FM / sites

/home/suroeste/public_html/payments.transportessuroeste.com/docker/nginx/sites/

/home/suroeste/public_html/payments.transportessuroeste.com/docker/nginx/sites

Name	Size	Mode	Actions
default.conf	5566	0644	edit dl rm

Edit: /home/suroeste/public_html/payments.transportessuroeste.com/docker/nginx/sites/default.conf (5566B)

# ============================================================================
# TRANSPORTES SUROESTE - Nginx Site Configuration
# ============================================================================
# API and payment pages server block
# ============================================================================

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

root /var/www/html/public;
    index index.php;

# ========================================================================
    # Security headers
    # ========================================================================
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# API-specific CSP (restrictive)
    set $csp_default "default-src 'self'";
    set $csp_script "script-src 'self'";
    set $csp_style "style-src 'self'";
    set $csp_img "img-src 'self' data:";
    set $csp_connect "connect-src 'self'";
    set $csp_frame "frame-src 'none'";
    set $csp_object "object-src 'none'";
    set $csp_base "base-uri 'self'";

# ========================================================================
    # Block access to sensitive files
    # ========================================================================
    location ~ /\.env { deny all; return 404; }
    location ~ /\.git { deny all; return 404; }
    location ~ /\.ht { deny all; return 404; }
    location ~ /composer\.(json|lock)$ { deny all; return 404; }
    location ~ /\.vscode { deny all; return 404; }
    location = /config/config.php { deny all; return 404; }
    location ^~ /vendor/ { deny all; return 404; }
    location ^~ /src/ { deny all; return 404; }
    location ^~ /config/ { deny all; return 404; }
    location ^~ /sql/ { deny all; return 404; }
    location ^~ /logs/ { deny all; return 404; }
    location ^~ /docker/ { deny all; return 404; }
    location ^~ /scripts/ { deny all; return 404; }

# ========================================================================
    # Static assets - cache headers
    # ========================================================================
    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
        add_header X-Content-Type-Options "nosniff" always;
        access_log off;
        try_files $uri =404;
    }

# ========================================================================
    # API endpoints - rate limited
    # ========================================================================
    location /api/ {
        limit_req zone=api burst=20 nodelay;
        limit_conn conn_limit 30;

# API-specific headers
        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
        add_header Pragma "no-cache" always;
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;

try_files $uri /index.php$is_args$args;
    }

# ========================================================================
    # Payment pages - relaxed CSP for ePayco
    # ========================================================================
    location /payment/ {
        limit_req zone=payment burst=5 nodelay;

try_files $uri /index.php$is_args$args;
    }

# ========================================================================
    # Health check - no rate limit
    # ========================================================================
    location = /api/v1/health {
        access_log off;
        try_files $uri /index.php$is_args$args;
    }

# ========================================================================
    # PHP-FPM handler
    # ========================================================================
    location ~ \.php$ {
        # Security: only allow index.php
        location ~ ^/index\.php$ {
            internal;
        }

# Prevent direct PHP execution
        try_files $uri =404;

fastcgi_pass php-fpm;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;

# FastCGI tuning
        fastcgi_buffer_size 32k;
        fastcgi_buffers 16 16k;
        fastcgi_busy_buffers_size 32k;
        fastcgi_connect_timeout 5s;
        fastcgi_send_timeout 30s;
        fastcgi_read_timeout 30s;

# Hide PHP headers
        fastcgi_hide_header X-Powered-By;
    }

# ========================================================================
    # Default route - front controller
    # ========================================================================
    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }

# ========================================================================
    # Deny all other dot files
    # ========================================================================
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

cmd: