
# THIS Example file (PHP Application) assumes Case A2!!!
# You MUST insert your IP address  at line 52
# You MUST insert your domain name at line 74
# You SHOULD update and activate line 48 to protect your specific paths to be hidden.

# A) IF the Plesk Domain "Web Server Setting" "Process PHP by nginx" is OFF then...
# 1) all ".php" script calls will be passed to Apache; use here as is.
# 2) BUT if you have manually activated PHP-FPM by cloning the domains config
#    in /etc/php5/fpm/pool.d, then you can leave it OFF but yourself pass all the
#    script requests to php-fpm - a block below does that.

# B) IF the Plesk Domain "Web Server Setting" "Process PHP by nginx" is ON then...
# Plesk sets a "location ~ \.php(/.*)?$ {" which passes the scripts to PHP-FPM.
# The problem is, that Plesk's directive block does NOT include a "try_files",
# which leaves the setup insecure and passes attack calls to FPM.

# After each modification: /etc/init.d/nginx restart
# Server Error log: /var/log/nginx/error.log
# Domain Error log: /var/www/vhosts/system/<domain>/logs/error_log
# http://wiki.nginx.org/Pitfalls
# http://www.php.net/manual/de/regexp.introduction.php

# Plesk's "location /" sends the resource request to Apache via Ports 7080/7081
# Plesk's "location /" is the ONLY prefix string location in the Plesk config,
# which means it's always the winning prefix location, and gets noted as such.
# - UNLESS we add any longer prefix string locations...
# Implying that if we want to use Nginx for everything, then we must add
# "location" statements matching ALL resource types we expect, with "try_files".
# Security via e.g. "try_files" is NOT an issue at "location /", that's then Apache's job.

# error_log /var/log/nginx/error.log debug;

# This prefix string location gets tested in phase 1, pre-empts "location /" since longer
location = /robots.txt {
 allow all;
 log_not_found off;
 access_log off;
}

# Then comes regex processing, *** which terminates on the first match ***, and the
# corresponding location configuration is used. If no match with a regular expression
# is found, then the configuration of the prefix location remembered earlier is used.
# SO the order in which regex locations appear is IMPORTANT!

# Hide sensitive areas not needing direct user access
# *First* regex match attempt ensures deny all really happens
# TODO location ~ ^/(\.ht|config/.*\.(php|inc)|login|interests|users) { deny all; }

# Copied from Plesk "Handle PHP by Nginx" config - access to statistics via Apache
location ~ ^/(plesk-stat|webstat|webstat-ssl|ftpstat|anon_ftpstat|awstats-icon) {
    proxy_pass https://##YOUR-IP##:7081;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header X-Accel-Internal /internal-nginx-static-location;
    access_log off;
}

# PHP-Handling: Best of Plesk and ownCloud and Web-Forum articles
# A match here pre-empts Plesk's "location /", sends the script to PHP-FPM
# "(?U)" sets internal "ungreedy" option, i.e. to FIRST ".php" - COOL
location ~ ^((?U).+?\.php)(/.*)?$ {
  # TR: See http://wiki.nginx.org/HttpFastcgiModule#fastcgi_split_path_info
  # TR: Directive populates $fastcgi_script_name + $fastcgi_path_info
  # TR: BUT there's a problem: http://trac.nginx.org/nginx/ticket/321
  fastcgi_split_path_info ^((?U).+\.php)(/?.+)$;
  set $path_info $fastcgi_path_info;
  # Requested PHP Scripts MUST exist exactly as named
  try_files $fastcgi_script_name =404;
  # try_files has emptied $fastcgi_path_info
  fastcgi_param PATH_INFO $path_info;
  # You can add any application-special headers to $_SERVER here
  fastcgi_pass "unix:/var/www/vhosts/system/<domain>/php-fpm.sock";
  # TR: Sets SCRIPT_FILENAME as $document_root$fastcgi_script_name
  # TR: Meaning that $fastcgi_script_name MUST be correct now!
  include /etc/nginx/fastcgi.conf;
  # access_log off;
}
# Plesk's Directives for Web User Access are not needed on this domain!

# The "generic" handling of static resources
# Note that they are all formulated securely with "try_files".

charset utf-8;
location = /nginx.conf { deny all; }

# PUT MOST FREQUENT FIRST
# try_files "uses the first found file for request processing; the processing is performed in the current context"

# If your website uses static html files rather than php, or a mix:
# Docu: "using an index file causes an internal redirect, and the
# request can be processed in a different location"
# location ~* /$ { index index.html; }

# If your website uses "pretty URLs", i.e. hiding the "index.php":
# location ~* /$ { index index.php; }

# Frequent possibly modified content valid 2 weeks in Cache
location ~* \.(js|css|htm|html|xhtml|xml|json)$ {
 try_files $uri =404;
 expires 2w;
 add_header Pragma public;
 add_header Cache-Control public;
 access_log off;
 # add_header Debug Frequent;
}

# Pics and Fonts valid 90 Days in Cache
location ~* \.(png|jpg|jpeg|gif|ico|bmp|img|ttf|otf|eot|svg|svgz|woff)$ {
 try_files $uri =404;
 expires 90d;
 add_header Pragma public;
 add_header Cache-Control public;
 access_log off;
 # add_header Debug PicFont;
}

# Zips + PDF valid 2 weeks in Cache
location ~* \.(bz2|exe|gz|pdf|rar|tgz|zip)$ {
 try_files $uri =404;
 expires 2w;
 add_header Pragma public;
 add_header Cache-Control public;
 access_log off;
 # add_header Debug ZipPDF;
}

# Media files (large) valid 1 week in Cache
location ~* \.(ac3|avi|flv|iso|mp3|mp4|mpeg|mpg|ogg|qt|rm|swf|wav)$ {
 try_files $uri =404;
 expires 1w;
 add_header Pragma public;
 add_header Cache-Control public;
 access_log off;
 # add_header Debug Media;
}

# Infrequent possibly modified content valid 3 days in Cache
location ~* \.(dat|doc|docx|dts|ppt|pptx|tar|txt|xls|xlsx)$ {
 try_files $uri =404;
 expires 3d;
 add_header Pragma public;
 add_header Cache-Control public;
 access_log off;
 # add_header Debug Infrequent;
}

# NOTE: If you select "Process PHP by nginx" in Plesk, then Plesk adds a "location ~ /$ { index index.html ... }"
# This Regex, providing indexing for anything ending in "/", is NOT ALWAYS HELPFUL, scuppers WordPress Permalinks
# It pre-empts any later regex for "/$", causing an index to be searched for in the non-existent permalink "directory"
# SO if your app uses URLs matching "^/.+/$" and needing special treatment, you'll need to "rewrite" them!

# Virtually nothing should arrive here: We've already (hopefully) done any
# special protected / allowed locations, all ".php" scripts, all static assets.

location ~ ^/.+ {
 # Allow the unrecognised type to be a file or directory, reject all else
 try_files $uri $uri/ =404;
 # Let this be logged � we want to know of anything untoward!
}

# Finally, switch gzipping on
gzip on;
gzip_proxied any;
gzip_min_length 100;
gzip_buffers 8 16k;	# number size, default 32 4k|16 8k
gzip_types text/css text/plain text/javascript application/javascript application/json application/x-javascript application/xml application/xml+rss application/xhtml+xml application/x-font-ttf application/x-font-opentype application/vnd.ms-fontobject image/svg+xml image/x-icon application/rss+xml application/atom_xml;
gzip_vary on;
gzip_comp_level 9;
gzip_http_version 1.0;
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
