blob: 9fc942fbf1cb49027985ff26545198684abfaf8a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
# zagan.bet download page — nginx + php-fpm example.
#
# Install at /etc/nginx/conf.d/zagan.bet.conf (the packaged nginx.conf includes
# conf.d/*.conf). Replace the server name, root, socket and certificate paths.
#
# Only index.php and latest.php are PHP. Everything else under the web root is
# static: /bin/ is immutable and versioned, while the installers are stable and
# revalidated. Any other .php request is refused, so releases.php (an include)
# and stray scripts cannot be downloaded as source.
server {
listen 80;
listen [::]:80;
server_name dl.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on; # nginx < 1.25.1: listen 443 ssl http2;
server_name dl.example.com;
root /srv/zagan.bet;
index index.php;
ssl_certificate /etc/letsencrypt/live/dl.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/dl.example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
# Published binaries: static, versioned, never rewritten.
location /bin/ {
try_files $uri =404;
add_header Cache-Control "public, max-age=31536000, immutable";
}
# The page rescans bin/ on every request, so don't cache it.
location = /index.php {
include fastcgi_params;
# Debian/Ubuntu: /run/php/php-fpm.sock
# Arch: /run/php-fpm/php-fpm.sock
fastcgi_pass unix:/run/php/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
add_header Cache-Control "no-cache";
}
# The newest-version feed read by install.sh and install.ps1.
location = /latest.php {
include fastcgi_params;
fastcgi_pass unix:/run/php/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
add_header Cache-Control "no-store";
}
# Stable installers: always revalidate so a fix reaches the next download.
location = /install.sh {
default_type text/plain;
add_header Cache-Control "no-cache";
}
location = /install.ps1 {
default_type text/plain;
add_header Cache-Control "no-cache";
}
location / {
try_files $uri $uri/ =404;
}
# releases.php is an include only; no other script is meant to be served.
location ~ \.php$ {
return 404;
}
# Never serve dotfiles (.gitignore, editor leftovers).
location ~ /\. {
deny all;
}
}
|
