mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-16 16:45:07 +00:00
ignacionelson
6e47d76ba6
Client file sharing, rebuilt from the ground up: a private area per client, resumable uploads, folders, groups and categories, sharing with expiry dates and download limits, comments, file versions, an activity log, a REST API, and sixteen languages. This repository begins here. ProjectSend 2 was developed privately, and that development history is not published — the previous generation remains available, with its own history, at projectsend/legacy. Free software under the GNU General Public License v2, or (at your option) any later version.
63 lines
2.4 KiB
Nginx Configuration File
63 lines
2.4 KiB
Nginx Configuration File
server {
|
|
listen 80;
|
|
server_name _;
|
|
root /var/www/html/public;
|
|
index index.php;
|
|
|
|
client_max_body_size 100m;
|
|
|
|
# The nginx version number is nobody's business but ours.
|
|
server_tokens off;
|
|
|
|
# Baseline hardening for every response. `always` so they survive error
|
|
# responses too. NOTE: nginx does not merge add_header across levels —
|
|
# a location that declares any add_header of its own inherits none of
|
|
# these, so /protected-files/ below repeats them deliberately.
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.php?$query_string;
|
|
}
|
|
|
|
# Protected file serving: PHP authorizes, nginx streams (brief §3).
|
|
# PHP responds with X-Accel-Redirect: /protected-files/<path>.
|
|
#
|
|
# This is the only location that returns bytes someone else uploaded,
|
|
# so it gets the strictest headers in the file. `sandbox` puts anything
|
|
# rendered as a document into an opaque origin with scripts disabled —
|
|
# if a payload ever does reach here with a renderable content type
|
|
# (FileThumbnailController's allowlist is the primary defence), it
|
|
# cannot touch this app's origin or the viewer's session. Images loaded
|
|
# as subresources are unaffected: a CSP on a subresource response never
|
|
# creates a browsing context, so thumbnails and previews still render.
|
|
location /protected-files/ {
|
|
internal;
|
|
alias /var/www/html/storage/app/files/;
|
|
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Content-Security-Policy "sandbox; default-src 'none'" always;
|
|
}
|
|
|
|
location ~ \.php$ {
|
|
# Never hand a path to PHP-FPM that isn't a real script on disk:
|
|
# without this, any URI ending in .php reaches the interpreter and
|
|
# PATH_INFO resolution decides what actually runs.
|
|
try_files $uri =404;
|
|
|
|
fastcgi_pass app:9000;
|
|
fastcgi_index index.php;
|
|
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
|
|
include fastcgi_params;
|
|
fastcgi_buffer_size 32k;
|
|
fastcgi_buffers 8 32k;
|
|
}
|
|
|
|
location ~ /\.(?!well-known) {
|
|
deny all;
|
|
}
|
|
}
|