;
} }
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all; deny all;
} }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all; deny all;
} }
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) { location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params; include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param PATH_INFO $path_info;
# fastcgi_param HTTPS on; # fastcgi_param HTTPS on;
# Avoid sending the security headers twice # Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true; fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true; fastcgi_param front_controller_active true;
fastcgi_pass php-handler; fastcgi_pass php-handler;
fastcgi_intercept_errors on; fastcgi_intercept_errors on;
fastcgi_request_buffering off; fastcgi_request_buffering off;
} }
location ~ ^/(?:updater|ocs-provider)(?:$|/) { location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404; try_files $uri/ =404;
index index.php; index index.php;
} }
# Adding the cache control header for js and css files # Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block # Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif)$ { location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463"; add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to # Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above) # have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into # Before enabling Strict-Transport-Security headers please read into
# this topic first. # this topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets # Optional: Don't log access to assets
access_log off; access_log off;
} }
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ { location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets # Optional: Don't log access to other assets
access_log off; access_log off;
} }
} }
} }

74
.examples/docker-compose/insecure/mariadb/fpm/web/nginx.conf
View File

@ -36,21 +36,25 @@ http {
# Add headers to serve security related headers # Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this # Before enabling Strict-Transport-Security headers please read into this
# topic first. # topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Path to the root of your installation
root /var/www/html; root /var/www/html;
location = /robots.txt { location = /robots.txt {
@ -62,14 +66,18 @@ http {
# The following 2 rules are only needed for the user_webfinger app. # The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app. # Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last; #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
# last;
# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
location = /.well-known/carddav { location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
location = /.well-known/caldav { location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
# set max upload size # set max upload size
@ -89,68 +97,72 @@ http {
#pagespeed off; #pagespeed off;
location / { location / {
rewrite ^ /index.php$request_uri; rewrite ^ /index.php;
} }
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all; deny all;
} }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all; deny all;
} }
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) { location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params; include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param PATH_INFO $path_info;
# fastcgi_param HTTPS on; # fastcgi_param HTTPS on;
# Avoid sending the security headers twice # Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true; fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true; fastcgi_param front_controller_active true;
fastcgi_pass php-handler; fastcgi_pass php-handler;
fastcgi_intercept_errors on; fastcgi_intercept_errors on;
fastcgi_request_buffering off; fastcgi_request_buffering off;
} }
location ~ ^/(?:updater|ocs-provider)(?:$|/) { location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404; try_files $uri/ =404;
index index.php; index index.php;
} }
# Adding the cache control header for js and css files # Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block # Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif)$ { location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463"; add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to # Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above) # have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into # Before enabling Strict-Transport-Security headers please read into
# this topic first. # this topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets # Optional: Don't log access to assets
access_log off; access_log off;
} }
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ { location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets # Optional: Don't log access to other assets
access_log off; access_log off;
} }
} }
} }

74
.examples/docker-compose/insecure/postgres/fpm/web/nginx.conf
View File

@ -36,21 +36,25 @@ http {
# Add headers to serve security related headers # Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this # Before enabling Strict-Transport-Security headers please read into this
# topic first. # topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Path to the root of your installation
root /var/www/html; root /var/www/html;
location = /robots.txt { location = /robots.txt {
@ -62,14 +66,18 @@ http {
# The following 2 rules are only needed for the user_webfinger app. # The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app. # Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last; #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
# last;
# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
location = /.well-known/carddav { location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
location = /.well-known/caldav { location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
# set max upload size # set max upload size
@ -89,68 +97,72 @@ http {
#pagespeed off; #pagespeed off;
location / { location / {
rewrite ^ /index.php$request_uri; rewrite ^ /index.php;
} }
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all; deny all;
} }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all; deny all;
} }
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) { location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params; include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param PATH_INFO $path_info;
# fastcgi_param HTTPS on; # fastcgi_param HTTPS on;
# Avoid sending the security headers twice # Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true; fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true; fastcgi_param front_controller_active true;
fastcgi_pass php-handler; fastcgi_pass php-handler;
fastcgi_intercept_errors on; fastcgi_intercept_errors on;
fastcgi_request_buffering off; fastcgi_request_buffering off;
} }
location ~ ^/(?:updater|ocs-provider)(?:$|/) { location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404; try_files $uri/ =404;
index index.php; index index.php;
} }
# Adding the cache control header for js and css files # Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block # Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif)$ { location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463"; add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to # Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above) # have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into # Before enabling Strict-Transport-Security headers please read into
# this topic first. # this topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets # Optional: Don't log access to assets
access_log off; access_log off;
} }
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ { location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets # Optional: Don't log access to other assets
access_log off; access_log off;
} }
} }
} }

74
.examples/docker-compose/with-nginx-proxy-self-signed-ssl/mariadb/fpm/web/nginx.conf
View File

@ -41,21 +41,25 @@ http {
# Add headers to serve security related headers # Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this # Before enabling Strict-Transport-Security headers please read into this
# topic first. # topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Path to the root of your installation
root /var/www/html; root /var/www/html;
location = /robots.txt { location = /robots.txt {
@ -67,14 +71,18 @@ http {
# The following 2 rules are only needed for the user_webfinger app. # The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app. # Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last; #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
# last;
# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
location = /.well-known/carddav { location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
location = /.well-known/caldav { location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
# set max upload size # set max upload size
@ -94,68 +102,72 @@ http {
#pagespeed off; #pagespeed off;
location / { location / {
rewrite ^ /index.php$request_uri; rewrite ^ /index.php;
} }
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all; deny all;
} }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all; deny all;
} }
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) { location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params; include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param PATH_INFO $path_info;
# fastcgi_param HTTPS on; # fastcgi_param HTTPS on;
# Avoid sending the security headers twice # Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true; fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true; fastcgi_param front_controller_active true;
fastcgi_pass php-handler; fastcgi_pass php-handler;
fastcgi_intercept_errors on; fastcgi_intercept_errors on;
fastcgi_request_buffering off; fastcgi_request_buffering off;
} }
location ~ ^/(?:updater|ocs-provider)(?:$|/) { location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404; try_files $uri/ =404;
index index.php; index index.php;
} }
# Adding the cache control header for js and css files # Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block # Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif)$ { location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463"; add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to # Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above) # have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into # Before enabling Strict-Transport-Security headers please read into
# this topic first. # this topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets # Optional: Don't log access to assets
access_log off; access_log off;
} }
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ { location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets # Optional: Don't log access to other assets
access_log off; access_log off;
} }
} }
} }

74
.examples/docker-compose/with-nginx-proxy/mariadb-cron-redis/fpm/web/nginx.conf
View File

@ -41,21 +41,25 @@ http {
# Add headers to serve security related headers # Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this # Before enabling Strict-Transport-Security headers please read into this
# topic first. # topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Path to the root of your installation
root /var/www/html; root /var/www/html;
location = /robots.txt { location = /robots.txt {
@ -67,14 +71,18 @@ http {
# The following 2 rules are only needed for the user_webfinger app. # The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app. # Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last; #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
# last;
# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
location = /.well-known/carddav { location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
location = /.well-known/caldav { location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
# set max upload size # set max upload size
@ -94,68 +102,72 @@ http {
#pagespeed off; #pagespeed off;
location / { location / {
rewrite ^ /index.php$request_uri; rewrite ^ /index.php;
} }
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all; deny all;
} }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all; deny all;
} }
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) { location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params; include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param PATH_INFO $path_info;
# fastcgi_param HTTPS on; # fastcgi_param HTTPS on;
# Avoid sending the security headers twice # Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true; fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true; fastcgi_param front_controller_active true;
fastcgi_pass php-handler; fastcgi_pass php-handler;
fastcgi_intercept_errors on; fastcgi_intercept_errors on;
fastcgi_request_buffering off; fastcgi_request_buffering off;
} }
location ~ ^/(?:updater|ocs-provider)(?:$|/) { location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404; try_files $uri/ =404;
index index.php; index index.php;
} }
# Adding the cache control header for js and css files # Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block # Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif)$ { location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463"; add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to # Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above) # have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into # Before enabling Strict-Transport-Security headers please read into
# this topic first. # this topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets # Optional: Don't log access to assets
access_log off; access_log off;
} }
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ { location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets # Optional: Don't log access to other assets
access_log off; access_log off;
} }
} }
} }

74
.examples/docker-compose/with-nginx-proxy/mariadb/fpm/web/nginx.conf
View File

@ -41,21 +41,25 @@ http {
# Add headers to serve security related headers # Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this # Before enabling Strict-Transport-Security headers please read into this
# topic first. # topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Path to the root of your installation
root /var/www/html; root /var/www/html;
location = /robots.txt { location = /robots.txt {
@ -67,14 +71,18 @@ http {
# The following 2 rules are only needed for the user_webfinger app. # The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app. # Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last; #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
# last;
# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
location = /.well-known/carddav { location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
location = /.well-known/caldav { location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
# set max upload size # set max upload size
@ -94,68 +102,72 @@ http {
#pagespeed off; #pagespeed off;
location / { location / {
rewrite ^ /index.php$request_uri; rewrite ^ /index.php;
} }
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all; deny all;
} }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all; deny all;
} }
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) { location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params; include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param PATH_INFO $path_info;
# fastcgi_param HTTPS on; # fastcgi_param HTTPS on;
# Avoid sending the security headers twice # Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true; fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true; fastcgi_param front_controller_active true;
fastcgi_pass php-handler; fastcgi_pass php-handler;
fastcgi_intercept_errors on; fastcgi_intercept_errors on;
fastcgi_request_buffering off; fastcgi_request_buffering off;
} }
location ~ ^/(?:updater|ocs-provider)(?:$|/) { location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404; try_files $uri/ =404;
index index.php; index index.php;
} }
# Adding the cache control header for js and css files # Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block # Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif)$ { location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463"; add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to # Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above) # have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into # Before enabling Strict-Transport-Security headers please read into
# this topic first. # this topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets # Optional: Don't log access to assets
access_log off; access_log off;
} }
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ { location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets # Optional: Don't log access to other assets
access_log off; access_log off;
} }
} }
} }

74
.examples/docker-compose/with-nginx-proxy/postgres/fpm/web/nginx.conf
View File

@ -41,21 +41,25 @@ http {
# Add headers to serve security related headers # Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this # Before enabling Strict-Transport-Security headers please read into this
# topic first. # topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Path to the root of your installation
root /var/www/html; root /var/www/html;
location = /robots.txt { location = /robots.txt {
@ -67,14 +71,18 @@ http {
# The following 2 rules are only needed for the user_webfinger app. # The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app. # Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last; #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
# last;
# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
location = /.well-known/carddav { location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
location = /.well-known/caldav { location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav; return 301 $scheme://$host:$server_port/remote.php/dav;
} }
# set max upload size # set max upload size
@ -94,68 +102,72 @@ http {
#pagespeed off; #pagespeed off;
location / { location / {
rewrite ^ /index.php$request_uri; rewrite ^ /index.php;
} }
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all; deny all;
} }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all; deny all;
} }
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) { location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params; include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param PATH_INFO $path_info;
# fastcgi_param HTTPS on; # fastcgi_param HTTPS on;
# Avoid sending the security headers twice # Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true; fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true; fastcgi_param front_controller_active true;
fastcgi_pass php-handler; fastcgi_pass php-handler;
fastcgi_intercept_errors on; fastcgi_intercept_errors on;
fastcgi_request_buffering off; fastcgi_request_buffering off;
} }
location ~ ^/(?:updater|ocs-provider)(?:$|/) { location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404; try_files $uri/ =404;
index index.php; index index.php;
} }
# Adding the cache control header for js and css files # Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block # Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif)$ { location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463"; add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to # Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above) # have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into # Before enabling Strict-Transport-Security headers please read into
# this topic first. # this topic first.
# add_header Strict-Transport-Security "max-age=15768000; #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# includeSubDomains; preload;";
# #
# WARNING: Only add the preload option once you read about # WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option # the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped # will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list # in all major browsers and getting removed from this list
# could take several months. # could take several months.
add_header X-Content-Type-Options nosniff; add_header Referrer-Policy "no-referrer" always;
add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff" always;
add_header X-Robots-Tag none; add_header X-Download-Options "noopen" always;
add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header Referrer-Policy no-referrer; add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets # Optional: Don't log access to assets
access_log off; access_log off;
} }
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ { location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets # Optional: Don't log access to other assets
access_log off; access_log off;
} }
} }
} }