From 874aac3c5ed799ee4b6c457213b44c78be127a61 Mon Sep 17 00:00:00 2001
From: andryyy <andre.peters@debinux.de>
Date: Sun, 8 Oct 2017 22:57:34 +0200
Subject: [PATCH] [Nginx, PHP-FPM] Do not expose PHP version, example for
 nextcloud site, include custom locations to site (add site.something.custom
 to data/conf/nginx)

---
 data/assets/site.nextcloud.custom | 41 +++++++++++++++++++++++++++++++
 data/conf/nginx/site.conf         | 16 ++++++++++--
 docker-compose.yml                |  2 +-
 3 files changed, 56 insertions(+), 3 deletions(-)
 create mode 100644 data/assets/site.nextcloud.custom

diff --git a/data/assets/site.nextcloud.custom b/data/assets/site.nextcloud.custom
new file mode 100644
index 00000000..c28700b0
--- /dev/null
+++ b/data/assets/site.nextcloud.custom
@@ -0,0 +1,41 @@
+  location ^~ /nextcloud {
+    location /nextcloud {
+      rewrite ^ /nextcloud/index.php$uri;
+    }
+    location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+      deny all;
+    }
+    location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) {
+      deny all;
+    }
+    location ~ ^/nextcloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
+      fastcgi_split_path_info ^(.+\.php)(/.*)$;
+      include fastcgi_params;
+      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+      fastcgi_param PATH_INFO $fastcgi_path_info;
+      fastcgi_param HTTPS on;
+      fastcgi_param modHeadersAvailable true;
+      fastcgi_param front_controller_active true;
+      fastcgi_pass phpfpm:9000;
+      fastcgi_intercept_errors on;
+      fastcgi_request_buffering off;
+    }
+    location ~ ^/nextcloud/(?:updater|ocs-provider)(?:$|/) {
+      try_files $uri/ =404;
+      index index.php;
+    }
+    location ~ \.(?:css|js|woff|svg|gif)$ {
+      try_files $uri /nextcloud/index.php$uri$is_args$args;
+      add_header Cache-Control "public, max-age=15778463";
+      add_header X-Content-Type-Options nosniff;
+      add_header X-XSS-Protection "1; mode=block";
+      add_header X-Robots-Tag none;
+      add_header X-Download-Options noopen;
+      add_header X-Permitted-Cross-Domain-Policies none;
+      access_log off;
+    }
+    location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
+      try_files $uri /nextcloud/index.php$uri$is_args$args;
+      access_log off;
+    }
+  }
diff --git a/data/conf/nginx/site.conf b/data/conf/nginx/site.conf
index 1b5a8a3e..71424174 100644
--- a/data/conf/nginx/site.conf
+++ b/data/conf/nginx/site.conf
@@ -22,11 +22,15 @@ server {
   ssl_protocols TLSv1.2;
   ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
   ssl_prefer_server_ciphers on;
-  add_header Strict-Transport-Security "max-age=15768000; includeSubDomains";
   ssl_session_cache shared:SSL:50m;
   ssl_session_timeout 1d;
   ssl_session_tickets off;
-  add_header Strict-Transport-Security max-age=15768000;
+  add_header Strict-Transport-Security "max-age=15768000; includeSubDomains";
+  add_header X-Content-Type-Options nosniff;
+  add_header X-XSS-Protection "1; mode=block";
+  add_header X-Robots-Tag none;
+  add_header X-Download-Options noopen;
+  add_header X-Permitted-Cross-Domain-Policies none;
 
   index index.php index.html;
   include /etc/nginx/conf.d/server_name.active;
@@ -177,6 +181,8 @@ server {
     proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
     #alias /usr/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
   }
+
+  include /etc/nginx/conf.d/site.*.custom;
 }
 server {
   include /etc/nginx/conf.d/listen_plain.active;
@@ -189,6 +195,11 @@ server {
   access_log /var/log/nginx/access.log;
   absolute_redirect off;
   root /web;
+  add_header X-Content-Type-Options nosniff;
+  add_header X-XSS-Protection "1; mode=block";
+  add_header X-Robots-Tag none;
+  add_header X-Download-Options noopen;
+  add_header X-Permitted-Cross-Domain-Policies none;
 
   location ~ ^/api/v1/(.*)$ {
     try_files $uri $uri/ /json_api.php?query=$1;
@@ -333,4 +344,5 @@ server {
     #alias /usr/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
   }
 
+  include /etc/nginx/conf.d/site.*.custom;
 }
diff --git a/docker-compose.yml b/docker-compose.yml
index 78ef16c0..7a1c5e81 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -98,7 +98,7 @@ services:
     php-fpm-mailcow:
       image: mailcow/phpfpm:1.3
       build: ./data/Dockerfiles/phpfpm
-      command: "php-fpm -d date.timezone=${TZ}"
+      command: "php-fpm -d date.timezone=${TZ} expose_php=0"
       depends_on:
         - redis-mailcow
       volumes: