# --- ustawienia globalne ---------------------------------------------------
#
user  www;
worker_processes  4;

# --- za/l/adowanie potrzebnych modu/l/ow ----
#
load_module "/usr/local/libexec/nginx/ngx_http_brotli_filter_module.so";
load_module "/usr/local/libexec/nginx/ngx_http_brotli_static_module.so";

error_log  /var/log/nginx/global/error.log;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    # [...]

    server_names_hash_max_size 1024;
    server_names_hash_bucket_size  512;

    # [...]

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/global/access.log  main;

    server_tokens off;
    charset  utf-8;
    source_charset  utf-8;
    aio on;
    sendfile        off;
    #tcp_nopush     on;
    lingering_time        10s;
    max_ranges            0;
    output_buffers        2 128k;
    postpone_output       0;
    reset_timedout_connection on;
    send_timeout          10s;

    keepalive_timeout  0;
    #keepalive_timeout  65;

    brotli on;
    brotli_static on;
    brotli_types text/css text/javascript text/mathml text/plain text/xml application/x-javascript application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml;

    gzip  off;
    gzip_static on;
    gzip_buffers      256 8k;
    gzip_comp_level   9;
    gzip_http_version 1.0;
    gzip_min_length   0;
    gzip_types        text/css text/javascript text/mathml text/plain text/xml application/x-javascript application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml;
    gzip_vary         on;
    gzip_disable      "MSIE [1-6]\.(?!.*SV1)";

    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_ecdh_curve secp521r1:secp384r1;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout  5m;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

server {
    listen       10.2.2.XXX:80;
    server_name  www.mojadomena.pl;
        location / {
            return 301 https://$server_name$request_uri;
        }
        location /pma/ {
            return 301 https://mgt.mojadomena.pl/pma/;
        }
        include 014-acmele.conf;
        include 005-x-frame.conf;
}

server {
    listen       10.2.2.239:443 ssl;
    server_name  crm.limesmp.pl;

    ssl_certificate      certs/www.mojadomena.pl.chained.pem;
    ssl_certificate_key  certs/www.mojadomena.pl.key;
    ssl_dhparam          certs/www.mojadomena.pl.2048.dh.pem;

    # dla paneli, kt/ore maj/a by/c pomini/ete przez wyszukiwarki
    add_header X-Robots-Tag none;

    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload";
    add_header Public-Key-Pins 'pin-sha256="VZRoSKCpoY3HzxId7gGq25lX0sITzskJGKuwqDt/Sq8="; pin-sha256="kvC0r0fZ885Ojc2JkQLC8bFvZutAx5w2DgvVsE8LlMo="; max-age=2592000; includeSubdomains';
    ### add_header Content-Security-Policy-Report-Only "upgrade-insecure-requests; default-src https:; form-action https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; img-src 'self'; style-src 'self' 'unsafe-inline' font-src 'self' object-src 'none'; report-uri /cgi-bin/csp-report.cgi"

    # logowanie
    access_log /var/log/nginx/www.mojadomena.pl/access.log main;
    error_log /var/log/nginx/www.mojadomena.pl/error.log;

    root /var/www/htdocs/virtuls/crm.limesmp.pl/web;
    index  app.php;

    location / {
        try_files $uri $uri/ /app.php$is_args$args;
    }

    # obs/luga Let's Encrypt dla protoko/lu bez szyfrowania
    location /.well-known/ {}

    location /pma/ {
        return 301 https://ev.ath.pl/pma/;
    }

    error_page  404              /50x.html;
    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/local/www/nginx-dist;
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        fastcgi_pass   unix:/var/run/php-fpm-www.socket;
        fastcgi_param  HTTPS on;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;

    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }
        include 000-cmsploit.conf;
        include 004-pillaging-dvcs.conf;
        include 005-x-frame.conf;
}

server {
    listen 11.22.33.44 ssl http2;
    # [...]
}

server {
    listen [::1]:80 ipv6only=off;
    # [...]
}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }

    # pass the PHP scripts to FastCGI server via unix socket
    #
    location ~ \.php$ {
        fastcgi_pass   unix:/var/run/php-fpm-www.socket;
        fastcgi_param HTTPS on;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        root           html;
        fastcgi_pass   127.0.0.5:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        include        fastcgi_params;
    }

    location ~ \.php$ {
        fastcgi_pass   unix:/var/run/php-fpm-www.socket;
        fastcgi_param  PHP_ADMIN_VALUE short_open_tag=On;
        # [...]
    }

    location ~ \.php$ {
        fastcgi_pass   unix:/var/run/php-fpm-www.socket;
        fastcgi_param  PHP_ADMIN_VALUE open_basedir=/var/www/htdocs/virtuals/www.gdbd.pl/nowa-strona:/var/tmp:/usr/local/share/pear:/usr/local/share/phpmailer:/usr/local/share/adodb:/usr/local/share/smarty:/usr/local/share/fpdf:/usr/local/share/jpgraph;
        fastcgi_param  PHP_ADMIN_VALUE sys_temp_dir=/var/www/htdocs/virtuals/www.gdbd.pl/nowa-strona/tmp;
        fastcgi_param  PHP_ADMIN_VALUE upload_tmp_dir=/var/www/htdocs/virtuals/www.gdbd.pl/nowa-strona/tmp;
        fastcgi_param  PHP_ADMIN_VALUE session.save_path=/var/www/htdocs/virtuals/www.gdbd.pl/nowa-strona/tmp;
        # [...]
    }

        location ~ \.cgi$ {
            try_files $uri =404;
            gzip off;
            #rewrite ^/cgi-bin/nagios/(.*)$ /nagios/$1;
            fastcgi_pass  unix:/var/run/fcgiwrap/fcgiwrap.sock;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME  $request_filename;
            fastcgi_param REMOTE_USER $remote_user;
        }

    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload";

load_module "/usr/local/libexec/nginx/ngx_http_fancyindex_module.so";

    location /pkg/data/ {
        alias /pkg/data/logs/bulk/;
        fancyindex on;
        fancyindex_exact_size off;
    }

    location /nagios/ {
        alias /usr/local/www/nagios/;
        index index.php;
        satisfy any;
        allow 10.0.0.0/8;
        allow 127.0.0.4;
        deny all;

        auth_basic "Special Area";
        auth_basic_user_file /var/www/authdb/auth.db;
    }

    ssl_client_certificate /etc/ssl/ca.crt.pem;
    ssl_verify_client on;
    ssl_verify_depth 10;
    if ($ssl_client_verify != SUCCESS) { return 403; }

    location /kalendarz/ {
        alias /var/www/htdocs/virtuals/webdavcal/data/;

        dav_methods PUT DELETE MKCOL COPY MOVE;
        dav_ext_methods PROPFIND OPTIONS;
        dav_access user:rw  group:rw  all:r;

        create_full_put_path on;
        client_body_temp_path /var/www/htdocs/virtuals/webdavcal/tmp/;
        client_max_body_size 100m;

        limit_except GET {
            auth_basic "Strefa chroniona kalendarzy";
            auth_basic_user_file /var/www/htdocs/virtuals/webdavcal/authdb/davcal.db;
        }

        fancyindex on;
        fancyindex_exact_size off;
    }

    location /nagios/ {
        alias /usr/local/www/nagios/;
        index index.php;
        satisfy any;
        allow 10.0.0.0/8;
        allow 127.0.0.4;
        deny all;

        auth_basic "Athenasoft Special Area";
        auth_basic_user_file /var/www/authdb/ccauth.db;

        location ~ \.php$ {
            fastcgi_pass   unix:/var/run/phph-fpm.socket;
            fastcgi_param HTTPS on;
            fastcgi_index index.php;
            fastcgi_param  SCRIPT_FILENAME $request_filename;
            include        fastcgi_params;
        }
        include expires.conf;

        location ~ \.cgi$ {
            try_files $uri =404;
            gzip off;
            #rewrite ^/cgi-bin/nagios/(.*)$ /nagios/$1;
            fastcgi_pass  unix:/var/run/fcgiwrap/fcgiwrap.sock;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME  $request_filename;
            fastcgi_param REMOTE_USER $remote_user;
        }
    }

# dodanie typu pliku (mime)
types {
        application/x-ns-proxy-autoconfig dat;
}

server {
        listen                  ip.ad.dre.ss:80;
        server_name             wpad.domain.local wpad w3c.domain.local;

        access_log              /var/log/nginx/wpad.domain.local/access.log;
        error_log               /var/log/nginx/wpad.domain.local/error.log;

        root                    /var/www/htdocs/virtuals/wpad/data;

        # je/zeli kto/s poprosi o domy/slny dokument, to przekierowania na wpad.dat
        #
        location / {
                return 301 /wpad.dat;
        }

        # pr/oba zwr/ocenia pliku wpad.dat albo b/l/ad
        #
        location /wpad.dat {
                try_files /wpad.dat =404;
        }
}

server {
   # [...] ustawienia listen ,certyfikatów, logowania, itd.

    # deny running scripts inside writable directories
    location ~* /(images|cache|media|logs|tmp)/.*\.(php|pl|py|jsp|asp|sh|cgi)$ {
        return 403;
    }

    location ~ \.xml$ {
        return 403;
    }

    location / {
        try_files $uri $uri/ /index.php?$args;

        if ($request_uri ~ "^/(.*)(?<=/)index\.php/?((?<=/).*)?$") { return 301 /$1$2; }
        if ($request_uri ~ "^/(.*)(?<=/)index\.php/?((?<=/).*)?$") { return 301 /$1$2; }
        if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)"){ return 403; }
        if ($query_string ~ "base64_encode.*\(.*\)"){ return 403; }
        if ($query_string ~* "(\<|%3C).*script.*(\>|%3E)"){ return 403; }
        if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})"){ return 403; }
        if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})"){ return 403; }
    }

    location /administrator {
        satisfy any;
        allow 127.0.0.0/8;
        allow __adres_ip__;
        deny all;

        auth_basic "Firma Security Team";
        auth_basic_user_file /var/www/htdocs/virtuals/www.domain.tld/authdb/admin;
    }

    location ~ /component/users/ {
        allow 127.0.0.0/8;
        allow __adres_ip__;
        deny all;
    }

    # pass the PHP scripts to FastCGI server listening on unix socket
    #
    location ~ \.php$ {
        fastcgi_pass   unix:/var/run/php-fpm-jjanusz.socket;
        fastcgi_param HTTPS on;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        fastcgi_param   PATH_TRANSLATED $document_root/$fastcgi_path_info;
        fastcgi_param   PATH_INFO $fastcgi_path_info;
        include        fastcgi_params;
    }

    include 000-cmsploit.conf;
    include 004-dot-ht.conf;
    include 004-err-page-404.conf;
    include 004-err-page-5xx.conf;
    include 004-pillaging-dvcs.conf;
    include 005-no-logging.conf;
    include 015-csp-report.conf;

    include expires.conf;
}

    location /dspam/ {
        alias /usr/local/www/dspam/;
        index index.html;
        auth_basic "Dspam Control Center";
        auth_basic_user_file /var/www/htdocs/virtuals/__SERVER_NAME__/authdb/dspamdb;
        gzip off;
        location ~ \.cgi$ {
            fastcgi_pass  unix:/var/run/fcgiwrap/fcgiwrap.sock;
            fastcgi_index dspam.cgi;
            fastcgi_param SCRIPT_FILENAME  $request_filename;
            include fastcgi_params;
            fastcgi_param REMOTE_USER $remote_user;
            fastcgi_pass_header Authorization;
            fastcgi_intercept_errors off;
        }
        include expires.conf;
    }

charset_map  iso-8859-2  utf-8 {
    A0 C2A0 ; # no-break space
    A1 C484 ; # latin capital letter A with ogonek
[...]
}

http {
    [...]

    include charset-l2-utf8.conf;

    [...]
}

server {
    [...]

    source_charset iso-8859-2;

    [...]
}