cclohmar
b93de83519
7 languages, 3 pages (What/How/Start), 80-line router, 98KB total.
Features:
- No database, no Composer, no build step — just files on disk
- nginx PHP isolation: only index.php executes
- Bot detection with browser heuristic bypass
- Rate limiting, structured weekly logs, geo-location, Telegram alerts
- Multi-language: Accept-Language auto-detect, nav dropdown
- Article sub-page routing via /start/{slug}
- Apache + Caddy config alternatives documented in Start page
- Sample config — no real keys or secrets
62 lines
1.9 KiB
Text
Executable file
62 lines
1.9 KiB
Text
Executable file
# bare-site nginx configuration
|
|
# Place this in /etc/nginx/sites-available/ and symlink to sites-enabled/
|
|
# Or include it in your main nginx.conf
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
|
|
server_name your-domain.com;
|
|
root /var/www/html; # ← set to your web root
|
|
index index.php index.html index.htm;
|
|
charset utf-8;
|
|
|
|
access_log /var/log/nginx/bare-site-access.log;
|
|
error_log /var/log/nginx/bare-site-error.log;
|
|
|
|
# Security headers
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# === THE CRITICAL RULES ===
|
|
# These three location blocks are the security foundation of bare-site.
|
|
# Do NOT change the order — nginx processes locations in order.
|
|
|
|
# 1. ONLY index.php can execute PHP
|
|
location = /index.php {
|
|
include fastcgi_params;
|
|
fastcgi_pass unix:/run/php/php8.4-fpm.sock; # ← adjust to your PHP-FPM socket
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
fastcgi_param PATH_INFO $fastcgi_path_info;
|
|
fastcgi_hide_header X-Powered-By;
|
|
}
|
|
|
|
# 2. BLOCK all other .php files from direct execution
|
|
location ~ \.php$ {
|
|
return 404;
|
|
}
|
|
|
|
# 3. Everything else routes through index.php
|
|
location / {
|
|
try_files $uri $uri/ /index.php?$query_string;
|
|
}
|
|
|
|
# === Static file caching ===
|
|
location ~ \.css$ {
|
|
access_log off;
|
|
expires max;
|
|
add_header Content-Type text/css;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
|
|
location ~* ^.+\.(jpg|jpeg|gif|png|webp|js|ico|svg|woff|woff2|ttf)$ {
|
|
access_log off;
|
|
expires max;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
|
|
# === Block sensitive files ===
|
|
location ~ /\.ht { deny all; }
|
|
location ~* \.(env|log|sql|md|yml|yaml)$ { deny all; }
|
|
}
|