99 lines
4.4 KiB
Plaintext
99 lines
4.4 KiB
Plaintext
# ============================================================
|
||
# 酷冰甲官网 - 宝塔(Nginx) 站点配置 coolcoth.com
|
||
# 运行目录 = /public，PHP 入口 index.php
|
||
# ------------------------------------------------------------
|
||
# 两种用法（二选一）：
|
||
# A. 高级：宝塔 -> 网站 -> 设置 -> 配置文件，整体替换为下方完整 server 块
|
||
# B. 普通：宝塔新建站点后，仅把下方「伪静态区」内容粘到「伪静态」框，
|
||
# 再用「设置 -> 重定向」开启 https + www 跳转（见文件末尾说明）
|
||
# ============================================================
|
||
|
||
# ---------- 完整版 server 块（用法 A）----------
|
||
server {
|
||
listen 80;
|
||
server_name coolcoth.com www.coolcoth.com;
|
||
|
||
# HTTP -> HTTPS，并规范到 www（延续原 Apache 的 www 优先策略）
|
||
return 301 https://www.coolcoth.com$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name coolcoth.com www.coolcoth.com;
|
||
|
||
root /www/wwwroot/coolcoth.com/public; # 运行目录 = /public
|
||
index index.php index.html;
|
||
|
||
# ── SSL 证书（宝塔申请 Let's Encrypt 后自动填充，或手动指定）──
|
||
# ssl_certificate /www/server/panel/vhost/cert/coolcoth.com/fullchain.pem;
|
||
# ssl_certificate_key /www/server/panel/vhost/cert/coolcoth.com/privkey.pem;
|
||
# ssl_protocols TLSv1.2 TLSv1.3;
|
||
# ssl_ciphers HIGH:!aNULL:!MD5;
|
||
|
||
# ── 通用安全响应头（Nginx 层统一下发，含静态资源；
|
||
# CSP 含动态 nonce，由 PHP Helper::apply_security_headers() 下发，勿在此重复）──
|
||
add_header X-Frame-Options "DENY" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||
add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()" always;
|
||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||
|
||
# ── Let's Encrypt HTTP-01 验证（运行目录=/public 时必须，否则签发 404）──
|
||
location ^~ /.well-known/acme-challenge/ {
|
||
root /www/wwwroot/coolcoth.com; # 真实根目录（不含 /public）
|
||
default_type text/plain;
|
||
try_files $uri =404;
|
||
}
|
||
|
||
# ── 静态资源长缓存 ──
|
||
location ~* \.(css|js|png|jpg|jpeg|gif|svg|ico|webp|woff2?|ttf|eot)$ {
|
||
expires 1y;
|
||
add_header Cache-Control "public";
|
||
}
|
||
|
||
# ── 前端控制器：真实文件直接服务，其余转发 index.php ──
|
||
location / {
|
||
try_files $uri $uri/ /index.php?$query_string;
|
||
}
|
||
|
||
# ── PHP ──
|
||
location ~ \.php$ {
|
||
# 禁止敏感目录下的 PHP 被执行
|
||
location ~ /(app|config|storage|routes|vendor)/.*\.php$ { return 404; }
|
||
fastcgi_pass unix:/tmp/php-cgi-74.sock; # 按宝塔实际 PHP 版本调整（如 php-cgi-80.sock / php-cgi-82.sock）
|
||
fastcgi_index index.php;
|
||
include fastcgi.conf;
|
||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||
}
|
||
|
||
# ── 禁止访问敏感文件 ──
|
||
location ~ \.(env|git|svn|htaccess|htpasswd|ini|log|bak|old|swp|sql|zip|gz|yml|md|lock|user\.ini)$ {
|
||
deny all;
|
||
}
|
||
}
|
||
|
||
# ============================================================
|
||
# 伪静态区（用法 B：粘贴到宝塔「伪静态」框）
|
||
# ------------------------------------------------------------
|
||
# location ^~ /.well-known/acme-challenge/ {
|
||
# root /www/wwwroot/coolcoth.com;
|
||
# default_type text/plain;
|
||
# try_files $uri =404;
|
||
# }
|
||
#
|
||
# location / {
|
||
# try_files $uri $uri/ /index.php?$query_string;
|
||
# }
|
||
#
|
||
# 安全响应头在宝塔「配置文件的 443 server 块」用 add_header ... always; 添加，
|
||
# 或保持现状由 PHP 下发（index.php 已全局调用 apply_security_headers()）。
|
||
# ============================================================
|
||
#
|
||
# 用法 B 的「重定向」设置（宝塔 -> 网站 -> 设置 -> 重定向）：
|
||
# 开启重定向 -> 名称任意 -> 类型 301
|
||
# 域名：coolcoth.com 目标 URL：https://www.coolcoth.com$CACHE_URL$REQ_ARGS
|
||
# （宝塔会自动把 http:// 与 https:// 都重定向至 www；若想用裸域作主，目标改为 https://coolcoth.com）
|
||
# ============================================================
|