nginx.conf

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  text/plain;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;

    server {
        listen 80;
        server_name default_server;
        error_page 404  /404.html;
        include /etc/nginx/conf.d/redirects.txt;

        if ($http_user_agent ~ "(^GoogleHC).*$|(^kube-probe).*$" ) {
            return 200;
        }

        PROTO_REDIRECT_CONFIG

        if ($host ~* ^www\.(.*)) {
            set $host_without_www $1;
            rewrite ^(.*) https://$host_without_www$1 permanent;
        }

        ## Begin - Server Info
        root /usr/share/nginx/html;
        index index.html;
        server_tokens off;
        ## End - Server Info

        ## Search API proxy
        location /api/search {
            proxy_read_timeout 30s;
            proxy_connect_timeout 30s;
            proxy_pass http://127.0.0.1:8082;
        }

        ## Begin - Security
        location ~ ^/(.well-known/security.txt|security.txt) {
            return 301 https://northern.tech/security.txt;
        }

        # deny all direct access for these folders
        location ~* /(.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
        # deny running scripts inside core system folders
        location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
        # deny running scripts inside user folder
        location ~* /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
        # deny access to specific files in the root folder
        location ~ /(LICENSE.txt|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess) { return 403; }
        ## End - Security

        # Try to keep the file uplodas in the memory:
        client_max_body_size       10m;
        client_body_buffer_size    128k;

        ## Optimizations
        # serve .gz files if found next to their uncompressed originals
        gzip_static on;
        gzip_proxied any;

        # Security hardening
        ## Add security headers based on scan https://securityheaders.com/
        add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; connect-src 'self' www.google-analytics.com stats.g.doubleclick.net; script-src 'self' https: 'unsafe-inline'; object-src 'self'; img-src 'self' data: https:; font-src 'self' https:; frame-src 'self' www.google.com www.youtube.com; manifest-src 'self'; base-uri 'self'; form-action 'self' webto.salesforce.com; frame-ancestors 'self'; block-all-mixed-content; upgrade-insecure-requests;";
        add_header Permissions-Policy "camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()";
        add_header Referrer-Policy 'strict-origin';
        add_header Strict-Transport-Security "max-age=31536000;" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Xss-Protection "1; mode=block" always;

        ## Block common exploits
        ## https://www.howtoforge.com/nginx-how-to-block-exploits-sql-injections-file-injections-spam-user-agents-etc
        set $block_common_exploits 0;
        if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "proc/self/environ") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "base64_(en|de)code\(.*\)") {
            set $block_common_exploits 1;
        }
        if ($block_common_exploits = 1) {
            return 403;
        }
        ## Block SQL injections
        set $block_sql_injections 0;
        if ($query_string ~ "union.*select.*\(") {
            set $block_sql_injections 1;
        }
        if ($query_string ~ "union.*all.*select.*") {
            set $block_sql_injections 1;
        }
        if ($query_string ~ "concat.*\(") {
            set $block_sql_injections 1;
        }
        if ($block_sql_injections = 1) {
            return 403;
        }
        ## Block file injections
        set $block_file_injections 0;
        if ($query_string ~ "[a-zA-Z0-9_]=http://") {
            set $block_file_injections 1;
        }
        if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") {
            set $block_file_injections 1;
        }
        if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") {
            set $block_file_injections 1;
        }
        if ($block_file_injections = 1) {
            return 403;
        }
        ## Block spam
        set $block_spam 0;
        if ($query_string ~ "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") {
            set $block_spam 1;
        }
        if ($query_string ~ "\b(erections|hoodia|huronriveracres|impotence|levitra|libido)\b") {
            set $block_spam 1;
        }
        if ($query_string ~ "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") {
            set $block_spam 1;
        }
        if ($query_string ~ "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") {
            set $block_spam 1;
        }
        if ($block_spam = 1) {
            return 403;
        }
        ## Common bandwidth hoggers and hacking tools.
        set $block_user_agents 0;
        if ($http_user_agent ~ "libwww-perl") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "GetRight") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "GetWeb!") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "Go!Zilla") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "Download Demon") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "Go-Ahead-Got-It") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "TurnitinBot") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "GrabNet") {
            set $block_user_agents 1;
        }
        if ($block_user_agents = 1) {
            return 403;
        }
    }
}