|
|
# 苏州科普站 Nginx 草稿：默认站点 + 上传目录禁止解析 PHP
|
|
|
# 仅供运维对照落地，不要直接覆盖线上未确认的路径/证书/php-fpm 套接字。
|
|
|
# 占位请替换：
|
|
|
# ROOT 本站 public 目录，例如 /var/www/szkp-map-service/public
|
|
|
# FPM_SOCK 本站独立 php-fpm，例如 unix:/run/php/php8.1-fpm-szkp.sock
|
|
|
# SERVER_NAME 本站域名（可多个）
|
|
|
# 不要改应用 URL：图片仍走 /storage/uploads/...
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
# 一、默认站点：扫 IP、未知 Host 不要落到本站
|
|
|
# 必须出现在本站 server 之前，或明确 listen ... default_server
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
server {
|
|
|
listen 80 default_server;
|
|
|
listen [::]:80 default_server;
|
|
|
server_name _;
|
|
|
|
|
|
# 444：直接断开，不回你站的页面/框架/路径
|
|
|
return 444;
|
|
|
}
|
|
|
|
|
|
# Nginx >= 1.19.4 推荐：HTTPS 扫 IP 时拒绝握手，不必准备假证书
|
|
|
server {
|
|
|
listen 443 ssl default_server;
|
|
|
listen [::]:443 ssl default_server;
|
|
|
server_name _;
|
|
|
ssl_reject_handshake on;
|
|
|
}
|
|
|
|
|
|
# 若当前 Nginx 不支持 ssl_reject_handshake，改用下面这段（二选一，不要两段都开）
|
|
|
# server {
|
|
|
# listen 443 ssl default_server;
|
|
|
# listen [::]:443 ssl default_server;
|
|
|
# server_name _;
|
|
|
# ssl_certificate /path/to/any.crt;
|
|
|
# ssl_certificate_key /path/to/any.key;
|
|
|
# return 444;
|
|
|
# }
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
# 二、本站（科普）正式站点
|
|
|
# 确认本站 listen 行上没有 default_server
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
server {
|
|
|
listen 80;
|
|
|
listen [::]:80;
|
|
|
server_name YOUR_SZKP_DOMAIN.example.com;
|
|
|
return 301 https://$host$request_uri;
|
|
|
}
|
|
|
|
|
|
server {
|
|
|
listen 443 ssl;
|
|
|
listen [::]:443 ssl;
|
|
|
server_name YOUR_SZKP_DOMAIN.example.com;
|
|
|
|
|
|
root /var/www/szkp-map-service/public;
|
|
|
index index.php;
|
|
|
charset utf-8;
|
|
|
|
|
|
ssl_certificate /path/to/szkp.fullchain.pem;
|
|
|
ssl_certificate_key /path/to/szkp.privkey.pem;
|
|
|
|
|
|
add_header X-Content-Type-Options nosniff always;
|
|
|
add_header X-Frame-Options SAMEORIGIN always;
|
|
|
|
|
|
# 上传目录：只当静态文件，绝不进 PHP
|
|
|
# ^~ 优先于正则，避免 *.php 落到下面的 location ~ \.php$
|
|
|
location ^~ /storage/uploads {
|
|
|
alias /var/www/szkp-map-service/storage/app/public/uploads;
|
|
|
# 若已做 public/storage 软链，可改成不写 alias，仅靠 root + try_files：
|
|
|
# try_files $uri =404;
|
|
|
|
|
|
add_header X-Content-Type-Options nosniff always;
|
|
|
types { }
|
|
|
default_type application/octet-stream;
|
|
|
|
|
|
location ~* \.(php|phtml|phar|php[0-9]|pht|phps|shtml)$ {
|
|
|
deny all;
|
|
|
return 404;
|
|
|
}
|
|
|
|
|
|
try_files $uri =404;
|
|
|
}
|
|
|
|
|
|
location / {
|
|
|
try_files $uri $uri/ /index.php?$query_string;
|
|
|
}
|
|
|
|
|
|
location = /favicon.ico { access_log off; log_not_found off; }
|
|
|
location = /robots.txt { access_log off; log_not_found off; }
|
|
|
|
|
|
location ~ \.php$ {
|
|
|
try_files $uri =404;
|
|
|
fastcgi_pass unix:/run/php/php8.1-fpm-szkp.sock;
|
|
|
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
|
|
|
include fastcgi_params;
|
|
|
fastcgi_hide_header X-Powered-By;
|
|
|
}
|
|
|
|
|
|
location ~ /\.(?!well-known).* {
|
|
|
deny all;
|
|
|
}
|
|
|
}
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
# 三、同机其他站点（如 www.szyljt.com）
|
|
|
# 若该站也能访问到同一份 storage，必须同样禁止解析，否则扫那个域名仍能打到上传文件。
|
|
|
# 把下面 location 原样放进那个站点的 server {}，路径改成实际 uploads 目录。
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
# location ^~ /storage/uploads {
|
|
|
# alias /var/www/szkp-map-service/storage/app/public/uploads;
|
|
|
# add_header X-Content-Type-Options nosniff always;
|
|
|
# location ~* \.(php|phtml|phar|php[0-9]|pht|phps|shtml)$ {
|
|
|
# deny all;
|
|
|
# return 404;
|
|
|
# }
|
|
|
# try_files $uri =404;
|
|
|
# }
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
# 落地检查（运维执行，不必改代码）
|
|
|
# 1. nginx -t && 重载
|
|
|
# 2. 浏览器或 curl 访问 http://服务器IP/ 应无本站页面（连接被关或非 200 业务页）
|
|
|
# 3. 用本站域名访问一张已有 jpg，地址仍是 /storage/uploads/xxx.jpg，能正常显示
|
|
|
# 4. 访问 /storage/uploads 下任何 .php 应为 404，且不应再被 PHP 执行
|
|
|
# 5. 本站与同机其他站使用不同 Linux 用户、不同 php-fpm 池，并限制 open_basedir
|
|
|
# ---------------------------------------------------------------------------
|
