1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
# zagan.bet download page — nginx + php-fpm example.
#
# Install at /etc/nginx/conf.d/zagan.bet.conf (the packaged nginx.conf includes
# conf.d/*.conf). Replace the server name, root, socket and certificate paths.
#
# Only index.php and latest.php are PHP. Everything else under the web root is
# static: /bin/ is immutable and versioned, while the installers are stable and
# revalidated. Any other .php request is refused, so releases.php (an include)
# and stray scripts cannot be downloaded as source.
server {
listen 80;
listen [::]:80;
server_name dl.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on; # nginx < 1.25.1: listen 443 ssl http2;
server_name dl.example.com;
root /srv/zagan.bet;
index index.php;
ssl_certificate /etc/letsencrypt/live/dl.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/dl.example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
# Published binaries: static, versioned, never rewritten.
location /bin/ {
try_files $uri =404;
add_header Cache-Control "public, max-age=31536000, immutable";
}
# The browser app: static files, no framework runtime.
location = /play {
return 301 /play/;
}
location /play/ {
try_files $uri $uri/ /play/index.html;
add_header Cache-Control "no-cache";
add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
}
# WebSocket gateway. Keep the upgrade headers and a long read timeout:
# a crash round can idle for a while between pushes.
location = /ws {
proxy_pass http://127.0.0.1:8890;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
# Ask crawlers and scanners to stay out, and never index a page.
location = /robots.txt {
default_type text/plain;
try_files $uri =404;
add_header Cache-Control "public, max-age=3600";
add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
}
# The page rescans bin/ on every request, so don't cache it.
location = /index.php {
include fastcgi_params;
# Debian/Ubuntu: /run/php/php-fpm.sock
# Arch: /run/php-fpm/php-fpm.sock
fastcgi_pass unix:/run/php/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
add_header Cache-Control "no-cache";
add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
}
# The newest-version feed read by install.sh and install.ps1.
location = /latest.php {
include fastcgi_params;
fastcgi_pass unix:/run/php/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
add_header Cache-Control "no-store";
add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
}
# Stable installers: always revalidate so a fix reaches the next download.
location = /install.sh {
default_type text/plain;
add_header Cache-Control "no-cache";
}
location = /install.ps1 {
default_type text/plain;
add_header Cache-Control "no-cache";
}
location / {
try_files $uri $uri/ =404;
}
# releases.php is an include only; no other script is meant to be served.
location ~ \.php$ {
return 404;
}
# Never serve dotfiles (.gitignore, editor leftovers).
location ~ /\. {
deny all;
}
}
|
