From Tom, 5 Months ago, written in Plain Text.
This paste will hop the perch in 1 Second.
Embed
  1. server {
  2. listen 443 ssl http2 default_server;
  3. listen [::]:443 ssl http2 default_server;
  4. server_name cloud-sound-sculpture.dedyn.io;
  5. ssl_certificate /etc/letsencrypt/rsa-certs/fullchain.pem;
  6. ssl_certificate_key /etc/letsencrypt/rsa-certs/privkey.pem;
  7. ssl_certificate /etc/letsencrypt/ecc-certs/fullchain.pem;
  8. ssl_certificate_key /etc/letsencrypt/ecc-certs/privkey.pem;
  9. ssl_trusted_certificate /etc/letsencrypt/ecc-certs/chain.pem;
  10. ssl_dhparam /etc/ssl/certs/dhparam.pem;
  11. ssl_session_timeout 1d;
  12. ssl_session_cache shared:SSL:50m;
  13. ssl_session_tickets off;
  14. ssl_protocols TLSv1.3 TLSv1.2;
  15. ssl_ciphers 'TLS-CHACHA20-POLY1305-SHA256:TLS-AES-256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384';
  16. ssl_ecdh_curve X448:secp521r1:secp384r1;
  17. ssl_prefer_server_ciphers on;
  18. ssl_stapling on;
  19. ssl_stapling_verify on;
  20. add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
  21. add_header Referrer-Policy "no-referrer" always;
  22. add_header X-Content-Type-Options "nosniff" always;
  23. add_header X-Download-Options "noopen" always;
  24. add_header X-Frame-Options "SAMEORIGIN" always;
  25. add_header X-Permitted-Cross-Domain-Policies "none" always;
  26. add_header X-Robots-Tag "none" always;
  27. add_header X-XSS-Protection "1; mode=block" always;
  28. fastcgi_hide_header X-Powered-By;
  29. fastcgi_read_timeout 3600;
  30. fastcgi_send_timeout 3600;
  31. fastcgi_connect_timeout 3600;
  32. root /var/www/nextcloud;
  33. location = /robots.txt {
  34. allow all;
  35. log_not_found off;
  36. access_log off;
  37. }
  38. location = /.well-known/carddav {
  39. return 301 $scheme://$host:$server_port/remote.php/dav;
  40. }
  41. location = /.well-known/caldav {
  42. return 301 $scheme://$host:$server_port/remote.php/dav;
  43. }
  44. location = /.well-known/webfinger {
  45. return 301 /index.php$uri;
  46. }
  47. location = /.well-known/nodeinfo {
  48. return 301 /index.php$uri;
  49. }
  50. client_max_body_size 10240M;
  51. fastcgi_buffers 64 4K;
  52. gzip on;
  53. gzip_vary on;
  54. gzip_comp_level 4;
  55. gzip_min_length 256;
  56. gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
  57. gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
  58. location / {
  59. rewrite ^ /index.php;
  60. }
  61. location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
  62. deny all;
  63. }
  64. location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
  65. deny all;
  66. }
  67. location ^~ /apps/rainloop/app/data {
  68. deny all;
  69. }
  70. location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy)\.php(?:$|\/) {
  71. fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
  72. set $path_info $fastcgi_path_info;
  73. try_files $fastcgi_script_name =404;
  74. include fastcgi_params;
  75. fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  76. fastcgi_param PATH_INFO $path_info;
  77. fastcgi_param HTTPS on;
  78. fastcgi_param modHeadersAvailable true;
  79. fastcgi_param front_controller_active true;
  80. fastcgi_pass php-handler;
  81. fastcgi_intercept_errors on;
  82. fastcgi_request_buffering off;
  83. }
  84. location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
  85. try_files $uri/ =404;
  86. index index.php;
  87. }
  88. location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
  89. try_files $uri /index.php$request_uri;
  90. add_header Cache-Control "public, max-age=15778463";
  91. add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
  92. add_header Referrer-Policy "no-referrer" always;
  93. add_header X-Content-Type-Options "nosniff" always;
  94. add_header X-Download-Options "noopen" always;
  95. add_header X-Frame-Options "SAMEORIGIN" always;
  96. add_header X-Permitted-Cross-Domain-Policies "none" always;
  97. add_header X-Robots-Tag "none" always;
  98. add_header X-XSS-Protection "1; mode=block" always;
  99. access_log off;
  100. }
  101. location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ {
  102. try_files $uri /index.php$request_uri;
  103. access_log off;
  104. }
  105. }
  106.