admin/B24-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

init

Browse Source
This commit is contained in:
admin
2026-05-20 15:23:05 +03:00
commit 43c0739dfa
703 changed files with 61692 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
confs/nginx/inc/block.conf
+79
View File
@@ -0,0 +1,79 @@
#
# .ht files: .htpasswd, .htaccess
#
location ~* /\.ht {
deny all;
}
#
# repositories: .svn, .hg, .git
#
location ~* /\.(svn|hg|git) {
deny all;
}
#
# ignore files: .hgignore, .gitignore
#
location ~* /\.(hgignore|gitignore) {
deny all;
}
#
# tmp files without filename: .orig, .bak, .save, .old, .swp
#
location ~* /(\.(orig|bak|save|old|swp)) {
deny all;
}
#
# tmp files with filename: index.orig, index.bak, index.save, index.old, index.swp, index~
#
location ~* /*(\.(orig|bak|save|old|swp)|~)$ {
deny all;
}
#
# macos and windows special files: .DS_Store, Thumbs.db
#
location ~* /(\.DS_Store|Thumbs.db) {
deny all;
}
#
#location ~* /vendor/ {
# deny all;
#}
#
location ~* /composer {
deny all;
}
#
# bitrix internal locations
#
location ~* ^/bitrix/(modules|local_cache|stack_cache|managed_cache|php_interface) {
deny all;
}
#
location ~* ^/bitrix/\.settings\.php {
deny all;
}
#
location ~* ^/bitrix/\.settings_extra\.php {
deny all;
}
#
# upload 1c files
#
location ~* ^/upload/1c_[^/]+/ {
deny all;
}
#
# use the file system to access files outside the site (cache)
#
location ~* /\.\./ {
deny all;
}
#
location ~* ^/bitrix/html_pages/\.config\.php {
deny all;
}
#
location ~* ^/bitrix/html_pages/\.enabled {
deny all;
}
#
confs/nginx/inc/bx_temp.conf
+11
View File
@@ -0,0 +1,11 @@
#
location ~* ^/bx_tmp_download/ {
internal;
rewrite /bx_tmp_download/(.+) /.bx_temp/$1 last;
}
#
location ~* ^/.bx_temp/ {
internal;
root /opt;
}
#
confs/nginx/inc/clouds.conf
+481
View File
@@ -0,0 +1,481 @@
#
# Use nginx to return static content from cloud storage
#
location ^~ /upload/bx_cloud_upload/ {
# Amazon Simple Storage Service
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.(s3|af-south-1|ap-east-1|ap-south-1|ap-south-2|ap-southeast-1|ap-southeast-2|ap-southeast-3|ap-southeast-4|ap-northeast-1|ap-northeast-2|ap-northeast-3|ca-central-1|ca-west-1|cn-north-1|cn-northwest-1|eu-central-1|eu-central-2|eu-west-1|eu-west-2|eu-west-3|eu-south-1|eu-south-2|eu-north-1|il-central-1|me-south-1|me-central-1|sa-east-1|us-east-1|us-east-2|us-west-1|us-west-2|us-gov-east-1|us-gov-west-1)\.amazonaws\.com/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.$3.amazonaws.com/$4;
}
# Google Storage
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.commondatastorage\.googleapis\.com/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.commondatastorage.googleapis.com/$3;
}
# Rackspace Cloud Files
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.([^/:\s]+)\.([^/:\s]+)\.rackcdn\.com/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.$3.$4.rackcdn.com/$5;
}
# Clodo.ru (old)
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.clodo\.ru\:(80|443)/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.clodo.ru:$3/$4;
}
# Clodo.ru
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.clodo\.ru/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.clodo.ru/$3;
}
# Selectel
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.selcdn\.ru/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.selcdn.ru/$3;
}
# Selectel as S3 compatible storage
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.selstorage\.ru/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.selstorage.ru/$3;
}
# HotBox
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.hb\.bizmrg\.com/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.hb.bizmrg.com/$3;
}
# HotBox
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.hb\.bizmrg\.com/([^\s].+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://hb.bizmrg.com/$2;
}
# Yandex Object Storage
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.storage\.yandexcloud\.net/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.storage.yandexcloud.net/$3;
}
# Yandex Object Storage
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.storage\.yandexcloud\.net/([^\s].+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://storage.yandexcloud.net/$2;
}
# S3 compatible storage
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.io\.activecloud\.com/([^\s]+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://$2.io.activecloud.com/$3;
}
# S3 compatible storage
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.io\.activecloud\.com/([^\s].+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://io.activecloud.com/$2;
}
# Timeweb.cloud S3 compatible storage
location ~ ^/upload/bx_cloud_upload/(http[s]?)\.s3\.timeweb\.cloud/([^\s].+)$ {
internal;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
#proxy_max_temp_file_size 0;
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $1://s3.timeweb.cloud/$2;
}
# block everything else
location ~* .*$ {
deny all;
}
}
#
# cloud resize cache
#
location ^~ /upload/resize_cache/c/upload/bx_cloud_upload/ {
# Amazon
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.(s3|af-south-1|ap-east-1|ap-south-1|ap-south-2|ap-southeast-1|ap-southeast-2|ap-southeast-3|ap-southeast-4|ap-northeast-1|ap-northeast-2|ap-northeast-3|ca-central-1|ca-west-1|cn-north-1|cn-northwest-1|eu-central-1|eu-central-2|eu-west-1|eu-west-2|eu-west-3|eu-south-1|eu-south-2|eu-north-1|il-central-1|me-south-1|me-central-1|sa-east-1|us-east-1|us-east-2|us-west-1|us-west-2|us-gov-east-1|us-gov-west-1)\.amazonaws\.com/([^\s]+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://$2.$3.amazonaws.com/$4;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# Rackspace
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.([^/:\s]+)\.([^/:\s]+)\.rackcdn\.com/([^\s]+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://$2.$3.$4.rackcdn.com/$5;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# Clodo
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.clodo\.ru\:(80|443)/([^\s]+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://$2.clodo.ru:$3/$4;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# Google
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.commondatastorage\.googleapis\.com/([^\s]+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://$2.commondatastorage.googleapis.com/$3;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# Selectel
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.selcdn\.ru/([^\s]+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://$2.selcdn.ru/$3;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# Selectel as S3 compatible storage
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.selstorage\.ru/([^\s]+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://$2.selstorage.ru/$3;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# Yandex
location ~* ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.storage\.yandexcloud\.net/([^\s]+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://$2.storage.yandexcloud.net/$3;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# Yandex second option
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.storage\.yandexcloud\.net/([^\s].+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://storage.yandexcloud.net/$2;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# HotBox
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.hb\.bizmrg\.com/([^\s]+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://$2.hb.bizmrg.com/$3;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# HotBox
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.hb\.bizmrg\.com/([^\s].+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://hb.bizmrg.com/$2;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# Clodo.ru
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.clodo\.ru/([^\s]+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://$2.clodo.ru/$3;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# Timeweb.cloud S3 compatible storage
location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.s3\.timeweb\.cloud/([^\s].+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
resolver 8.8.8.8 ipv6=off;
proxy_method GET;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
if ($cdi) {
more_set_headers -s 200 'Content-Disposition: $cdi';
}
proxy_pass $1://s3.timeweb.cloud/$2;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
# block everything else
location ~* .*$ {
deny all;
}
}
#
confs/nginx/inc/composite.conf
+8
View File
@@ -0,0 +1,8 @@
#
location ~* @.*\.html$ {
internal;
# disable browser cache, php manage file
expires -1y;
add_header X-Bitrix-Composite "Nginx (file)";
}
#
confs/nginx/inc/dav.conf
+17
View File
@@ -0,0 +1,17 @@
#
location ~ ^/bitrix/groupdav.php.*$ {
if ($request_method ~ ^(PROPPATCH|MKCALENDAR)$) {
add_header Allow "OPTIONS,REPORT,CHECKAUTH,PROPFIND,MKCOL,GET,POST,PUT,DELETE,COPY,MOVE,LOCK,UNLOCK,ACL,HEAD";
return 405 "Method not allowed";
}
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root/bitrix/groupdav.php;
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass php:9000;
}
#
location ~ ^/.well-known/(caldav|carddav)$ {
rewrite ^ /bitrix/groupdav.php last;
}
#
confs/nginx/inc/errors.conf
+27
View File
@@ -0,0 +1,27 @@
# errors pages
error_page 403 /403.html;
error_page 404 /404.html;
error_page 500 /500.html;
error_page 502 /502.html;
error_page 503 /503.html;
error_page 504 /504.html;
# errors pages locations
location ^~ /403.html {
root /etc/nginx/errors;
}
location ^~ /404.html {
root /etc/nginx/errors;
}
location ^~ /500.html {
root /etc/nginx/errors;
}
location ^~ /502.html {
root /etc/nginx/errors;
}
location ^~ /503.html {
root /etc/nginx/errors;
}
location ^~ /504.html {
root /etc/nginx/errors;
}
confs/nginx/inc/modules.conf
+165
View File
@@ -0,0 +1,165 @@
#
##########################################################
#
# nginx modules - uncomment line and restart nginx
#
##########################################################
#
#
# nginx-module-brotli = brotli compression dynamic module
#
load_module "/usr/lib/nginx/modules/ngx_http_brotli_filter_module.so";
load_module "/usr/lib/nginx/modules/ngx_http_brotli_static_module.so";
#
#
# nginx-module-headers-more = headers-more dynamic module
#
load_module "/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so";
#
#
# nginx-module-zip = zip on fly dynamic module
#
load_module "/usr/lib/nginx/modules/ngx_http_zip_module.so";
#
#
# nginx-module-njs = njs dynamic module
#
#load_module "/usr/lib/nginx/modules/ngx_http_js_module.so";
#load_module "/usr/lib/nginx/modules/ngx_stream_js_module.so";
#
#
# nginx-module-geoip = geoip dynamic module
#
#load_module "/usr/lib/nginx/modules/ngx_http_geoip_module.so";
#load_module "/usr/lib/nginx/modules/ngx_stream_geoip_module.so";
#
#
# nginx-module-geoip2 = geoip2 dynamic module
#
#load_module "/usr/lib/nginx/modules/ngx_http_geoip2_module.so";
#load_module "/usr/lib/nginx/modules/ngx_stream_geoip2_module.so";
#
#
# nginx-module-image-filter = image filter dynamic module
#
#load_module "/usr/lib/nginx/modules/ngx_http_image_filter_module.so";
#
#
# nginx-module-xslt = xslt dynamic module
#
#load_module "/usr/lib/nginx/modules/ngx_http_xslt_filter_module.so";
#
#
# nginx-module-perl = perl dynamic module
#
#load_module "/usr/lib/nginx/modules/ngx_http_perl_module.so";
#
#
# nginx-module-ndk = ndk dynamic module
#
#load_module "/usr/lib/nginx/modules/ndk_http_module.so";
#
#
# nginx-module-lua = lua dynamic module
# ndk_http_module must be placed first!
#
#load_module "/usr/lib/nginx/modules/ndk_http_module.so";
#load_module "/usr/lib/nginx/modules/ngx_http_lua_module.so";
#load_module "/usr/lib/nginx/modules/ngx_stream_lua_module.so";
#
#
##########################################################
#
# nginx-debug modules - uncomment line and restart nginx-debug
#
##########################################################
#
#
# nginx-module-brotli = brotli compression dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ngx_http_brotli_filter_module-debug.so";
#load_module "/usr/lib/nginx/modules/ngx_http_brotli_static_module-debug.so";
#
#
# nginx-module-headers-more = headers-more dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ngx_http_headers_more_filter_module-debug.so";
#
#
# nginx-module-zip = zip on fly dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ngx_http_zip_module-debug.so";
#
#
# nginx-module-njs = njs dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ngx_http_js_module-debug.so";
#load_module "/usr/lib/nginx/modules/ngx_stream_js_module-debug.so";
#
#
# nginx-module-geoip = geoip dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ngx_http_geoip_module-debug.so";
#load_module "/usr/lib/nginx/modules/ngx_stream_geoip_module-debug.so";
#
#
# nginx-module-geoip2 = geoip2 dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ngx_http_geoip2_module-debug.so";
#load_module "/usr/lib/nginx/modules/ngx_stream_geoip2_module-debug.so";
#
#
# nginx-module-image-filter = image filter dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ngx_http_image_filter_module-debug.so";
#
#
# nginx-module-xslt = xslt dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ngx_http_xslt_filter_module-debug.so";
#
#
# nginx-module-perl = perl dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ngx_http_perl_module-debug.so";
#
#
# nginx-module-ndk = ndk dynamic module (debug)
#
#load_module "/usr/lib/nginx/modules/ndk_http_module-debug.so";
#
#
# nginx-module-lua = lua dynamic module (debug)
# ndk_http_module must be placed first!
#
#load_module "/usr/lib/nginx/modules/ndk_http_module-debug.so";
#load_module "/usr/lib/nginx/modules/ngx_http_lua_module-debug.so";
#load_module "/usr/lib/nginx/modules/ngx_stream_lua_module-debug.so";
#
#
##########################################################
#
confs/nginx/inc/proxy.conf
+17
View File
@@ -0,0 +1,17 @@
#
# bitrixsetup script
#
location ^~ ^(/bitrixsetup\.php)$ {
proxy_buffering off;
}
#
# pub and online + telephony and voximplant
#
#location ~* ^/(pub/|online/|services/telephony/info_receiver.php|/bitrix/tools/voximplant/) {
# add_header X-Frame-Options '' always;
# #
# location ~* ^/(pub/imconnector/|pub/imbot.php|services/telephony/info_receiver.php|bitrix/tools/voximplant/) {
# proxy_ignore_client_abort on;
# }
#}
#
confs/nginx/inc/push.conf
+31
View File
@@ -0,0 +1,31 @@
#
location ~* ^/bitrix/subws/ {
proxy_pass http://push_sub:8010;
# http://blog.martinfjordvald.com/2013/02/websockets-in-nginx/
# 12h+0.5
proxy_max_temp_file_size 0;
proxy_read_timeout 43800;
proxy_http_version 1.1;
proxy_set_header Upgrade $replace_upgrade;
proxy_set_header Connection $connection_upgrade;
}
#
location ~* ^/bitrix/sub/ {
rewrite ^/bitrix/sub/(.*)$ /bitrix/subws/$1 break;
proxy_pass http://push_sub:8010;
proxy_max_temp_file_size 0;
proxy_read_timeout 43800;
}
#
location ~* ^/bitrix/rest/ {
proxy_pass http://push_pub:9010;
proxy_max_temp_file_size 0;
proxy_read_timeout 43800;
}
#
location ~* ^/bitrix/pub/ {
proxy_pass http://push_pub:9010;
proxy_max_temp_file_size 0;
proxy_read_timeout 43800;
}
#
confs/nginx/inc/push_secure.conf
+31
View File
@@ -0,0 +1,31 @@
#
location ~* ^/bitrix/subws/ {
proxy_pass http://push_sub:8010;
# http://blog.martinfjordvald.com/2013/02/websockets-in-nginx/
# 12h+0.5
proxy_max_temp_file_size 0;
proxy_read_timeout 43800;
proxy_http_version 1.1;
proxy_set_header Upgrade $replace_upgrade;
proxy_set_header Connection $connection_upgrade;
}
#
location ~* ^/bitrix/sub/ {
rewrite ^/bitrix/sub/(.*)$ /bitrix/subws/$1 break;
proxy_pass http://push_sub:8010;
proxy_max_temp_file_size 0;
proxy_read_timeout 43800;
}
#
location ~* ^/bitrix/rest/ {
proxy_pass http://push_pub:9010;
proxy_max_temp_file_size 0;
proxy_read_timeout 43800;
}
#
location ~* ^/bitrix/pub/ {
proxy_pass http://push_pub:9010;
proxy_max_temp_file_size 0;
proxy_read_timeout 43800;
}
#
confs/nginx/inc/static.conf
+92
View File
@@ -0,0 +1,92 @@
#
# static files
#
location ~* ^.+\.(jpg|jpeg|gif|png|svg|js|css|mp3|ogg|mpe?g|avi|zip|gz|bz2?|rar|html|htm|xml|jpg|jpeg|gif|png|css|flv|js|wmv|mp4|bmp|swf|ico|txt|otf|woff|woff2|ttf|eot|map|wav|tar|7z)$ {
log_not_found off;
access_log off;
expires 30d;
add_header Cache-Control public;
}
#
# internal sources
#
location ~ (/bitrix/modules|/upload/support/not_image|/bitrix/php_interface|local/modules|local/php_interface) {
internal;
}
#
# accept access for merged css and js
#
location ~* ^/bitrix/cache/(css/.+\.css|js/.+\.js)$ {
expires 30d;
}
#
# static content
#
location ~* ^/(upload|bitrix/images|bitrix/tmp) {
set $cdi $upstream_http_x_cd_info;
if ($cdi) {
more_set_headers -s 200 'Content-Disposition:$cdi';
}
expires 30d;
}
#
# fix xss on svg files in /upload/*
#
location ~* ^/upload/.+\.svg$ {
add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox";
}
#
# download file from /upload/*, do not execute
#
location ~* ^/upload/.*([^/]+)\.(html|htm|php|php3|php4|php5|php6|phtml|pl|asp|aspx|cgi|dll|exe|shtm|shtml|fcg|fcgi|fpl|asmx|pht)$ {
add_header Content-Disposition "attachment";
}
#
# upload sizes
#
location ~ /upload/ {
client_body_buffer_size 1024m;
client_max_body_size 1024m;
}
#
# local resize cache
#
location ~* ^/upload/resize_cache/x/(.+)$ {
internal;
set $new_uri $upstream_http_x_gen_src;
set $cdi $upstream_http_x_cd_info;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Server $host;
more_clear_input_headers 'Authorization';
if ($cdi) {
more_set_headers -s 200 'Content-Disposition:$cdi';
}
proxy_set_header "cookie" "";
proxy_set_header "content-type" "";
proxy_set_header "content-length" "";
proxy_pass $scheme://$host/upload/resize_cache/$1;
proxy_intercept_errors on;
error_page 403 404 500 502 503 504 = /$new_uri;
}
#
# favicon.png
#
location = /favicon.png {
log_not_found off;
access_log off;
}
#
# robots.txt
#
location = /robots.txt {
log_not_found off;
access_log off;
}
#
# player options, disable no-sniff
#
location ~* ^/bitrix/components/bitrix/player/mediaplayer/player$ {
add_header Access-Control-Allow-Origin *;
}
#