-
Notifications
You must be signed in to change notification settings - Fork 0
/
default.conf
108 lines (88 loc) · 3.27 KB
/
default.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
# Protect against DoS
## Limit concurrent connections to 130, most browsers will open up lots of concurrent connections but will never go above 100.
limit_conn_zone $binary_remote_addr zone=limit_per_ip:10m;
limit_conn limit_per_ip 130;
## Limit requests up to 500 per second per ip
limit_req_zone $binary_remote_addr zone=allips:10m rate=500r/s;
limit_req zone=allips burst=400 nodelay;
## Return 429 when rate limiting instead of 503
limit_req_status 429;
limit_conn_status 429;
client_body_buffer_size 4k;
client_header_buffer_size 1k;
client_max_body_size 2k;
large_client_header_buffers 2 1k;
server {
listen 80;
listen [::]:80;
server_name asdfxyz.xyz, www.asdfxyz.xyz;
server_tokens off;
# for the SSL certificate
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
# redirect people on port 80 to 443
location / {
return 301 https://asdfxyz.xyz$request_uri;
}
}
server {
listen 443 default_server ssl http2;
listen [::]:443 ssl http2;
server_name asdfxyz.xyz;
server_tokens off;
ssl_certificate /etc/nginx/ssl/live/asdfxyz.xyz/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/asdfxyz.xyz/privkey.pem;
# Security headers
## Prevent MIME type sniffing, protects against certain XSS attacks
add_header X-Content-Type-Options nosniff;
## Disable depreciated XSS protection filter (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection)
add_header X-XSS-Protection "0";
## Prevent clickjacking attacks (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)
add_header X-Frame-Options DENY;
## Prevents data from being loaded in Adobe Flash or Adobe Acrobat
add_header X-Permitted-Cross-Domain-Policies none;
## Old IE header, force download instead of opening in browser
add_header X-Download-Options noopen;
## Site should only be accessed via HTTPS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Security cookie flag
proxy_cookie_path ~(.*) "$1; SameSite=strict; secure; httpOnly";
# performance
aio threads;
location / {
root /usr/share/nginx/html/html;
index index.html index.htm;
}
location /image/ {
root /usr/share/nginx/html/;
# prevent hotlinking
valid_referers none blocked www.asdfxyz.xyz asdfxyz.xyz;
if ($invalid_referer) {
return 403;
}
}
# basic reverse proxy to express server
location /api/ {
# note - backend is the name of the container, dont use `localhost`
proxy_pass http://backend:3000/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# Disable unsafe HTTP methods
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
return 405;
}
# Denying unwanted User-Agents
if ($http_user_agent ~* LWP::Simple|BBBike|wget) {
return 403;
}
if ($http_user_agent ~* msnbot|scrapbot) {
return 403;
}
# Deny access to hidden files
location ~ /\. {
deny all;
}
}