diff --git a/Dockerfile b/Dockerfile index da24d2b..d40cad2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,6 +15,9 @@ RUN \ && rm /var/lib/nginx/logs \ && mkdir -p /var/lib/nginx/logs \ && ln -s /dev/stderr /var/lib/nginx/logs/error.log \ +# Create folder where the user hook into our default configs + && mkdir -p /etc/nginx/server.d/ \ + && mkdir -p /etc/nginx/location.d/ \ # Remove default content from the default $DOCUMENT_ROOT ... && rm -rf /var/www \ # ... but ensure it exists with the right owner diff --git a/etc/nginx/sites-available/redirect-apex-to-www.conf.tpl b/etc/nginx/sites-available/redirect-apex-to-www.conf.tpl index 31e10fd..1268668 100644 --- a/etc/nginx/sites-available/redirect-apex-to-www.conf.tpl +++ b/etc/nginx/sites-available/redirect-apex-to-www.conf.tpl @@ -2,5 +2,6 @@ server { listen 80; server_name ~^(?!www.)(?.+)$; + include /etc/nginx/server.d/*.conf; return {{REDIRECT_CODE}} {{REDIRECT_PROTO}}://www.$domain$request_uri; } diff --git a/etc/nginx/sites-available/redirect-www-to-apex.conf.tpl b/etc/nginx/sites-available/redirect-www-to-apex.conf.tpl index cdc463a..b695be6 100644 --- a/etc/nginx/sites-available/redirect-www-to-apex.conf.tpl +++ b/etc/nginx/sites-available/redirect-www-to-apex.conf.tpl @@ -1,5 +1,7 @@ server { listen 80; server_name ~^www.(?.+)$; + + include /etc/nginx/server.d/*.conf; return {{REDIRECT_CODE}} {{REDIRECT_PROTO}}://$domain$request_uri; } diff --git a/etc/nginx/sites-available/site.conf.tpl b/etc/nginx/sites-available/site.conf.tpl index 49237d6..393ac1d 100644 --- a/etc/nginx/sites-available/site.conf.tpl +++ b/etc/nginx/sites-available/site.conf.tpl @@ -5,10 +5,12 @@ server { index index.php index.html index.htm; location / { + include /etc/nginx/location.d/*.conf; try_files $uri $uri/ /index.php$is_args$args; } location ~ \.php$ { + include /etc/nginx/location.d/*.conf; fastcgi_pass [::]:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; @@ -18,4 +20,5 @@ server { fastcgi_param SERVER_SOFTWARE ""; } + include /etc/nginx/server.d/*.conf; } diff --git a/examples/phpinfo/docker-compose.yml b/examples/00-phpinfo/docker-compose.yml similarity index 100% rename from examples/phpinfo/docker-compose.yml rename to examples/00-phpinfo/docker-compose.yml diff --git a/examples/phpinfo-behind-https/index.php b/examples/00-phpinfo/index.php similarity index 100% rename from examples/phpinfo-behind-https/index.php rename to examples/00-phpinfo/index.php diff --git a/examples/phpinfo-behind-https/Caddyfile b/examples/01-phpinfo-behind-https/Caddyfile similarity index 100% rename from examples/phpinfo-behind-https/Caddyfile rename to examples/01-phpinfo-behind-https/Caddyfile diff --git a/examples/phpinfo-behind-https/docker-compose.yml b/examples/01-phpinfo-behind-https/docker-compose.yml similarity index 100% rename from examples/phpinfo-behind-https/docker-compose.yml rename to examples/01-phpinfo-behind-https/docker-compose.yml diff --git a/examples/phpinfo/index.php b/examples/01-phpinfo-behind-https/index.php similarity index 100% rename from examples/phpinfo/index.php rename to examples/01-phpinfo-behind-https/index.php diff --git a/examples/02-extra-headers/docker-compose.yml b/examples/02-extra-headers/docker-compose.yml new file mode 100644 index 0000000..733141f --- /dev/null +++ b/examples/02-extra-headers/docker-compose.yml @@ -0,0 +1,9 @@ +version: '3' +services: + backend: + build: ../../ + volumes: + - './index.html:/var/www/index.html' + - './headers.conf:/etc/nginx/location.d/headers.conf' + ports: + - '80:80' diff --git a/examples/02-extra-headers/headers.conf b/examples/02-extra-headers/headers.conf new file mode 100644 index 0000000..b96043b --- /dev/null +++ b/examples/02-extra-headers/headers.conf @@ -0,0 +1,25 @@ +# The X-Frame-Options header indicates whether a browser should be allowed +# to render a page within a frame or iframe. +add_header X-Frame-Options "SAMEORIGIN" always; + +# MIME type sniffing security protection +# There are very few edge cases where you wouldn't want this enabled. +add_header X-Content-Type-Options "nosniff" always; + +# The X-XSS-Protection header is used by Internet Explorer version 8+ +# The header instructs IE to enable its inbuilt anti-cross-site scripting filter. +add_header X-XSS-Protection "1; mode=block" always; + +# Prevent mobile network providers from modifying your site +# +# (!) If you are using `ngx_pagespeed`, please note that setting +# the `Cache-Control: no-transform` response header will prevent +# `PageSpeed` from rewriting `HTML` files, and, if +# `pagespeed DisableRewriteOnNoTransform off` is not used, also +# from rewriting other resources. +# +# https://developers.google.com/speed/pagespeed/module/configuration#notransform +add_header "Cache-Control" "no-transform"; + +# Force the latest IE version +add_header "X-UA-Compatible" "IE=Edge"; diff --git a/examples/02-extra-headers/index.html b/examples/02-extra-headers/index.html new file mode 100644 index 0000000..b3022c4 --- /dev/null +++ b/examples/02-extra-headers/index.html @@ -0,0 +1,3 @@ +

Extra Headers

+ +

Please open your browsers dev-tools to inspect the respone headers!