91 lines
2.9 KiB
Plaintext
91 lines
2.9 KiB
Plaintext
server {
|
|
listen ${WEBSITE.PORT};
|
|
root /usr/local/www/${WEBSITE.NAME};
|
|
index index.php;
|
|
|
|
# Location for wiki's entry points
|
|
location ~ ^/(index|load|api|thumb|opensearch_desc|rest|img_auth)\.php$ {
|
|
# Mitigate https://httpoxy.org/ vulnerabilities
|
|
fastcgi_param HTTP_PROXY "";
|
|
fastcgi_pass 127.0.0.1:9000;
|
|
fastcgi_index index.php;
|
|
# include the fastcgi_param setting
|
|
include fastcgi_params;
|
|
# SCRIPT_FILENAME parameter is used for PHP FPM determining
|
|
# the script name. If it is not set in fastcgi_params file,
|
|
# i.e. /etc/nginx/fastcgi_params or in the parent contexts,
|
|
# please comment off following line:
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
}
|
|
|
|
# Images
|
|
location /images {
|
|
# Separate location for images/ so .php execution won't apply
|
|
}
|
|
location /images/deleted {
|
|
# Deny access to deleted images folder
|
|
deny all;
|
|
}
|
|
# MediaWiki assets (usually images)
|
|
location ~ ^/resources/(assets|lib|src) {
|
|
try_files $uri 404;
|
|
add_header Cache-Control "public";
|
|
expires 7d;
|
|
}
|
|
# Assets, scripts and styles from skins and extensions
|
|
location ~ ^/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg|wasm)$ {
|
|
try_files $uri 404;
|
|
add_header Cache-Control "public";
|
|
expires 7d;
|
|
}
|
|
# Favicon
|
|
location = /favicon.ico {
|
|
alias /images/6/64/Favicon.ico;
|
|
add_header Cache-Control "public";
|
|
expires 7d;
|
|
}
|
|
|
|
# License and credits files
|
|
location ~ ^/(COPYING|CREDITS)$ {
|
|
default_type text/plain;
|
|
}
|
|
|
|
## Uncomment the following code if you wish to use the installer/updater
|
|
## installer/updater
|
|
location /mw-config/ {
|
|
# Do this inside of a location so it can be negated
|
|
location ~ \.php$ {
|
|
include fastcgi_params;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
fastcgi_pass 127.0.0.1:9000; # or whatever port your PHP-FPM listens on
|
|
}
|
|
}
|
|
|
|
# Handling for Mediawiki REST API, see [[mw:API:REST_API]]
|
|
location /rest.php/ {
|
|
try_files $uri $uri/ /rest.php?$query_string;
|
|
}
|
|
|
|
## Uncomment the following code for handling image authentication
|
|
## Also add "deny all;" in the location for /w/images above
|
|
#location /w/img_auth.php/ {
|
|
# try_files $uri $uri/ /w/img_auth.php?$query_string;
|
|
#}
|
|
|
|
|
|
# Allow robots.txt in case you have one
|
|
location = /robots.txt {
|
|
}
|
|
# Explicit access to the root website, redirect to main page (adapt as needed)
|
|
location = / {
|
|
return 301 /index.php;
|
|
}
|
|
|
|
# Every other entry point will be disallowed.
|
|
# Add specific rules for other entry points/images as needed above this
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|
|
|