nginx.conf

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  text/plain;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;

    server {
        listen 80;
        server_name default_server;
        error_page 404  /404.html;
        include /etc/nginx/conf.d/redirects.txt;

        if ($http_user_agent ~ "(^GoogleHC).*$|(^kube-probe).*$" ) {
            return 200;
        }

        PROTO_REDIRECT_CONFIG

        ## Begin - Server Info
        root /usr/share/nginx/html;
        index index.html;
        server_tokens off;
        ## End - Server Info


        ## Begin - Security
        location ~ ^/(.well-known/security.txt|security.txt) { return 301 https://northern.tech/security.txt; }
        # deny all direct access for these folders
        location ~* /(.git|cache|bin|logs|backup|tests)/.*$ { return 404; }
        # deny running scripts inside core system folders
        location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 404; }
        # deny running scripts inside user folder
        location ~* /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 404; }
        # deny access to specific files in the root folder
        location ~ /(LICENSE.txt|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess|package.json|package-lock.json|Dockerfile|Containerfile|Makefile) { return 404; }
        ## End - Security

        # Try to keep the file uplodas in the memory:
        client_max_body_size       10m;
        client_body_buffer_size    128k;

        ## Optimizations
        # serve .gz files if found next to their uncompressed originals
        gzip_static on;

        # Configure gzip for the relevant types
        gzip_proxied any;
        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        # Security hardening
        ## Add security headers based on scan https://securityheaders.com/
        add_header X-Xss-Protection "1; mode=block" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        #add_header Content-Security-Policy "default-src https: data: 'unsafe-inline' 'unsafe-eval'" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header 'Referrer-Policy' 'strict-origin';
        # 'sha256-ruKmkK0iwJgE/F4xuzLY3V2OuzVOOJISav7NURhCKsM=' hugo discuss template (https://github.com/gohugoio/hugo/blob/master/tpl/tplimpl/embedded/templates/disqus.html)
        add_header Content-Security-Policy "default-src 'none'; style-src 'self' cdn.jsdelivr.net; connect-src 'self' *.disqus.com *.disquscdn.com *.google-analytics.com; script-src 'self' 'sha256-ruKmkK0iwJgE/F4xuzLY3V2OuzVOOJISav7NURhCKsM=' *.disqus.com *.disquscdn.com *.googletagmanager.com; object-src 'self'; img-src 'self' data: https:; font-src 'self' https:; frame-src 'self' www.google.com www.youtube.com *.disqus.com disqus.com;  manifest-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests;";

        #add_header Feature-Policy "speaker self;fullscreen self;";
        ## Block common exploits
        ## https://www.howtoforge.com/nginx-how-to-block-exploits-sql-injections-file-injections-spam-user-agents-etc
        set $block_common_exploits 0;
        if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "proc/self/environ") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") {
            set $block_common_exploits 1;
        }
        if ($query_string ~ "base64_(en|de)code\(.*\)") {
            set $block_common_exploits 1;
        }
        if ($block_common_exploits = 1) {
            return 404;
        }
        ## Block SQL injections
        set $block_sql_injections 0;
        if ($query_string ~ "union.*select.*\(") {
            set $block_sql_injections 1;
        }
        if ($query_string ~ "union.*all.*select.*") {
            set $block_sql_injections 1;
        }
        if ($query_string ~ "concat.*\(") {
            set $block_sql_injections 1;
        }
        if ($block_sql_injections = 1) {
            return 404;
        }
        ## Block file injections
        set $block_file_injections 0;
        if ($query_string ~ "[a-zA-Z0-9_]=http://") {
            set $block_file_injections 1;
        }
        if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") {
            set $block_file_injections 1;
        }
        if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") {
            set $block_file_injections 1;
        }
        if ($block_file_injections = 1) {
            return 404;
        }
        ## Block spam
        set $block_spam 0;
        if ($query_string ~ "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") {
            set $block_spam 1;
        }
        if ($query_string ~ "\b(erections|hoodia|huronriveracres|impotence|levitra|libido)\b") {
            set $block_spam 1;
        }
        if ($query_string ~ "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") {
            set $block_spam 1;
        }
        if ($query_string ~ "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") {
            set $block_spam 1;
        }
        if ($block_spam = 1) {
            return 404;
        }
        ## Common bandwidth hoggers and hacking tools.
        set $block_user_agents 0;
        if ($http_user_agent ~ "libwww-perl") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "GetRight") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "GetWeb!") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "Go!Zilla") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "Download Demon") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "Go-Ahead-Got-It") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "TurnitinBot") {
            set $block_user_agents 1;
        }
        if ($http_user_agent ~ "GrabNet") {
            set $block_user_agents 1;
        }
        if ($block_user_agents = 1) {
            return 404;
        }
    }

    # exclude CI User-Agent from the logging
    map $uri:$status:$request_method:$http_user_agent $loggable_module {
       ~(\.tar\.gz)\:200\:GET\:(?!CI$) 1;
       default 0;
    }

    map $uri $module {
        ~/modules/(?<captured_module>[^/]*)(.*(\.tar\.gz)) $captured_module;
    }

    log_format json escape=json
        '{'
        '"time_local":"$time_local",'
        '"module":"$module",'
        '"upstream_addr":"$upstream_addr",'
        '"request":"$request",'
        '"body_bytes_sent":"$body_bytes_sent",'
        '"request_time":"$request_time",'
        '"http_user_agent":"$http_user_agent"'
        '}';

    server {
         listen 81;
         server_name default_server;
         error_page 404  /404.html;
         set $bucket "cfbs.s3.amazonaws.com";

         if ($http_user_agent ~ "(^GoogleHC).*$|(^kube-probe).*$" ) {
             return 200;
         }

         location / {
             #write modules.log if file ends with .tar.gz and response code is 2xx and request method is GET
             access_log  /home/proxy/modules.log json if=$loggable_module;
             resolver 8.8.8.8 valid=60s; # resolver should be set to resolve cfbs.s3.amazonaws.com inside the container
             proxy_http_version 1.1;
             proxy_redirect off;
             proxy_set_header Connection "";
             proxy_set_header Authorization '';
             proxy_set_header Host $bucket;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_hide_header x-amz-id-2;
             proxy_hide_header x-amz-request-id;
             proxy_hide_header x-amz-meta-server-side-encryption;
             proxy_hide_header x-amz-server-side-encryption;
             proxy_hide_header Set-Cookie;
             proxy_ignore_headers Set-Cookie;
             proxy_intercept_errors on;
             proxy_pass https://$bucket;
        }

        location /stats {
            alias /home/proxy/;
            try_files stats.json = 404;
        }
    }
}