Skip to content

Commit 76e8d8d

Browse files
author
Daniel Haus
committed
Upgrade to latest nginx and anonymize ips
1 parent 3b94499 commit 76e8d8d

File tree

4 files changed

+96
-56
lines changed

4 files changed

+96
-56
lines changed

‎Dockerfile

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
FROM jedisct1/phusion-baseimage-latest:16.04
22

33
RUN (curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -) \
4-
&& echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list \
4+
&& (curl -sS http://nginx.org/keys/nginx_signing.key | sudo apt-key add -) \
5+
&& echo "deb https://dl.yarnpkg.com/debian/ stable main" \
6+
| sudo tee /etc/apt/sources.list.d/yarn.list \
7+
&& echo "deb http://nginx.org/packages/mainline/ubuntu/ xenial nginx" \
8+
| sudo tee /etc/apt/sources.list.d/nginx.list \
59
&& apt-get update \
610
&& DEBIAN_FRONTEND=noninteractive \
711
apt-get install -yq --no-install-recommends \
@@ -49,8 +53,8 @@ RUN (curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -) \
4953
&& sed -i "s/;date.timezone =.*/date.timezone = UTC/" \
5054
/etc/php/7.1/fpm/php.ini \
5155
/etc/php/7.1/cli/php.ini \
52-
&& echo "daemon off;" >> /etc/nginx/nginx.conf \
53-
&& sed -i "s/;daemonize\s*=\s*yes/daemonize = no/g" /etc/php/7.1/fpm/php-fpm.conf \
56+
&& sed -i "/listen\./s/www-data/nginx/g" /etc/php/7.1/fpm/pool.d/www.conf \
57+
&& sed -i "s/;daemonize\s*=\s*yes/daemonize = no/" /etc/php/7.1/fpm/php-fpm.conf \
5458
&& sed -i "s/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/" /etc/php/7.1/fpm/php.ini \
5559
&& sed -i "s/;clear_env\s*=\s*no/clear_env = no/" /etc/php/7.1/fpm/pool.d/www.conf \
5660
&& mkdir -p \
@@ -59,8 +63,9 @@ RUN (curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -) \
5963
/etc/service/nginx \
6064
/etc/service/phpfpm
6165

62-
COPY etc/default.conf /etc/nginx/sites-available/default
63-
COPY etc/gzip.conf etc/security.conf etc/uploads.conf /etc/nginx/conf.d/
66+
COPY nginx.conf /etc/nginx/
67+
COPY etc/*.conf /etc/nginx/conf.d/
68+
6469
COPY nginx.sh /etc/service/nginx/run
6570
COPY phpfpm.sh /etc/service/phpfpm/run
6671

‎etc/default.conf

+45-50
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,53 @@
1-
# open_file_cache max=10000 inactive=5m;
2-
# open_file_cache_valid 1m;
3-
# open_file_cache_min_uses 1;
4-
# open_file_cache_errors on;
1+
# vim: ft=nginx ts=2 sw=2
52

63
server {
7-
listen 80 default_server;
8-
listen [::]:80 default_server ipv6only=on;
4+
listen 80 default_server;
5+
listen [::]:80 default_server ipv6only=on;
96

10-
add_header X-Frame-Options "SAMEORIGIN";
11-
add_header X-XSS-Protection "1; mode=block";
7+
add_header X-Frame-Options "SAMEORIGIN";
8+
add_header X-XSS-Protection "1; mode=block";
129

10+
# Make site accessible from http://localhost/
11+
server_name localhost;
12+
13+
location / {
1314
root /var/www/html;
1415
index index.php index.html index.htm;
1516

16-
# Make site accessible from http://localhost/
17-
server_name localhost;
18-
19-
location / {
20-
server_tokens off;
21-
# First attempt to serve request as file, then as directory, then
22-
# /index.php.
23-
try_files $uri $uri/ @reroute;
24-
# Uncomment to enable naxsi on this location
25-
# include /etc/nginx/naxsi.rules
26-
}
27-
28-
location = /favicon.ico { log_not_found off; access_log off; }
29-
location = /robots.txt { access_log off; log_not_found off; }
30-
31-
location @reroute {
32-
rewrite ^ /index.php last;
33-
}
34-
35-
# error_page 404 /index.php;
36-
37-
# pass the PHP scripts to php-fpm
38-
# Note: \.php$ is susceptible to file upload attacks
39-
# Consider using: "location ~ ^/(index|app|app_dev|config)\.php(/|$) {"
40-
location ~ \.php$ {
41-
fastcgi_split_path_info ^(.+\.php)(/.+)$;
42-
# With php5-fpm:
43-
fastcgi_pass unix:/run/php/php7.1-fpm.sock;
44-
fastcgi_index index.php;
45-
include fastcgi_params;
46-
include fastcgi.conf;
47-
fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
48-
fastcgi_param LARA_ENV local; # Environment variable for Laravel
49-
fastcgi_param HTTPS off;
50-
}
51-
52-
# deny access to .htaccess files, if Apache's document root
53-
# concurs with nginx's one
54-
55-
location ~ /\.ht {
56-
deny all;
57-
}
17+
server_tokens off;
18+
# First attempt to serve request as file, then as directory, then
19+
# /index.php.
20+
try_files $uri $uri/ @reroute;
21+
# include /etc/nginx/naxsi.rules
22+
}
23+
24+
location = /favicon.ico { log_not_found off; access_log off; }
25+
location = /robots.txt { access_log off; log_not_found off; }
26+
27+
location @reroute {
28+
rewrite ^ /index.php last;
29+
}
30+
31+
# error_page 404 /index.php;
32+
33+
# pass the PHP scripts to php-fpm
34+
# Note: \.php$ is susceptible to file upload attacks
35+
# Consider using: "location ~ ^/(index|app|app_dev|config)\.php(/|$) {"
36+
location ~ \.php$ {
37+
root /var/www/html;
38+
fastcgi_index index.php;
39+
fastcgi_split_path_info ^(.+\.php)(/.+)$;
40+
fastcgi_pass unix:/run/php/php7.1-fpm.sock;
41+
include fastcgi_params;
42+
fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
43+
fastcgi_param LARA_ENV local; # Environment variable for Laravel
44+
fastcgi_param HTTPS off;
45+
}
46+
47+
# deny access to .htaccess files, if Apache's document root
48+
# concurs with nginx's one
49+
50+
location ~ /\.ht {
51+
deny all;
52+
}
5853
}

‎nginx.conf

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
user nginx;
2+
worker_processes 1;
3+
4+
error_log /var/log/nginx/error.log warn;
5+
pid /var/run/nginx.pid;
6+
7+
8+
events {
9+
worker_connections 1024;
10+
}
11+
12+
13+
http {
14+
include /etc/nginx/mime.types;
15+
default_type application/octet-stream;
16+
17+
# open_file_cache max=10000 inactive=5m;
18+
# open_file_cache_valid 1m;
19+
# open_file_cache_min_uses 1;
20+
# open_file_cache_errors on;
21+
22+
map $remote_addr $remote_addr_anon {
23+
~(?P<ip>\d+\.\d+\.\d+)\. $ip.0;
24+
~(?P<ip>[^:]+:[^:]+): $ip::;
25+
default 0.0.0.0;
26+
}
27+
28+
log_format main '$remote_addr_anon - $remote_user [$time_local] "$request" '
29+
'$status $body_bytes_sent "$http_referer" '
30+
'"$http_user_agent" "$http_x_forwarded_for"';
31+
32+
access_log /var/log/nginx/access.log main;
33+
34+
sendfile on;
35+
#tcp_nopush on;
36+
37+
keepalive_timeout 65;
38+
39+
include /etc/nginx/conf.d/*.conf;
40+
}

‎nginx.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
#!/bin/sh
22

3-
nginx
3+
nginx -g "daemon off;"

0 commit comments

Comments
 (0)