-
Notifications
You must be signed in to change notification settings - Fork 32
/
drupal.conf
156 lines (126 loc) · 4.34 KB
/
drupal.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
### Nginx configuration for Drupal.
server {
include /etc/nginx/conf.d/drupal/server_prepend*.conf;
listen ${NGINX_LISTEN:-8080} default_server;
include /etc/nginx/helpers/*.conf;
root /app/${WEBROOT:-};
index index.php;
## rewriting /index.php to / because after https://www.drupal.org/node/2599326
## autocomplete URLs are forced to go to index.php
rewrite ^/index.php / last;
## The 'default' location.
location / {
include /etc/nginx/conf.d/drupal/location_prepend*.conf;
## This has to come before any *.txt path-based blocking
## Support for the securitytxt module
## http://drupal.org/project/securitytxt.
## RFC8615 standard path.
location ~* /\.well-known/security\.txt(\.sig)?$ {
access_log off;
try_files $uri @drupal;
}
## Do not allow access to .txt and .md unless inside public or private files
## directories (sites/*/files and sytem/files)
location ~* ^(?!.+(?:sites\/.+|system)\/files\/).+\.(txt|md)$ {
deny all;
access_log off;
log_not_found off;
}
## Replicate the Apache <FilesMatch> directive of Drupal standard
## .htaccess. Disable access to any code files. Return a 404 to curtail
## information disclosure.
location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|.*sql\.gz|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^\/(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(composer\.(json|lock)|web\.config|yarn\.lock|package(-lock)?\.json)$|^\/#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {
deny all;
access_log off;
log_not_found off;
return 404;
}
## Expiring per default for four weeks and one second, Drupal will overwrite that if necessary
expires ${NGINX_DEFAULT_EXPIRES:-2628001s};
## Disallow access to any dot files, but send the request to Drupal
location ~* /\. {
try_files /dev/null @drupal;
}
### Directives for installing drupal.
location ~* ^(/install.php|/core/install.php) {
try_files /dev/null @php;
}
## Direct Access to .php files is not allowed and is sent to Drupal instead
location ~* ^.+\.php$ {
try_files /dev/null @drupal;
}
## Try to find a file with given URL, if not pass to Drupal
try_files $uri @drupal;
include /etc/nginx/conf.d/drupal/location_append*.conf;
}
## Main Drupal Location
location @drupal {
include /etc/nginx/conf.d/drupal/location_drupal_prepend*.conf;
include /etc/nginx/fastcgi.conf;
fastcgi_param SCRIPT_NAME /index.php;
fastcgi_param SCRIPT_FILENAME $realpath_root/index.php;
fastcgi_pass ${NGINX_FASTCGI_PASS:-php}:9000;
include /etc/nginx/conf.d/drupal/location_drupal_append*.conf;
}
## PHP Location.
## Warning: This allows to execute any PHP files, use with care!
location @php {
include /etc/nginx/conf.d/drupal/location_php_prepend*.conf;
include /etc/nginx/fastcgi.conf;
fastcgi_pass ${NGINX_FASTCGI_PASS:-php}:9000;
include /etc/nginx/conf.d/drupal/location_php_append*.conf;
}
## Trying to access private files directly returns a 404.
location /sites/default/files/private/ {
internal;
}
## Disallow access to patches directory.
location ^~ /patches/ {
deny all;
access_log off;
log_not_found off;
}
## Disallow access to backup directory.
location ^~ /backup/ {
deny all;
access_log off;
log_not_found off;
}
## Disallow access to vagrant directory.
location ^~ /vagrant/ {
deny all;
access_log off;
log_not_found off;
}
## Disallow access to vendor directory.
location ^~ /core/vendor/ {
deny all;
access_log off;
log_not_found off;
}
## Disallow access to vendor directory.
location ^~ /vendor/ {
deny all;
access_log off;
log_not_found off;
}
## Support for the robotstxt module
## http://drupal.org/project/robotstxt.
location = /robots.txt {
access_log off;
try_files $uri @drupal;
}
## Add support for the humanstxt module
## http://drupal.org/project/humanstxt.
location = /humans.txt {
access_log off;
try_files $uri @drupal;
}
## Return an in memory 1x1 transparent GIF.
location @empty {
expires 30d;
empty_gif;
}
include /etc/nginx/conf.d/drupal/favicon.conf;
include /etc/nginx/conf.d/drupal/server_append*.conf;
}