... | ... | @@ -106,6 +106,88 @@ If someone clicks on an external link inside a survey, the website that link poi |
|
|
|
|
|
### Nginx
|
|
|
|
|
|
#### A working example
|
|
|
|
|
|
```nginx
|
|
|
server {
|
|
|
listen 80;
|
|
|
listen [::]:80;
|
|
|
server_name date.example.org;
|
|
|
return 301 https://$host$request_uri;
|
|
|
}
|
|
|
|
|
|
server {
|
|
|
listen 443 ssl http2;
|
|
|
listen [::]:443 ssl http2; # For ipv6 only
|
|
|
server_name date.example.org;
|
|
|
|
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://dev.stats.latoilescoute.net 'unsafe-inline' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' https://dev.stats.latoilescoute.net";
|
|
|
|
|
|
# Those ssl certificats is generated by letsencrypt, to create an certificat
|
|
|
# through lets encrypt information are available here https://certbot.eff.org/lets-encrypt/debianstretch-nginx
|
|
|
# For secure ssl configuration, look also at https://mozilla.github.io/server-side-tls/ssl-config-generator/
|
|
|
include /etc/letsencrypt/options-ssl-nginx.conf;
|
|
|
ssl_certificate /etc/letsencrypt/live/scoodle.latoilescoute.net/fullchain.pem;
|
|
|
ssl_certificate_key /etc/letsencrypt/live/scoodle.latoilescoute.net/privkey.pem;
|
|
|
|
|
|
|
|
|
access_log /var/log/nginx/date.example.org.access.log;
|
|
|
error_log /var/log/nginx/date.example.org.error.log;
|
|
|
|
|
|
root /path/to/your/framadate;
|
|
|
|
|
|
index index.php;
|
|
|
|
|
|
location ~^/(\.git)/{
|
|
|
deny all;
|
|
|
}
|
|
|
location ~ /\. {
|
|
|
deny all;
|
|
|
}
|
|
|
|
|
|
location ~ ^/composer\.json.*$|^/composer\.lock.*$|^/php\.ini.*$|^/.*\.sh {
|
|
|
deny all;
|
|
|
}
|
|
|
|
|
|
location /admin/ {
|
|
|
auth_basic "Restricted access";
|
|
|
auth_basic_user_file /path/to/framadate/admin/.htpasswd;
|
|
|
|
|
|
location ~ \.php$ {
|
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
|
include /etc/nginx/fastcgi_params;
|
|
|
fastcgi_pass unix:/run/php/php7.0-fpm.sock;
|
|
|
}
|
|
|
try_files $uri $uri/ =401;
|
|
|
}
|
|
|
|
|
|
location / {
|
|
|
rewrite "^/admin$" "/admin/" last;
|
|
|
|
|
|
# Clean URL
|
|
|
rewrite "^/([a-zA-Z0-9]+)$" "/studs.php?poll=$1" last;
|
|
|
rewrite "^/([a-zA-Z0-9]+)/action/([a-zA-Z_-]+)/(.+)$" "/studs.php?poll=$1&$2=$3" last;
|
|
|
rewrite "^/([a-zA-Z0-9]+)/vote/([a-zA-Z0-9]{16})$" "/studs.php?poll=$1&vote=$2" last;
|
|
|
rewrite "^/([a-zA-Z0-9]{24})/admin$" "/adminstuds.php?poll=$1" last;
|
|
|
rewrite "^/([a-zA-Z0-9]{24})/admin/vote/([a-zA-Z0-9]{16})$" "/adminstuds.php?poll=$1&vote=$2" last;
|
|
|
rewrite "^/([a-zA-Z0-9]{24})/admin/action/([a-zA-Z_-]+)(/([A-Za-z0-9]+))?$" "/adminstuds.php?poll=$1&$2=$4" last;
|
|
|
try_files $uri /index.php;
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
location ~ \.php$ {
|
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
|
fastcgi_index index.php;
|
|
|
include /etc/nginx/fastcgi_params;
|
|
|
fastcgi_pass unix:/run/php/php7.0-fpm.sock;
|
|
|
}
|
|
|
}
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#### Secure server
|
|
|
##### Content Security Policy
|
... | ... | |