From 106e797edb5ad3f30676bc92d823215651cd5ee4 Mon Sep 17 00:00:00 2001
From: Mende <Mende@his.de>
Date: Fri, 27 Nov 2020 16:51:04 +0100
Subject: [PATCH] added globals

---
 playbooks/nginx/main.yml        | 20 +++++++++++++++++
 playbooks/nginx/php.j2          | 17 ++++++++++++++
 playbooks/nginx/restrictions.j2 | 39 +++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+)
 create mode 100644 playbooks/nginx/php.j2
 create mode 100644 playbooks/nginx/restrictions.j2

diff --git a/playbooks/nginx/main.yml b/playbooks/nginx/main.yml
index 1ff150f..adcd9b7 100644
--- a/playbooks/nginx/main.yml
+++ b/playbooks/nginx/main.yml
@@ -20,6 +20,26 @@
       notify:
         - "Restart nginx"
 
+    - name: "Generate global restrictions"
+      template:
+        src: ./restrictions.j2
+        dest: /etc/nginx/global/restrictions.conf
+        owner: root
+        group: root
+        mode: 0644
+      notify:
+        - "Restart nginx"
+
+    - name: "Generate global php config"
+      template:
+        src: ./php.j2
+        dest: /etc/nginx/global/php.conf
+        owner: root
+        group: root
+        mode: 0644
+      notify:
+        - "Restart nginx"
+
     - name: "Generate default config"
       template:
         src: ./default.j2
diff --git a/playbooks/nginx/php.j2 b/playbooks/nginx/php.j2
new file mode 100644
index 0000000..beb5993
--- /dev/null
+++ b/playbooks/nginx/php.j2
@@ -0,0 +1,17 @@
+##
+# global php settings
+##
+
+#server {
+
+    # using php-fpm socket module
+    location ~ \.php$ {
+        include snippets/fastcgi-php.conf;
+        #
+        # With php-fpm (or other unix sockets):
+        fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+        # With php-cgi (or other tcp sockets):
+        # fastcgi_pass 127.0.0.1:9000;
+    }
+
+#}
\ No newline at end of file
diff --git a/playbooks/nginx/restrictions.j2 b/playbooks/nginx/restrictions.j2
new file mode 100644
index 0000000..39ce61e
--- /dev/null
+++ b/playbooks/nginx/restrictions.j2
@@ -0,0 +1,39 @@
+# Global restrictions configuration file.
+# Designed to be included in any server {} block.
+location = /favicon.ico {
+        log_not_found off;
+        access_log off;
+}
+# robots.txt fallback to index.php
+location = /robots.txt {
+# Some WordPress plugin gererate robots.txt file
+    allow all;
+    try_files $uri $uri/ /index.php?$args @robots;
+    access_log off;
+    log_not_found off;
+}
+# additional fallback if robots.txt doesn't exist
+location @robots {
+   return 200 "User-agent: *\nDisallow: /wp-admin/\nAllow: /wp-admin/admin-ajax.php\n";
+}
+
+# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac) excepted .well-known directory.
+# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)
+location ~ /\.(?!well-known\/) {
+    deny all;
+}
+
+# Deny access to any files with a .php extension in the uploads directory for the single site
+location /wp-content/uploads {
+    location ~ \.php$ {
+        deny all;
+    }
+}
+
+
+# Deny access to any files with a .php extension in the uploads directory
+# Works in sub-directory installs and also in multisite network
+# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)
+location ~* /(?:uploads|files)/.*\.php$ {
+        deny all;
+}
\ No newline at end of file