From cd3f93bcc2d8e4a5934a19b13f7fdf30ee4e130c Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Sun, 1 Nov 2026 22:34:19 +0100
Subject: web: serve latest.php through PHP and refuse stray PHP files

nginx example now routes index.php and latest.php to php-fpm, sends the newest-version feed with no-store, keeps the stable installers revalidated, and returns 404 for every other .php request so releases.php cannot be downloaded as source. Documents Debian and Arch pool sockets.
---
 web/nginx.conf.example | 39 +++++++++++++++++++++++++++++++++------
 1 file changed, 33 insertions(+), 6 deletions(-)

(limited to 'web/nginx.conf.example')

diff --git a/web/nginx.conf.example b/web/nginx.conf.example
index ad001d1..9fc942f 100644
--- a/web/nginx.conf.example
+++ b/web/nginx.conf.example
@@ -1,11 +1,12 @@
 # zagan.bet download page — nginx + php-fpm example.
 #
 # Install at /etc/nginx/conf.d/zagan.bet.conf (the packaged nginx.conf includes
-# conf.d/*.conf). Replace the server name, root and certificate paths.
+# conf.d/*.conf). Replace the server name, root, socket and certificate paths.
 #
-# Only index.php is PHP; everything under /bin/ is served as static files.
-# The binaries are versioned, so they can be cached forever — which means you
-# must bump the version (Cargo.toml) instead of overwriting a published file.
+# Only index.php and latest.php are PHP. Everything else under the web root is
+# static: /bin/ is immutable and versioned, while the installers are stable and
+# revalidated. Any other .php request is refused, so releases.php (an include)
+# and stray scripts cannot be downloaded as source.
 
 server {
     listen 80;
@@ -17,7 +18,7 @@ server {
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    http2 on;
+    http2 on;                       # nginx < 1.25.1: listen 443 ssl http2;
     server_name dl.example.com;
 
     root /srv/zagan.bet;
@@ -39,15 +40,41 @@ server {
     # The page rescans bin/ on every request, so don't cache it.
     location = /index.php {
         include fastcgi_params;
-        fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
+        # Debian/Ubuntu: /run/php/php-fpm.sock
+        # Arch:          /run/php-fpm/php-fpm.sock
+        fastcgi_pass unix:/run/php/php-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         add_header Cache-Control "no-cache";
     }
 
+    # The newest-version feed read by install.sh and install.ps1.
+    location = /latest.php {
+        include fastcgi_params;
+        fastcgi_pass unix:/run/php/php-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        add_header Cache-Control "no-store";
+    }
+
+    # Stable installers: always revalidate so a fix reaches the next download.
+    location = /install.sh {
+        default_type text/plain;
+        add_header Cache-Control "no-cache";
+    }
+
+    location = /install.ps1 {
+        default_type text/plain;
+        add_header Cache-Control "no-cache";
+    }
+
     location / {
         try_files $uri $uri/ =404;
     }
 
+    # releases.php is an include only; no other script is meant to be served.
+    location ~ \.php$ {
+        return 404;
+    }
+
     # Never serve dotfiles (.gitignore, editor leftovers).
     location ~ /\. {
         deny all;
-- 
cgit v1.2.3