-
-
Notifications
You must be signed in to change notification settings - Fork 437
/
Copy pathnginx-frontend.conf
191 lines (174 loc) · 6.3 KB
/
nginx-frontend.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
geo $whitelist_remote_addr {
default 0;
# CIDR in the list below are not limited
10.0.0.0/8 1;
172.16.0.0/12 1;
192.168.0.0/16 1;
}
map $whitelist_remote_addr $limit_key {
0 $binary_remote_addr;
1 "";
}
map $http_x-magentoruncode $runcode {
default "${NGINX_MAGE_RUN_CODE}";
}
map $http_x-magentoruntype $runtype {
default "${NGINX_MAGE_RUN_TYPE}";
}
map $request_method $post_limit { # Setup a special rate limiter for POST requests
default "";
POST $limit_key;
}
map $http_x_forwarded_proto $fastcgi_param_https {
default '';
https 'on';
}
# Trust X-Forwarded-For header coming from local networks
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
limit_req_zone $limit_key zone=spam:10m rate=4r/m;
limit_req_zone $post_limit zone=post:10m rate=1r/s;
limit_req_zone $limit_key zone=get:10m rate=3r/s;
limit_req_zone $limit_key zone=media:10m rate=10r/s;
limit_req_log_level warn;
server {
listen 80;
server_name _ "";
if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS)$) { return 405; }
set $fastcgi_script_filename ""; # Required because it is used in a log format
set $fastcgi_script_name2 $fastcgi_script_name; # Allow this to be manipulated
set $fastcgi_php_value ""; # Pre/Append to add more PHP FPM config
client_max_body_size 16K; # Default max body size - increase using a specific location block
gzip on;
gzip_comp_level 6;
gzip_min_length 1100;
gzip_buffers 16 8k;
gzip_proxied any;
gzip_types
text/plain
text/css
text/js
text/xml
text/javascript
application/javascript
application/x-javascript
application/json
application/xml
application/xml+rss
image/svg+xml;
gzip_vary on;
location / {
limit_req zone=get burst=10 nodelay;
limit_req zone=post burst=3 nodelay;
root /pub/$runcode; # Only files in this directory can be loaded directly
set $fastcgi_script_filename /var/www/html/index.php; # Hard-coded to prevent loading other PHP files
try_files $uri @php-fpm;
# Rate limit for specific endpoints that are commonly spammed
location /newsletter/subscriber/new {
limit_req zone=spam;
limit_req_status 403;
set $fastcgi_script_filename /var/www/html/index.php;
try_files $uri @php-fpm;
}
location /customer/account/createpost {
limit_req zone=spam;
limit_req_status 403;
set $fastcgi_script_filename /var/www/html/index.php;
try_files $uri @php-fpm;
}
location /wishlist/index/send {
limit_req zone=spam;
limit_req_status 403;
set $fastcgi_script_filename /var/www/html/index.php;
try_files $uri @php-fpm;
}
location /review/product/post {
limit_req zone=spam;
limit_req_status 403;
set $fastcgi_script_filename /var/www/html/index.php;
try_files $uri @php-fpm;
}
}
location /skin/ {
root /var/www/html;
gzip on;
add_header Cache-Control "public";
expires +1y;
location ~* \.(eot|ttf|otf|woff|woff2|svg)$ {
add_header Access-Control-Allow-Origin "*";
}
}
location /skin/adminhtml/ { deny all; }
location /skin/install/ { deny all; }
location /media/ {
limit_req zone=media burst=100 nodelay;
root /var/www/html;
gzip on;
location ~* \.(eot|ttf|otf|woff|woff2|svg)$ {
add_header Access-Control-Allow-Origin "*";
add_header Cache-Control "public";
expires +1y;
}
location ~* \.(ico|jpg|jpeg|png|gif|js|css)$ {
add_header Cache-Control "public";
expires +1y;
}
location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
add_header Cache-Control "no-store";
expires off;
}
set $fastcgi_script_filename /var/www/html/get.php; # Hard-coded to prevent loading other PHP files
try_files $uri @php-fpm;
}
location /media/customer/ { deny all; }
location /media/downloadable/ { deny all; }
location /media/import/ { deny all; }
location /js/ {
root /var/www/html;
gzip on;
add_header Cache-Control "public";
expires +1y;
}
location /errors/ {
root /var/www/html;
location ~* \.(!(css|jpg|jpeg|gif|png|ico|webp))$ { return 404; }
}
# Non-rewritten URLs, Admin and API are disabled for frontend
location /index.php/ { return 404; }
location ~ ^/admin(?:/(.*))?$ { return 404; }
location /api/ { return 404; }
location /api.php { return 404; }
# Protect dot files no matter where they are located
location ~ /\. { return 404; }
# Ignore the files that are needed only for Apache
location = /get.php { return 404; }
location = /install.php { return 404; }
# Custom error handlers
error_page 404 = @php-404;
location @php-404 {
set $fastcgi_script_filename /var/www/html/errors/404.php; # Hard-coded to prevent loading other PHP files
set $fastcgi_script_name2 /errors/404.php; # Hard-coded to prevent loading other PHP files
try_files NOT_EXISTS @php-fpm;
}
# Proxy the PHP scripts to PHP FPM listening
location @php-fpm {
add_header X-Frame-Options "SAMEORIGIN";
# Proxy to PHP-FPM
fastcgi_pass php-fpm:9000;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $fastcgi_script_filename;
fastcgi_param SCRIPT_NAME $fastcgi_script_name2;
fastcgi_param SERVER_PORT '80';
fastcgi_param MAGE_RUN_CODE $runcode;
fastcgi_param MAGE_RUN_TYPE $runtype;
fastcgi_param PHP_VALUE "error_log=\"/var/www/html/var/log/php_errors-$runcode.log\"\n$fastcgi_php_value";
fastcgi_param HTTPS $fastcgi_param_https;
# FastCGI tuning parameters
fastcgi_connect_timeout 1s;
fastcgi_send_timeout 60s;
fastcgi_read_timeout 20m;
}
}