fix .gitignore dir negation so config/ and scripts/ are tracked

2026-08-27 16:14:23 +03:00
parent e14bfc676f
commit 34ff3a2693
19 changed files with 460 additions and 0 deletions
@@ -0,0 +1,49 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name __DOMAIN__ www.__DOMAIN__;
+
+    root  /home/bitrix/www;
+    index index.php index.html;
+    charset utf-8;
+
+    # ---- hard denies (order matters: regex locations match top-down) ----
+    location ~ /\.                                  { deny all; }  # dotfiles (.htaccess, .git...)
+    location ~* ^/(bitrix|local)/modules/.*\.php$   { deny all; }  # no direct module execution
+    location ~* ^/upload/.*\.(php|phar|phtml)$      { deny all; }  # uploads must never execute
+
+    # ---- static assets straight from disk, no PHP ----
+    location ~* ^.+\.(jpg|jpeg|gif|png|webp|avif|svg|ico|css|js|woff|woff2|ttf|eot|otf|mp3|mp4|m4a|ogg|pdf|zip|csv|xlsx?)$ {
+        expires 7d;
+        add_header Cache-Control "public";
+        access_log off;
+        try_files $uri =404;
+    }
+
+    # ---- optional rate-limit example zone (uncomment when needed) ----
+    #location /search {
+    #    limit_req zone=main_limit burst=20 nodelay;
+    #    rewrite ^(.*)$ /search/index.php last;
+    #}
+
+    # ---- Bitrix SEF routing (official pattern) ----
+    location / {
+        index index.php;
+        if (!-e $request_filename) {
+            rewrite ^(.*)$ /bitrix/urlrewrite.php last;
+        }
+    }
+
+    # ---- PHP execution ----
+    location ~ \.php$ {
+        include snippets/fastcgi-bitrix.conf;
+    }
+
+    # security headers (TLS versions added by certbot block later)
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+}
+
+# certbot --nginx will extend this file with the :443 server block,
+# redirect 80->443 and ACME challenge handling automatically.