cluster

Infrastructure files for Nordgedanken and Midnightthoughts.
git clone git://archive.git.mtrnord.blog/MTRNord/cluster.git
Log | Files | Refs | README

wordpress.conf (4342B)

      1 limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
      2 
      3 # Use an upstream for php-fpm so php backend can be referenced consistently
      4 upstream phpfpm {
      5     # unix socket for the php8.4-fpm pool
      6     server unix:/var/run/php/php8.4-fpm.sock;
      7     # keepalive connections to improve latency when talking to php-fpm
      8     keepalive 32;
      9     # fallback to TCP socket if needed (uncomment and configure host:port)
     10     # server 127.0.0.1:9000;
     11     ip_hash;
     12 }
     13 
     14 server {
     15     listen 8080;
     16     root /var/www/html/wordpress;
     17     index index.php;
     18 
     19     access_log stdout;
     20     error_log stderr;
     21     set $cache_uri $request_uri;
     22 
     23     server_name _;
     24 
     25     add_header Strict-Transport-Security "max-age=31536000" always;
     26 
     27     # Allow access to /.well-known/matrix before dotfile deny rule
     28     location /.well-known/matrix {
     29         alias /var/www/html/well-known/;
     30         default_type application/json;
     31         types { }
     32         # add_header Content-Type application/json;
     33         # Ensure cors headers are set
     34         add_header 'Access-Control-Allow-Origin' '*';
     35         add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
     36 
     37         # Set caching headers
     38         expires max;
     39 
     40         try_files $uri $uri.json =404;
     41     }
     42 
     43     # Forward all other /.well-known requests to WordPress
     44     location ^~ /.well-known {
     45         try_files $uri $uri/ /index.php$is_args$args;
     46     }
     47 
     48     location = /favicon.ico {
     49         log_not_found off;
     50         access_log off;
     51     }
     52 
     53     location = /robots.txt {
     54         allow all;
     55         log_not_found off;
     56         access_log off;
     57     }
     58 
     59     # Deny public access to wp-config.php
     60     location ~* wp-config.php {
     61         deny all;
     62     }
     63 
     64     # Deny access to wp-login.php
     65     location = /wp-login.php {
     66         limit_req zone=one burst=1 nodelay;
     67         try_files $uri =404;
     68 
     69         include fastcgi.conf;
     70         fastcgi_intercept_errors on;
     71         fastcgi_read_timeout 60s;
     72         proxy_read_timeout 60s;
     73         fastcgi_keep_conn on;
     74         fastcgi_pass phpfpm;
     75     }
     76 
     77     location ~* /.well-known/webfinger {
     78         default_type application/activity+json;
     79         add_header Vary Accept;
     80     }
     81 
     82     # Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac), except for /.well-known/matrix
     83     # Only match files or directories that start with a dot (hidden files), not all files containing a dot
     84     location ~ ^/(?!\.well-known)(\.[^/]+) {
     85         deny all;
     86     }
     87 
     88     # Deny access to any files with a .php extension in the uploads directory
     89     # Works in sub-directory installs and also in multisite network
     90     # Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)
     91     location ~* /(?:uploads|files)/.*\.php$ {
     92         deny all;
     93     }
     94 
     95     # POST requests and URLs with a query string should always go to PHP
     96     if ($request_method = POST) {
     97         set $cache_uri 'null cache';
     98     }
     99 
    100     if ($query_string != "") {
    101         set $cache_uri 'null cache';
    102     }
    103 
    104     # Don't cache URIs containing the following segments or /wp-json/activitypub
    105     if ($request_uri ~* "(/wp-admin/|/xmlrpc.php|/wp-(app|cron|login|register|mail).php|wp-.*.php|/feed/|index.php|wp-comments-popup.php|wp-links-opml.php|wp-locations.php |sitemap(_index)?.xml|[a-z0-9_-]+-sitemap([0-9]+)?.xml|/wp-json/activitypub)") {
    106         set $cache_uri 'null cache';
    107     }
    108 
    109     # Don't use the cache for logged-in users or recent commenters
    110     if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_logged_in") {
    111         set $cache_uri 'null cache';
    112     }
    113 
    114     # Use cached or actual file if it exists, otherwise pass request to WordPress
    115     location / {
    116         try_files /wp-content/cache/supercache/$http_host/$cache_uri/index-https.html $uri $uri/ /index.php$is_args$args;
    117     }
    118 
    119     location ~ \.php$ {
    120         try_files $uri =404;
    121 
    122         include fastcgi.conf;
    123         fastcgi_intercept_errors on;
    124         fastcgi_read_timeout 60s;
    125         proxy_read_timeout 60s;
    126         fastcgi_keep_conn on;
    127         fastcgi_pass phpfpm;
    128     }
    129 
    130     location ~* \.(avif|ogg|ogv|svg|svgz|eot|otf|woff|woff2|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
    131         expires max;
    132         log_not_found off;
    133         access_log off;
    134     }
    135 
    136     location = /wp-admin/install.php {
    137        deny all;
    138     }
    139 }