# --- ustawienia globalne ---------------------------------------------------
#
user  www;
worker_processes  4;

# --- za/l/adowanie potrzebnych modu/l/ow ----
#
load_module "/usr/local/libexec/nginx/ngx_http_brotli_filter_module.so";
load_module "/usr/local/libexec/nginx/ngx_http_brotli_static_module.so";

error_log  /var/log/nginx/global/error.log;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/global/access.log  main;

    server_tokens off;
    charset  utf-8;
    source_charset  utf-8;
    aio on;
    sendfile        off;
    #tcp_nopush     on;
    lingering_time        10s;
    max_ranges            0;
    output_buffers        2 128k;
    postpone_output       0;
    reset_timedout_connection on;
    send_timeout          10s;

    keepalive_timeout  0;
    #keepalive_timeout  65;

    brotli on;
    brotli_static on;
    brotli_types text/css text/javascript text/mathml text/plain text/xml application/x-javascript application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml;

    gzip  off;
    gzip_static on;
    gzip_buffers      256 8k;
    gzip_comp_level   9;
    gzip_http_version 1.0;
    gzip_min_length   0;
    gzip_types        text/css text/javascript text/mathml text/plain text/xml application/x-javascript application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml;
    gzip_vary         on;
    gzip_disable      "MSIE [1-6]\.(?!.*SV1)";

    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_ecdh_curve secp521r1:secp384r1;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout  5m;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

server {
    listen       10.2.2.XXX:80;
    server_name  www.mojadomena.pl;
        location / {
            return 301 https://$server_name$request_uri;
        }
        location /pma/ {
            return 301 https://mgt.mojadomena.pl/pma/;
        }
        include 014-acmele.conf;
        include 005-x-frame.conf;
}

server {
    listen       10.2.2.239:443 ssl;
    server_name  crm.limesmp.pl;

    ssl_certificate      certs/www.mojadomena.pl.chained.pem;
    ssl_certificate_key  certs/www.mojadomena.pl.key;
    ssl_dhparam          certs/www.mojadomena.pl.2048.dh.pem;

    # dla paneli, kt/ore maj/a by/c pomini/ete przez wyszukiwarki
    add_header X-Robots-Tag none;

    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload";
    add_header Public-Key-Pins 'pin-sha256="VZRoSKCpoY3HzxId7gGq25lX0sITzskJGKuwqDt/Sq8="; pin-sha256="kvC0r0fZ885Ojc2JkQLC8bFvZutAx5w2DgvVsE8LlMo="; max-age=2592000; includeSubdomains';
    ### add_header Content-Security-Policy-Report-Only "upgrade-insecure-requests; default-src https:; form-action https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; img-src 'self'; style-src 'self' 'unsafe-inline' font-src 'self' object-src 'none'; report-uri /cgi-bin/csp-report.cgi"

    # logowanie
    access_log /var/log/nginx/www.mojadomena.pl/access.log main;
    error_log /var/log/nginx/www.mojadomena.pl/error.log;

    root /var/www/htdocs/virtuls/crm.limesmp.pl/web;
    index  app.php;

    location / {
        try_files $uri $uri/ /app.php$is_args$args;
    }

    # obs/luga Let's Encrypt dla protoko/lu bez szyfrowania
    location /.well-known/ {}

    location /pma/ {
        return 301 https://ev.ath.pl/pma/;
    }

    error_page  404              /50x.html;
    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/local/www/nginx-dist;
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        fastcgi_pass   unix:/var/run/phph-fpm.socket;
        fastcgi_param  HTTPS on;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;

    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }
        include 000-cmsploit.conf;
        include 004-pillaging-dvcs.conf;
        include 005-x-frame.conf;
}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }

    # pass the PHP scripts to FastCGI server via unix socket
    #
    location ~ \.php$ {
        fastcgi_pass   unix:/var/run/phph-fpm.socket;
        fastcgi_param HTTPS on;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        root           html;
        fastcgi_pass   127.0.0.5:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        include        fastcgi_params;
    }

        location ~ \.cgi$ {
            try_files $uri =404;
            gzip off;
            #rewrite ^/cgi-bin/nagios/(.*)$ /nagios/$1;
            fastcgi_pass  unix:/var/run/fcgiwrap/fcgiwrap.sock;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME  $request_filename;
            fastcgi_param REMOTE_USER $remote_user;
        }

    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload";

    location /nagios/ {
        alias /usr/local/www/nagios/;
        index index.php;
        satisfy any;
        allow 10.0.0.0/8;
        allow 127.0.0.4;
        deny all;

        auth_basic "Special Area";
        auth_basic_user_file /var/www/authdb/auth.db;
    }