分享nginx 設定檔

[Brave Ye]

Code: Select all

# =========================================================================
# 區塊 1A: Port 80 網域名稱 (強制 HTTPS)
# =========================================================================

server {
    listen 80;
    server_name zine-tw.com www.zine-tw.com;

    # Certbot 驗證路徑
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    # 其餘所有請求強制跳轉 HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
    location = /404_deadlink {
        internal;
        return 404;
    }
}
# =========================================================================
# 區塊 1B: Port 80 IP 直連 (中國/牆內用戶 HTTP 通道)
# =========================================================================

server {
    listen 80;
    server_name 123.241.40.195;
    root /var/www/html;
    index index.php index.html index.htm;

    ### 💡 寬鬆安全標頭
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    ### -----------------------------------------------------
    ### 📝 MediaWiki 規則 (IP 版 - 完全對接 LocalSettings)
    ### -----------------------------------------------------
    location = / {
        return 301 $scheme://$host/wiki/;
    }

    # 短網址進入點
    location /wiki/ {
        try_files $uri $uri/ @mediawiki_ip;
    }

    location @mediawiki_ip {
        rewrite ^/wiki/(.*)$ /mediawiki/index.php?title=$1&$args last;
    }

    # 核心進入點與資源加載器 (load.php / api.php / rest.php)
    location ~ ^/(load|api|rest|index)\.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.5-fpm.sock;
        fastcgi_param SCRIPT_FILENAME /var/www/html/mediawiki$fastcgi_script_name;
        include fastcgi_params;
    }

    # 實體目錄 /mediawiki/ 與內部資源檔
    location /mediawiki/ {
        root /var/www/html;
        index index.php;
        try_files $uri $uri/ =404;

        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php8.5-fpm.sock;
            fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
            include fastcgi_params;
        }  
    }
    ### -----------------------------------------------------
    ### 💬 phpBB 3.3.17 規則 (IP 版 - 已移除 app.php rewrite)
    ### -----------------------------------------------------
    location ^~ /phpBB3/ {
        index index.php index.html index.htm;
        try_files $uri $uri/ =404;          # ← 取代 @phpbb_rewrite

        location ~ \.php(/|$) {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php8.5-fpm.sock;
            fastcgi_split_path_info ^(.+\.php)(/.*)$;
            fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param HTTP_PROXY "";     # ← 新增，防 proxy 注入
            include fastcgi_params;
        }

        # 收緊版：只擋根層級敏感檔，不误傷 ext/*/includes/
        location ~ ^/phpBB3/(config\.php|common\.php|store/|cache/data_) {
            deny all;
            error_page 403 =404 /404_deadlink;
        }
    }

    ### -----------------------------------------------------
    ### 💬 牆內通道補強：聊天室靜態前端
    ### -----------------------------------------------------
    location /chat {
        alias /var/www/my-chat/public/;
        index index.html index.htm;
        try_files $uri $uri/ /chat/index.html =404;
    }

    ### -----------------------------------------------------
    ### 🔌 Workerman WSS Proxy (IP HTTP 版)
    ### -----------------------------------------------------
    location /wss {
        proxy_pass http://127.0.0.1:8282;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        proxy_buffering off;
    }

    ### -----------------------------------------------------
    ### ⚡ 全域 PHP 解析器 (兜底規則)
    ### -----------------------------------------------------
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.5-fpm.sock;
        fastcgi_param HTTP_PROXY "";         # ← 新增
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}    
# =========================================================================
# 區塊 2: HTTPS 主站 (server_name zine-tw.com) — 開頭
# =========================================================================

server {
    listen 443 ssl;
    server_name zine-tw.com www.zine-tw.com;
    root /var/www/html;
    index index.php index.html index.htm;

    ### 🔑 SSL 安全憑證設定 (Certbot 自動管理)
    ssl_certificate     /etc/letsencrypt/live/zine-tw.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/zine-tw.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    ### 🔒 安全性回應標頭優化
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

    ### 🛡️ CSP 放行版 (保留原設定)
    add_header Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval'; connect-src 'self' https://zine-tw.com wss://zine-tw.com http://123.241.40.195 https://123.241.40.195 ws://123.241.40.195 wss://123.241.40.195;" always;

    ### 🛡️ Cross-Origin 安全標頭
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Cross-Origin-Embedder-Policy "credentialless" always;
    add_header Cross-Origin-Resource-Policy "same-origin" always;
    ### -----------------------------------------------------
    ### 📊 AWStats 流量統計中心專屬頂級路由
    ### -----------------------------------------------------
    location ^~ /awstats-icon/ {
        alias /usr/share/awstats/icon/;
        access_log off;
    }

    location = /awstats {
        return 301 $scheme://$host/awstats/awstats.pl?config=zine-tw.com;
    }
    location = /awstats/ {
        return 301 $scheme://$host/awstats/awstats.pl?config=zine-tw.com;
    }

    location ^~ /awstats/ {
        alias /usr/lib/cgi-bin/;
        index awstats.pl;

        location ~ \.pl$ {
            include fastcgi_params;
            fastcgi_pass unix:/run/fcgiwrap.socket;
            fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/awstats.pl;
            fastcgi_param SCRIPT_NAME     /awstats.pl;
            fastcgi_param DOCUMENT_ROOT   /usr/lib/cgi-bin;
            fastcgi_param QUERY_STRING    $query_string;
        }
    }

    ### -----------------------------------------------------
    ### 📝 MediaWiki 規則 (官方短網址最佳相容版)
    ### -----------------------------------------------------
    # 首頁自動導向短網址
    location = / {
        return 301 $scheme://$host/wiki/;
    }

    # 短網址進入點 (/wiki/頁面名稱)
    location /wiki/ {
        try_files $uri $uri/ @mediawiki;
    }

    location @mediawiki {
        rewrite ^/wiki/(.*)$ /mediawiki/index.php?title=$1&$args last;
    }

    # 直接解析 MediaWiki 根目錄關鍵 PHP 檔案 (解決 load.php 排版跑版)
    location ~ ^/(load|api|rest|index)\.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.5-fpm.sock;
        fastcgi_param SCRIPT_FILENAME /var/www/html/mediawiki$fastcgi_script_name;
        include fastcgi_params;
    }

    # 實體目錄 /mediawiki/ 存取規則
    location /mediawiki/ {
        root /var/www/html;
        index index.php;
        try_files $uri $uri/ =404;

        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php8.5-fpm.sock;
            fastcgi_param HTTP_PROXY "";      # ← 新增
            fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
            include fastcgi_params;
        }
    }

    ### 🛑 衝突排除：根目錄的 phpBB 核心敏感檔案
    location ~ ^/(config\.php|common\.php) {
        error_page 403 =404 /404_deadlink;
        deny all;
    }

    ### 🔄 舊 phpBB 專屬檔案永久導向新子目錄 /phpBB3/ (雙斜線 bug 已修)
    location ~ ^/(viewforum|viewtopic|memberlist|posting|ucp|mcp|search|faq|cron)\.php$ {
        return 301 /phpBB3/$1.php$is_args$args;
    }
    location ^~ /download/file.php {
        return 301 /phpBB3/download/file.php$is_args$args;
    }

    location ~* ^/(images|cache|includes)/.*\.(php|pl|py|sh|inc|tpl)$ {
        deny all;
    }
        ### -----------------------------------------------------
    ### 💬 phpBB 3.3.17 規則 (已關閉 URL rewriting 版)
    ### -----------------------------------------------------
    location ^~ /phpBB3/ {
        index index.php index.html index.htm;
        try_files $uri $uri/ =404;          # ← 取代 @phpbb_rewrite，垃圾請求直接 404

        location ~ \.php(/|$) {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php8.5-fpm.sock;
            fastcgi_split_path_info ^(.+\.php)(/.*)$;
            fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param HTTP_PROXY "";     # ← 新增
            include fastcgi_params;
        }

        # 收緊版：只擋根層級敏感檔，不误傷 ext/*/includes/
        location ~ ^/phpBB3/(config\.php|common\.php|store/|cache/data_) {
            deny all;
            error_page 403 =404 /404_deadlink;
        }
    }

    ### -----------------------------------------------------
    ### 💾 phpMyAdmin 子目錄優化設定 (IP 限制)
    ### -----------------------------------------------------
    location ^~ /phpmyadmin {
        allow 127.0.0.1;
        allow 123.241.40.195;
        deny all;
        error_page 403 =404 /404_deadlink;

        alias /var/www/html/phpmyadmin/;
        index index.php index.html;

        location ~ \.php$ {
            allow 127.0.0.1;
            allow 123.241.40.195;
            deny all;
            error_page 403 =404 /404_deadlink;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass unix:/run/php/php8.5-fpm.sock;
            fastcgi_index index.php;
            include fastcgi_params;
            fastcgi_param HTTP_PROXY "";     # ← 新增
            fastcgi_param SCRIPT_FILENAME $request_filename;
        }
    }

    ### -----------------------------------------------------
    ### 🔌 Workerman WSS (HTTPS 版)
    ### -----------------------------------------------------
    location /wss {
        proxy_pass http://127.0.0.1:8282;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        proxy_buffering off;
    }

    ### -----------------------------------------------------
    ### 💬 Workerman Chat 前端
    ### -----------------------------------------------------
    location /chat {
        alias /var/www/my-chat/public/;
        index index.html index.htm;
        try_files $uri $uri/ /chat/index.html =404;
    }

    ### -----------------------------------------------------
    ### ⚡ 根目錄其餘 PHP 解析 (兜底對接 PHP 8.5-FPM)
    ### -----------------------------------------------------
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.5-fpm.sock;
        fastcgi_param HTTP_PROXY "";         # ← 新增
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
    ### -----------------------------------------------------
    ### 🔒 【共用攔截器】死胡同路由 (404 統一出口)
    ### -----------------------------------------------------
    # 注意：此 location 必須設為 internal，否則外部無法直接訪問
    location = /404_deadlink {
        internal;
        return 404;
    }
}