ng.inx

# Placeholders to fill in during setup:
#
#   {domain}       bare domain, no scheme and no www
#                    example.com
#   {domain_path}  document root WITHOUT the leading slash and no trailing one
#                    var/www/example.com
#   {log_path}     directory for the nginx logs, WITHOUT the leading slash;
#                  keep it outside the document root
#                    var/log/nginx/example.com
#   {ssl_cert}     full chain certificate, WITHOUT the leading slash
#                    etc/letsencrypt/live/example.com/fullchain.pem
#   {ssl_key}      private key, WITHOUT the leading slash
#                    etc/letsencrypt/live/example.com/privkey.pem
#   {php_backend}  FPM backend, either a unix socket or a TCP address
#                    unix:/run/php/php8.4-fpm.sock   or   127.0.0.1:9000
#
#   DOMAIN=example.com
#   DOMAIN_PATH=var/www/example.com
#   LOG_PATH=var/log/nginx/example.com
#   SSL_CERT=etc/letsencrypt/live/example.com/fullchain.pem
#   SSL_KEY=etc/letsencrypt/live/example.com/privkey.pem
#   PHP_BACKEND=unix:/run/php/php8.4-fpm.sock
#
#   sed -e "s|{domain_path}|${DOMAIN_PATH}|g" \
#       -e "s|{log_path}|${LOG_PATH}|g" \
#       -e "s|{ssl_cert}|${SSL_CERT}|g" \
#       -e "s|{ssl_key}|${SSL_KEY}|g" \
#       -e "s|{php_backend}|${PHP_BACKEND}|g" \
#       -e "s|{domain}|${DOMAIN}|g" \
#       ng.inx | sudo tee /etc/nginx/sites-available/"$DOMAIN".conf > /dev/null
#
#   sudo mkdir -p /"$LOG_PATH"
#   sudo ln -s /etc/nginx/sites-available/"$DOMAIN".conf /etc/nginx/sites-enabled/
#   sudo nginx -t && sudo systemctl reload nginx
#
# nginx picks a location in this order: exact (=), then the longest prefix
# match, then the regular expressions in the order they are written here.
# A plain prefix block such as `location /core` therefore does NOT protect
# /core/composer.json against a later `location ~ \.php$` regex, so every deny
# rule below is written as a regex and placed BEFORE the PHP handler.
#
# PHP execution is an allowlist, not a filter: the only URIs passed to FPM are
# the handful of real entry points listed further down, and everything else
# ending in .php returns 404. Check that list before adding an extra.
#
# The locations are grouped into a PUBLIC SITE section and a MANAGER section
# (admin panel + installer), because the two are worth different levels of
# exposure. The manager section can be closed to all but a list of known
# addresses with the $manager_allowed allowlist defined just below.

# ---------------------------------------------------------------------
# Optional IP allowlist for the manager section (admin panel + installer).
# `geo` is only valid at http level, so it sits outside the server block.
#
# Off by default: `default 1` lets everyone through and the site behaves
# exactly as it would without this block. To lock the manager down, swap
# to `default 0` and list every address or range that may reach it.
# Nothing inside the server block needs editing - the manager locations
# already consult $manager_allowed.
#
# Behind a proxy, load balancer or CDN, $remote_addr is the proxy, not the
# visitor, and the allowlist would lock everybody out. Configure the real
# IP module first (`set_real_ip_from <proxy>;` / `real_ip_header
# X-Forwarded-For;`) and only trust proxies you control.
# ---------------------------------------------------------------------
geo $manager_allowed {
    default 1;
    # default 0;              # <- uncomment to turn the allowlist on
    # 203.0.113.10     1;     # office
    # 198.51.100.0/24  1;     # office range
    # 2001:db8::/32    1;     # IPv6 range
    # 127.0.0.1        1;     # keep local access when tunnelling in
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;                 # nginx < 1.25.1: drop this, use `listen 443 ssl http2;`
    server_name {domain} www.{domain};
    # merge_slashes off; # Uncomment this line if you want to handle double slashes from php.
    root /{domain_path};

    # Refuse anything that did not ask for one of the names above, so the
    # site cannot be reached by IP address or by a stray Host header.
    set $known_host 0;
    if ($host = {domain})     { set $known_host 1; }
    if ($host = www.{domain}) { set $known_host 1; }
    if ($known_host = 0)      { return 444; }

    # PHP builds password-reset links from SERVER_NAME when EVO_SITE_HOSTNAMES is empty, so
    # it must be the configured name ($server_name), never the Host header ($host). Sites
    # that answer to several equal hostnames should set EVO_SITE_HOSTNAMES instead:
    # $server_name is only the first name of the server_name line. The link's port is
    # SERVER_PORT, the port nginx listens on (80/443 are left out); behind a published port
    # that differs from it, set EVO_SITE_HOSTNAMES with that port (example.com:8443).

    # One canonical origin. www has to be answered rather than dropped -
    # listing it in server_name and then refusing it hands visitors a dead
    # connection - but it is redirected, not served, so sessions and CSRF
    # tokens are never split across two origins.
    if ($host = www.{domain}) { return 301 https://{domain}$request_uri; }

    ssl_certificate     /{ssl_cert};
    ssl_certificate_key /{ssl_key};
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    server_tokens off;
    keepalive_timeout 60;

    # SAMEORIGIN, not DENY: the manager UI is a frameset (manager/views/frame),
    # and DENY blocks same-origin framing too, which blanks the admin panel.
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000" always;

    index index.php index.html;
    error_page 404 /index.php?q=404;

    # Logs live outside the document root: the web server writes them, the
    # site never needs to read them, and nothing under /{domain_path} should
    # be writable by nginx that does not have to be.
    access_log /{log_path}/access.log;
    error_log  /{log_path}/error.log;

    # The file browser and the package installer both upload; the nginx
    # default of 1m rejects most real uploads with a 413.
    client_max_body_size 512M;

    # Never serve a directory index anywhere on the site.
    autoindex off;

    # Let's Encrypt / domain verification. `^~` stops regex evaluation, so this
    # must stay above the dotfile rule that would otherwise swallow it.
    location ^~ /.well-known/ { allow all; }

    # Dotfiles and dotfolders at any level (.git, .env, .htaccess, .idea, ...).
    location ~ (^|/)\. { access_log off; return 404; }

    # ---------------------------------------------------------------------
    # Directories that must never be reachable over HTTP.
    #   core    - the CMS core: config.php, .env, vendor, storage, logs, cache
    #   views   - Blade layouts of the manager UI
    #   vendor  - root level composer dependencies
    #   tmp     - scratch directory
    # ---------------------------------------------------------------------
    location ~ ^/(core|views|vendor|tmp)(/|$) { access_log off; return 404; }

    # Writable / generated areas under assets. The one exception, and it has to
    # come first: phpThumb thumbnails (Helper::phpThumb()) in assets/cache/images,
    # which pages link to - image files only, served as static files.
    location ~* ^/assets/cache/images/.+\.(jpe?g|png|gif|webp|avif|bmp|ico|wbmp)$ {
        access_log off;
        log_not_found off;
        expires max;
    }
    location ~ ^/assets/(cache|backup|export|import)(/|$) { access_log off; return 404; }

    # Root-level files that fingerprint the install or describe its layout.
    #   composer.json/.lock  exact dependency versions -> known CVEs
    #   publiccode.yml       softwareVersion, plus PHP and DB minimums
    #   phpstan.neon         analysed paths
    #   ht.access            the Apache rewrite template shipped alongside
    #   ng.inx               this file
    #   config.php.example   configuration shape
    #   AGENTS.md/README.md  repository map; not secret, just not public
    #
    # LICENSE is deliberately NOT here: it is the stock GPL-3.0 text, it
    # fingerprints nothing, and hiding it on a GPL project helps no one.
    # `artisan` is not here either - it lives in core/, not the web root,
    # and /core is already refused above.
    location ~ ^/(composer\.(json|lock)|phpstan\.neon|publiccode\.yml|AGENTS\.md|README\.md|ht\.access|ng\.inx|config\.php(\.example)?)$ {
        access_log off;
        return 404;
    }

    # Backups, dumps, editor leftovers and PHP include fragments anywhere.
    # The optional compression suffix matters: the static rule at the bottom
    # serves .gz and .zip, so without it dump.sql.gz would be downloadable.
    # `tar` is in the list for the same reason: a site-backup.tar.gz left in
    # the web root is the single most valuable file an attacker can find.
    location ~* \.(sql|sqlite|db|log|bak|old|orig|save|swp|swo|tpl|inc|ini|env|dist|example|yml|yaml|lock|tar)(\.(gz|bz2|xz|zip|tgz))?$ {
        access_log off;
        return 404;
    }

    location ~ ^/assets/.*\.php$ { access_log off; return 404; }

    # =====================================================================
    # PUBLIC SITE
    # Reachable by anyone. The front controller is the only PHP file a
    # visitor ever touches; friendly URLs reach it through @rewrite at the
    # bottom of this file.
    # =====================================================================

    location / { try_files $uri $uri/ @rewrite; }
    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    location = /index.php {
        try_files $uri @rewrite;

        include /etc/nginx/fastcgi_params;
        fastcgi_param SERVER_NAME $server_name;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS on;
        fastcgi_hide_header X-Powered-By;
        fastcgi_pass {php_backend};
    }

    # =====================================================================
    # MANAGER SECTION - admin panel and installer
    #
    # These URIs are the only ones from which the site can be changed, so
    # they are held to a higher standard than the public site above and are
    # kept together here rather than mixed in with it.
    #
    # Every block in this section consults $manager_allowed, so enabling the
    # IP allowlist at the top of this file covers the whole section in one
    # edit: PHP entry points, rewritten manager URLs, manager static assets
    # and the installer. It answers 404 rather than 403, so a blocked
    # address cannot tell a protected manager from a site that has none.
    # =====================================================================

    # Manager PHP entry points. Everything else under /manager that ends in
    # .php - processors, includes, language fragments, file browser
    # internals - is refused by the catch-all in the next section.
    #
    #   index.php                        manager front controller
    #   captcha.php                      login captcha image
    #   processors/remove_installer.processor.php
    #                                    "remove the install folder" of the installer
    #   includes/session_keepalive.php   manager session ping
    #   media/style/<theme>/ajax.php     manager ajax endpoint
    #   media/browser/<browser>/...      file browser: browse, browser, css,
    #                                    js_localize, js/browser/joiner
    #
    # <theme> and <browser> are the manager_theme / which_browser settings,
    # hence [A-Za-z0-9_-]+ rather than a hard-coded `default` / `mcpuk`.
    # Uploads go through browse.php, not a separate connector. An extra that
    # needs its own HTTP-callable PHP file has to be added to this list.
    location ~ ^/manager/(index\.php|captcha\.php|processors/remove_installer\.processor\.php|includes/session_keepalive\.php|media/style/[A-Za-z0-9_-]+/ajax\.php|media/browser/[A-Za-z0-9_-]+/(browse|browser|css|js_localize)\.php|media/browser/[A-Za-z0-9_-]+/js/browser/joiner\.php)$ {
        if ($manager_allowed = 0) { return 404; }

        try_files $uri @rewrite;

        include /etc/nginx/fastcgi_params;
        fastcgi_param SERVER_NAME $server_name;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS on;
        fastcgi_hide_header X-Powered-By;
        fastcgi_pass {php_backend};
    }

    # Manager static assets: theme CSS/JS, icons, the file browser's HTML.
    # Spelled out separately from the public static rule at the bottom so
    # the IP gate applies to them as well - a regex location wins over the
    # `location /manager` prefix, so they would otherwise slip past it.
    location ~* ^/manager/.+\.(css|js|html|txt|jpg|jpeg|gif|png|webp|svg|ico|bmp|swf|woff|woff2|ttf|otf|eot)$ {
        if ($manager_allowed = 0) { return 404; }

        access_log off;
        log_not_found off;
        expires max;
    }

    # Any other manager URL is an action name, not a file: hand it to the
    # manager front controller.
    location /manager {
        if ($manager_allowed = 0) { return 404; }

        rewrite ^/manager/(.*)$ /manager/index.php last;
    }

    # Installer. Delete or rename /install once the site is set up; until
    # then it can create an admin account, so it belongs in this section.
    # Uncomment the deny to close it off without deleting it - it has to
    # stay above the handler, as regexes are tried in order.
    # location ~ ^/install(/|$) { access_log off; return 404; }
    location ~ ^/install/index\.php$ {
        if ($manager_allowed = 0) { return 404; }

        try_files $uri @rewrite;

        include /etc/nginx/fastcgi_params;
        fastcgi_param SERVER_NAME $server_name;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS on;
        fastcgi_hide_header X-Powered-By;
        fastcgi_pass {php_backend};
    }

    # Written by the update widget, opened once, and deleted by itself.
    location = /update.php {
        if ($manager_allowed = 0) { return 404; }

        try_files $uri @rewrite;

        include /etc/nginx/fastcgi_params;
        fastcgi_param SERVER_NAME $server_name;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS on;
        fastcgi_hide_header X-Powered-By;
        fastcgi_pass {php_backend};
    }

    # =====================================================================
    # Fall-through, both sections
    # =====================================================================

    # Not an entry point in either section above, so it is never executed.
    # There is no fastcgi_split_path_info anywhere in this file: every
    # handler above is anchored with $, so /index.php/evil.php never reaches
    # FPM and the cgi.fix_pathinfo class of bypass has nothing to work with.
    location ~ \.php$ { access_log off; return 404; }

    location ~* \.(css|js|html|txt|xml|rss|atom|jpg|jpeg|gif|png|webp|avif|svg|svgz|ico|bmp|swf|woff|woff2|ttf|otf|eot|mp3|mp4|webm|ogg|ogv|wav|mid|midi|pdf|doc|docx|xls|xlsx|ppt|pptx|rtf|zip|gz|bz2|rar|7z)$ {
        access_log off;
        log_not_found off;
        expires max;
    }

    location @rewrite {
        rewrite ^(.*)$ /index.php?q=$1&$args last;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name {domain} www.{domain};

    access_log off;

    # Certificate renewals have to be answerable over plain HTTP, so this
    # stays above the redirect. `^~` keeps it out of regex comparison.
    location ^~ /.well-known/acme-challenge/ { root /{domain_path}; }

    location / { return 301 https://{domain}$request_uri; }
}