diff options
Diffstat (limited to 'install')
| -rw-r--r-- | install/sample-lighttpd.conf | 90 | ||||
| -rw-r--r-- | install/sample-nginx.conf | 142 |
2 files changed, 232 insertions, 0 deletions
diff --git a/install/sample-lighttpd.conf b/install/sample-lighttpd.conf new file mode 100644 index 000000000..db26c3b64 --- /dev/null +++ b/install/sample-lighttpd.conf @@ -0,0 +1,90 @@ +# See http://redmine.lighttpd.net/projects/lighttpd/wiki/Docs:ConfigurationOptions + +### LOAD MODULES +server.modules = ( + "mod_access", + "mod_accesslog", + "mod_fastcgi", + "mod_redirect", + "mod_rewrite" +) + +### BASIC STUFF +server.port = 80 + +server.username = "http" + +server.groupname = "http" + +server.document-root = "/path/to/your/www/files" #adjust to your setup + +server.errorlog = "/var/log/lighttpd/error.log" + +accesslog.filename = "/var/log/lighttpd/access.log" + +### DISABLE DIR LISTING +dir-listing.activate = "disable" + +### DISABLE REJECT EXPECT HEADER +### (needed for curl POST requests - otherwise they fail with error 417) +server.reject-expect-100-with-417 = "disable" + +### DEFINE SUPPORTED INDEX FILENAMES +index-file.names = ( + "index.html", + "index.htm", + "index.php" +) + +### DEFINE SUPPORTED MIME TYPES +mimetype.assign = ( + ".html" => "text/html", + ".htm" => "text/html", + ".css" => "text/css", + ".txt" => "text/plain", + ".svg" => "image/svg+xml", + ".jpg" => "image/jpeg", + ".png" => "image/png" +) + +### DONT EVER SERVE FILES WITH EXTENSION +static-file.exclude-extensions = ( ".php" ) + +### PHP WITH PHP-FPM +### (needs php-fpm installed and running) +fastcgi.server = ( + ".php" => ( + "localhost" => ( + "socket" => "/run/php-fpm/php-fpm.sock", + "broken-scriptfilename" => "enable", + "allow-x-sendfile" => "enable" + ) + ) +) + +### ENABLE SSL +$SERVER["socket"] == ":443" { + ssl.engine = "enable" + ssl.ca-file = "/etc/lighttpd/certs/ca-certs.crt" #adjust to your needs + ssl.pemfile = "/etc/lighttpd/certs/red-ssl.crt" #adjust to your needs + + ssl.use-compression = "disable" + ssl.use-sslv2 = "disable" + ssl.use-sslv3 = "disable" + ssl.cipher-list = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA" +} + +### RISTRICT ACCESS TO DIRECTORYS AND FILES +$HTTP["url"] =~ "\.(out|log|htaccess)$" { + url.access-deny = ("") +} + +$HTTP["url"] =~ "(^|/)\.git|(^|/)store" { + url.access-deny = ("") +} + +### URL REWRITE RULES +url.rewrite-if-not-file = ( + "^\/([^\?]*)\?(.*)$" => "/index.php?q=$1&$2", + "^\/(.*)$" => "/index.php?q=$1" +) diff --git a/install/sample-nginx.conf b/install/sample-nginx.conf new file mode 100644 index 000000000..e9a80d226 --- /dev/null +++ b/install/sample-nginx.conf @@ -0,0 +1,142 @@ +## +# Red Nginx configuration +# by Olaf Conradi +# +# On Debian based distributions you can add this file to +# /etc/nginx/sites-available +# +# Then customize to your needs. To enable the configuration +# symlink it to /etc/nginx/sites-enabled and reload Nginx using +# +# service nginx reload +## + +## +# You should look at the following URL's in order to grasp a solid understanding +# of Nginx configuration files in order to fully unleash the power of Nginx. +# +# http://wiki.nginx.org/Pitfalls +# http://wiki.nginx.org/QuickStart +# http://wiki.nginx.org/Configuration +## + +## +# This configuration assumes your domain is example.net +# You have a separate subdomain red.example.net +# You want all red traffic to be https +# You have an SSL certificate and key for your subdomain +# You have PHP FastCGI Process Manager (php5-fpm) running on localhost +# You have Red installed in /var/www/red +## + +server { + listen 80; + server_name red.example.net; + + index index.php; + root /var/www/red; + rewrite ^ https://red.example.net$request_uri? permanent; +} + +## +# Configure Red with SSL +# +# All requests are routed to the front controller +# except for certain known file types like images, css, etc. +# Those are served statically whenever possible with a +# fall back to the front controller (needed for avatars, for example) +## + +server { + listen 443 ssl; + server_name red.example.net; + + ssl on; + ssl_certificate /etc/nginx/ssl/red.example.net.chain.pem; + ssl_certificate_key /etc/nginx/ssl/example.net.key; + ssl_session_timeout 5m; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!DHE-RSA-AES128-GCM-SHA256:!DHE-RSA-AES256-GCM-SHA384:!DHE-RSA-AES128-SHA256:!DHE-RSA-AES256-SHA:!DHE-RSA-AES128-SHA:!DHE-RSA-AES256-SHA256:!DHE-RSA-CAMELLIA128-SHA:!DHE-RSA-CAMELLIA256-SHA; + ssl_prefer_server_ciphers on; + + fastcgi_param HTTPS on; + + index index.php; + charset utf-8; + root /var/www/red; + access_log /var/log/nginx/red.log; + #Uncomment the following line to include a standard configuration file + #Note that the most specific rule wins and your standard configuration + #will therefore *add* to this file, but not override it. + #include standard.conf + # allow uploads up to 20MB in size + client_max_body_size 20m; + client_body_buffer_size 128k; + + # rewrite to front controller as default rule + location / { + if ($is_args != "") { + rewrite ^/(.*) /index.php?q=$uri&$args last; + } + rewrite ^/(.*) /index.php?q=$uri last; + } + + # make sure webfinger and other well known services aren't blocked + # by denying dot files and rewrite request to the front controller + location ^~ /.well-known/ { + allow all; + rewrite ^/(.*) /index.php?q=$uri&$args last; + } + + # statically serve these file types when possible + # otherwise fall back to front controller + # allow browser to cache them + # added .htm for advanced source code editor library + location ~* \.(jpg|jpeg|gif|png|ico|css|js|htm|html|ttf|woff|svg)$ { + expires 30d; + try_files $uri /index.php?q=$uri&$args; + } + + # block these file types + location ~* \.(tpl|md|tgz|log|out)$ { + deny all; + } + + # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 + # or a unix socket + location ~* \.php$ { + # Zero-day exploit defense. + # http://forum.nginx.org/read.php?2,88845,page=3 + # Won't work properly (404 error) if the file is not stored on this + # server, which is entirely possible with php-fpm/php-fcgi. + # Comment the 'try_files' line out if you set up php-fpm/php-fcgi on + # another machine. And then cross your fingers that you won't get hacked. + try_files $uri =404; + + # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini + fastcgi_split_path_info ^(.+\.php)(/.+)$; + + # With php5-cgi alone: + # fastcgi_pass 127.0.0.1:9000; + + # With php5-fpm: + fastcgi_pass unix:/var/run/php5-fpm.sock; + + include fastcgi_params; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + } + + # deny access to all dot files + location ~ /\. { + deny all; + } + +#deny access to store + + location ~ /store { + deny all; + } + + +} |