/home/suroeste/public_html/payments.transportessuroeste.com/docker/nginx/sites
Edit: /home/suroeste/public_html/payments.transportessuroeste.com/docker/nginx/sites/default.conf (5566B)
# ============================================================================
# TRANSPORTES SUROESTE - Nginx Site Configuration
# ============================================================================
# API and payment pages server block
# ============================================================================
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
root /var/www/html/public;
index index.php;
# ========================================================================
# Security headers
# ========================================================================
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# API-specific CSP (restrictive)
set $csp_default "default-src 'self'";
set $csp_script "script-src 'self'";
set $csp_style "style-src 'self'";
set $csp_img "img-src 'self' data:";
set $csp_connect "connect-src 'self'";
set $csp_frame "frame-src 'none'";
set $csp_object "object-src 'none'";
set $csp_base "base-uri 'self'";
# ========================================================================
# Block access to sensitive files
# ========================================================================
location ~ /\.env { deny all; return 404; }
location ~ /\.git { deny all; return 404; }
location ~ /\.ht { deny all; return 404; }
location ~ /composer\.(json|lock)$ { deny all; return 404; }
location ~ /\.vscode { deny all; return 404; }
location = /config/config.php { deny all; return 404; }
location ^~ /vendor/ { deny all; return 404; }
location ^~ /src/ { deny all; return 404; }
location ^~ /config/ { deny all; return 404; }
location ^~ /sql/ { deny all; return 404; }
location ^~ /logs/ { deny all; return 404; }
location ^~ /docker/ { deny all; return 404; }
location ^~ /scripts/ { deny all; return 404; }
# ========================================================================
# Static assets - cache headers
# ========================================================================
location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
expires 30d;
add_header Cache-Control "public, no-transform";
add_header X-Content-Type-Options "nosniff" always;
access_log off;
try_files $uri =404;
}
# ========================================================================
# API endpoints - rate limited
# ========================================================================
location /api/ {
limit_req zone=api burst=20 nodelay;
limit_conn conn_limit 30;
# API-specific headers
add_header Cache-Control "no-store, no-cache, must-revalidate" always;
add_header Pragma "no-cache" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
try_files $uri /index.php$is_args$args;
}
# ========================================================================
# Payment pages - relaxed CSP for ePayco
# ========================================================================
location /payment/ {
limit_req zone=payment burst=5 nodelay;
try_files $uri /index.php$is_args$args;
}
# ========================================================================
# Health check - no rate limit
# ========================================================================
location = /api/v1/health {
access_log off;
try_files $uri /index.php$is_args$args;
}
# ========================================================================
# PHP-FPM handler
# ========================================================================
location ~ \.php$ {
# Security: only allow index.php
location ~ ^/index\.php$ {
internal;
}
# Prevent direct PHP execution
try_files $uri =404;
fastcgi_pass php-fpm;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
# FastCGI tuning
fastcgi_buffer_size 32k;
fastcgi_buffers 16 16k;
fastcgi_busy_buffers_size 32k;
fastcgi_connect_timeout 5s;
fastcgi_send_timeout 30s;
fastcgi_read_timeout 30s;
# Hide PHP headers
fastcgi_hide_header X-Powered-By;
}
# ========================================================================
# Default route - front controller
# ========================================================================
location / {
try_files $uri $uri/ /index.php$is_args$args;
}
# ========================================================================
# Deny all other dot files
# ========================================================================
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
}