Initial commit

2026-07-23 08:58:13 +08:00
commit 6fc18cf062
411 changed files with 2549 additions and 0 deletions
@@ -0,0 +1,53 @@
+# Managed by HostDesk. Sensitive application paths are explicitly denied.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name tanwan.de www.tanwan.de;
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/hostdesk/acme-http;
+        default_type text/plain;
+    }
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name tanwan.de www.tanwan.de;
+    ssl_certificate /etc/hostdesk/certificates/tanwan-de/fullchain.pem;
+    ssl_certificate_key /etc/hostdesk/certificates/tanwan-de/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_cache shared:HostDeskSSL:10m;
+    client_max_body_size 64m;
+    keepalive_timeout 65;
+    server_tokens off;
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript application/xml image/svg+xml;
+    access_log /var/log/nginx/tanwan-de.access.log;
+    error_log /var/log/nginx/tanwan-de.error.log;
+    add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/hostdesk/acme-http;
+        default_type text/plain;
+    }
+    root /var/www/tanwan.de/public;
+    index index.php index.html;
+    location = /database.sql { deny all; }
+    location = /README.md { deny all; }
+    location ^~ /database/ { deny all; }
+    location ^~ /storage/ { deny all; }
+    location ^~ /maintenance/ { deny all; }
+    location ^~ /deploy/ { deny all; }
+    location ~* \.(?:sql|sqlite|bak|backup|dist|ini|log|sh)$ { deny all; }
+    location / { try_files $uri $uri/ /index.php?$query_string; }
+    location ~ \.php$ {
+        try_files $uri =404;
+        include fastcgi.conf;
+        fastcgi_pass 127.0.0.1:9000;
+    }
+    location ~ /\. { deny all; }
+}