up
This commit is contained in:
Lizandro Guarnizo
@@ -0,0 +1,185 @@
|
||||
# Configuración SSL para bot.u-s.app
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name bot.u-s.app localhost;
|
||||
root /var/www/html;
|
||||
index index.php index.html;
|
||||
|
||||
# SSL Certificates
|
||||
ssl_certificate /etc/nginx/ssl/server.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/server.key;
|
||||
|
||||
# SSL Configuration
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_tickets off;
|
||||
|
||||
# Modern TLS configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
# Security headers
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
|
||||
# Logs
|
||||
access_log /var/log/nginx/whatsapp-ssl-access.log;
|
||||
error_log /var/log/nginx/whatsapp-ssl-error.log warn;
|
||||
|
||||
# Aumentar timeouts para webhook
|
||||
fastcgi_read_timeout 300;
|
||||
fastcgi_send_timeout 300;
|
||||
proxy_read_timeout 300;
|
||||
proxy_send_timeout 300;
|
||||
|
||||
# Root location
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?$query_string;
|
||||
}
|
||||
|
||||
# PHP files
|
||||
location ~ \.php$ {
|
||||
try_files $uri =404;
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_index index.php;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
|
||||
# FastCGI buffers
|
||||
fastcgi_buffers 16 16k;
|
||||
fastcgi_buffer_size 32k;
|
||||
|
||||
# Importante para que webhook responda rápido
|
||||
fastcgi_buffering off;
|
||||
}
|
||||
|
||||
# Webhook endpoint
|
||||
location ~ ^/api/webhook(_optimized)?\.php$ {
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_index webhook_optimized.php;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
|
||||
fastcgi_buffering off;
|
||||
fastcgi_request_buffering off;
|
||||
fastcgi_read_timeout 60;
|
||||
fastcgi_send_timeout 60;
|
||||
|
||||
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
||||
expires off;
|
||||
}
|
||||
|
||||
# Health check endpoint
|
||||
location /health.php {
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root/health.php;
|
||||
include fastcgi_params;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# Static assets caching
|
||||
location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# Deny access to hidden files
|
||||
location ~ /\. {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
# Deny access to sensitive files
|
||||
location ~ /(?:composer\.json|composer\.lock|package\.json|\.env|\.git) {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
# Uploads directory
|
||||
location ^~ /uploads/ {
|
||||
alias /var/www/html/uploads/;
|
||||
autoindex off;
|
||||
|
||||
# Security: solo permitir ciertos tipos de archivo
|
||||
location ~* \.(php|phtml|php3|php4|php5|pl|py|cgi|sh)$ {
|
||||
deny all;
|
||||
}
|
||||
}
|
||||
|
||||
# SSE endpoint
|
||||
location ~ ^/api/sse.*\.php$ {
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
|
||||
fastcgi_buffering off;
|
||||
fastcgi_cache off;
|
||||
proxy_buffering off;
|
||||
chunked_transfer_encoding off;
|
||||
|
||||
fastcgi_read_timeout 3600;
|
||||
fastcgi_send_timeout 3600;
|
||||
keepalive_timeout 3600;
|
||||
|
||||
add_header Content-Type text/event-stream;
|
||||
add_header Cache-Control no-cache;
|
||||
add_header X-Accel-Buffering no;
|
||||
}
|
||||
}
|
||||
|
||||
# Redirección HTTP a HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name _;
|
||||
|
||||
# Para desarrollo, mantener HTTP disponible
|
||||
# Descomentar las siguientes líneas para forzar HTTPS:
|
||||
# return 301 https://$host$request_uri;
|
||||
|
||||
# Por ahora, servir también en HTTP
|
||||
root /var/www/html;
|
||||
index index.php index.html;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?$query_string;
|
||||
}
|
||||
|
||||
location ~ \.php$ {
|
||||
try_files $uri =404;
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_index index.php;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
fastcgi_buffers 16 16k;
|
||||
fastcgi_buffer_size 32k;
|
||||
fastcgi_buffering off;
|
||||
}
|
||||
|
||||
location /health.php {
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root/health.php;
|
||||
include fastcgi_params;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
access_log off;
|
||||
}
|
||||
|
||||
location ~ /\. {
|
||||
deny all;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user