shop.example.com

Nginx vhost

Tested with nginx -t on save and rolled back if invalid.

server {
    listen 80;
    listen [::]:80;
    server_name shop.example.com;

location ^~ /.well-known/acme-challenge/ {
        auth_basic off;
        allow all;
        root /var/lib/xaxa/acme;
    }

location / {
        return 301 https://$host$request_uri;
    }
}

server {
listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name shop.example.com;

ssl_certificate /etc/nginx/xaxa/sites/shop.example.com/cert.pem;
    ssl_certificate_key /etc/nginx/xaxa/sites/shop.example.com/key.pem;

# Buffered writes: no disk call per request; shows up in the Logs tab with at most 5 s delay.
    # xaxa_timed (conf.d/xaxa.conf): rt= total at the end of the line, urt= PHP/application time
    access_log /var/log/nginx/xaxa/shop.example.com-access.log xaxa_timed buffer=32k flush=5s;
    error_log /var/log/nginx/xaxa/shop.example.com-error.log;

include /etc/nginx/xaxa/sites/shop.example.com/security.conf;

client_max_body_size 128M;
add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;

location ~ /\.(?!well-known) {
        deny all;
    }

root /home/shop-example-com/htdocs/shop.example.com;
    index index.php index.html;

location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_pass unix:/run/php/xaxa-shop-example-com.sock;
        fastcgi_read_timeout 90;
    }

location = /favicon.ico {
        try_files $uri /index.php?$query_string;
        log_not_found off;
        access_log off;
    }

location = /robots.txt {
        try_files $uri /index.php?$query_string;
        log_not_found off;
        access_log off;
    }

# Static files are cached; if the file does not exist the application responds (dynamic routes ending in .png/.js).
    # Security headers are repeated because add_header here overrides the server-level ones.
    location ~* \.(css|js|mjs|map|jpg|jpeg|png|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm|ogg|mp3)$ {
        try_files $uri /index.php?$query_string;
        expires 30d;
        access_log off;
        add_header Access-Control-Allow-Origin "*" always;
add_header X-Content-Type-Options nosniff always;
        add_header Referrer-Policy strict-origin-when-cross-origin always;
    }
}

Modules, scripting and includes outside this site's folder are blocked.