pqcserver/nginx.conf at main · Onion-Search-Engine/pqcserver · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
server {
    listen 80;
    server_name pqcserver.com www.pqcserver.com;

    root /var/www/pqcserver/public;

    # No upload size limit — GridFS chunked uploads
    client_max_body_size 0;
    index index.html;

    # ── Security headers ──────────────────────────────────────────────────
    add_header X-Frame-Options "SAMEORIGIN"                         always;
    add_header X-Content-Type-Options "nosniff"                     always;
    add_header X-XSS-Protection "1; mode=block"                     always;
    add_header Referrer-Policy "strict-origin-when-cross-origin"    always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://esm.sh; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com; font-src https://fonts.gstatic.com; connect-src 'self'; img-src 'self' data:;" always;

    # ── Rate limiting ─────────────────────────────────────────────────────
    limit_req_zone $binary_remote_addr zone=api:10m rate=20r/m;
    limit_req_zone $binary_remote_addr zone=register:10m rate=5r/m;

    # ── API endpoints → PHP-FPM ───────────────────────────────────────────
    location /api/ {
        limit_req zone=api burst=10 nodelay;

        # registration stricter
        location /api/user.php {
            limit_req zone=register burst=3 nodelay;
            try_files $uri =404;
            fastcgi_pass unix:/run/php/php8.3-fpm.sock;
            fastcgi_index index.php;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME /var/www/pqcserver$fastcgi_script_name;
        }

        # File upload/download — no size limit, streaming, long timeout
        location /api/file.php {
            try_files $uri =404;
            fastcgi_pass unix:/run/php/php8.3-fpm.sock;
            fastcgi_index index.php;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME /var/www/pqcserver$fastcgi_script_name;
            client_max_body_size    0;
            fastcgi_request_buffering off;
            fastcgi_read_timeout    600;
            fastcgi_send_timeout    600;
        }

        try_files $uri =404;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME /var/www/pqcserver$fastcgi_script_name;
    }

    # ── Short message links: /m/XXXXXXXX ─────────────────────────────────
    location ~ ^/m/([a-f0-9]{8})$ {
        try_files /m/index.html =404;
    }

    # ── User profiles: /u/username ────────────────────────────────────────
    location ~ ^/u/([a-z0-9_\-]{3,32})$ {
        try_files /u/index.html =404;
    }

    # ── Verify signature: /verify/ID ─────────────────────────────────────
    location ~ ^/verify/([a-f0-9]{10})$ {
        try_files /verify/index.html =404;
    }

    # ── Static pages ──────────────────────────────────────────────────────
    location / {
        try_files $uri $uri/ $uri.html =404;
    }

    # ── Cache static assets ───────────────────────────────────────────────
    location /assets/ {
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # ── Block access to config/scripts ───────────────────────────────────
    location ~ ^/(config|scripts|vendor)/ {
        deny all;
        return 404;
    }

    # ── Max upload size ───────────────────────────────────────────────────
    client_max_body_size 0;   # unlimited globally (file.php handles streams)

    # ── Gzip ──────────────────────────────────────────────────────────────
    gzip on;
    gzip_types text/plain text/css application/json application/javascript;
}