...
location /aaaa {
root /var/www/aaaa;
index index.php index.html index.htm;
location ~ (.+\.php)$ {
try_files $uri = 404;
root /var/www/aaaa/;
include /etc/nginx/fastcgi_params;
fastcgi_pass unix:/var/lib/php5-fpm/aaaa.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
}
...# nslookup portal.tggroup.kz
Server: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:
Name: portal.tggroup.kz
Address: 178.62.251.1561. Постоянный редирект с / на index.phplocation = / { rewrite ^ $scheme://$host/index.php permanent; } location / { deny all; return 404; } location ~* ^/index\.php$ { try_files $uri $uri/ =404; fastcgi_index index.php; fastcgi_pass php5-fpm-sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include /etc/nginx/fastcgi_params; }
$host
в порядке приоритета: имя хоста из строки запроса, или имя хоста из поля “Host” заголовка запроса, или имя сервера, соответствующего запросу
...
error_page 404 = @cms;
location / {
try_files /NONEXISTENTFILE @cms;
}
location @cms {
fastcgi_pass unix:/var/lib/php5-fpm/xxxxx.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root/index.php;
fastcgi_param SCRIPT_NAME /index.php;
include /etc/nginx/fastcgi_params;
}
...2. Запрещаем любую статику кроме gif|jpg|png|js|css|ttf|woff|icolocation ~* \.(gif|jpg|png|js|css|ttf|woff|ico)$ { try_files $uri =404; expires 30d; }
...
error_page 404 = @cms;
location ~* ^.+\.(gif|jpg|png|js|css|ttf|woff|ico)$ {
expires 30d;
access_log off;
log_not_found off;
}
location / {
try_files /NONEXISTENTFILE @cms;
}
...http {
....
geo $my_client_ip $denied {
default 1;
127.0.0.1 0;
XX.XX.XX.XX 0; # <- IP1 с которого можно заходить
YY.YY.YY.YY 0; # <- IP2 с которого можно заходить
}
server {
listen 443 ssl;
server_name site.ru;
root /var/www/html/;
...
set $my_client_ip $remote_addr;
if ($http_x_forwarded_client_ip ~ "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") {
set $my_client_ip $http_x_forwarded_client_ip;
}
error_page 403 = @deny;
location @deny {
root /var/www/deny;
rewrite ^(.*)$ /index.html break;
}
location ~* ^/json\.php$ {
if ($denied) {
return 403;
}
try_files /NONEXISTENTFILE @json;
}
location @json {
try_files $uri = 404;
fastcgi_pass unix:/var/lib/php5-fpm/xxxxx.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include /etc/nginx/fastcgi_params;
}
}
}4. Разрешаем доступ к /admin только с 1-го IP, для /admin/phpmyadmin
[mysqld]
...
log_error = /var/log/mysql_error.log
...systemctl restart mariadb.service
proxy_connect_timeout 120s;
proxy_send_timeout 120s;
proxy_read_timeout 120s;http {
...
log_format upstream_log '[$time_local] $remote_addr - $remote_user - $server_name to: $upstream_addr: $request upstream_response_time $upstream_response_time msec $msec request_time $request_time';
upstream servers {
least_conn;
server ip1;
server ip2 max_fails=3 fail_timeout=30s;
server ip3 max_fails=5 fail_timeout=30s;
keepalive 16;
}
server {
listen 80;
access_log /var/log/nginx/servers-access.log upstream_log;
error_log /var/log/nginx/servers-error.log debug;
location / {
proxy_pass http://servers;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_connect_timeout 120s;
proxy_send_timeout 120s;
proxy_read_timeout 120s;
}
}ls -la ~/backup.shchmod a+x ~/backup.shcat /var/log/syslog | grep CRON | grep backup.sh@midnight bash /full/path/backup.sh >/var/log/backup.log 2>&1@midnight bash /full/path/backup.sh >/dev/null 2>&1@midnight bash /full/path/backup.sh >/dev/null
certutil.exe -f -user -addstore Root myROOTcertFile.cercertutil.exe -f -user -addstore CA myCAcertFile.cerhttp {
# Websocket
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
...
lingering_time 86400;
proxy_ssl_verify off;
proxy_ssl_session_reuse on;
proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
proxy_cache off;
proxy_store off;
set $ssl off;
set $port 80;
if ($scheme = https) {
set $ssl on;
set $port 443;
}
location / {
proxy_pass https://192.168.XX.XX:8443/;
gzip off;
proxy_read_timeout 600s;
proxy_connect_timeout 600s;
proxy_redirect off;
proxy_buffering off;
proxy_request_buffering off;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Ssl $ssl;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $port;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Referer "";
}
}
}select user_id from order where status_id = '0';select user_id from order where status_id = '1';
server {
listen XX.XX.XX.XX:80 default_server;
server_name _;
return 444;
}server {
....
root /var/www/mysite.com;
index index.php index.html index.htm;
location / {
try_files $uri $uri/ =404;
}
location ~ \.php$ {
try_files $uri = 404;
fastcgi_pass unix:/var/lib/php5-fpm/mysite.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include /etc/nginx/fastcgi_params;
}
...
}map $ssl_client_s_dn $ssl_client_s_dn_cn {
default "";
~/CN=(?<CN>[^/]+) $CN;
}