cms.gooli.fun老系统的 配置文件

server
{
listen 80;
listen 443 ssl;
listen 443 quic;
http2 on;
server_name cms.gooli.fun;
index index.php index.html index.htm default.php default.htm default.html;
root /www/wwwroot/cms.gooli.fun/;

client_max_body_size 64m;          # 新增：上传整个文件夹用

#CERT-APPLY-CHECK--START
include /www/server/panel/vhost/nginx/well-known/cms.gooli.fun.conf;
#CERT-APPLY-CHECK--END
include /www/server/panel/vhost/nginx/extension/cms.gooli.fun/*.conf;

#SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则
#error_page 404/404.html;
set $isRedcert 1;
if ($server_port != 443) { set $isRedcert 2; }
if ( $uri ~ /\.well-known/ ) { set $isRedcert 1; }
if ($isRedcert != 1) { rewrite ^(/.*)$ https://$host$1 permanent; }
ssl_certificate    /www/server/panel/vhost/cert/cms.gooli.fun/fullchain.pem;
ssl_certificate_key    /www/server/panel/vhost/cert/cms.gooli.fun/privkey.pem;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_tickets on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
add_header Alt-Svc 'quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"';
error_page 497  https://$host$request_uri;
#SSL-END

#ERROR-PAGE-START
#error_page 404 /404.html;        # 新增注释：系统根没这个文件，404 会二次跳转
#error_page 502 /502.html;
#ERROR-PAGE-END

# ============ 新增：安全段（必须在 PHP include 之前）============
location ~ ^/(config|data|content|lib|docs)/ { return 404; }
location ~ ^/(cli\.php|bootstrap\.php|deploy\.sh|composer\.(json|lock)|README\.md)$ { return 404; }
location ~ ^/theme/.*\.(php|phtml|phar)$ { return 404; }

# 后台入口单独一段：生成整站可能超过默认 60s
location ~ ^/admin/(index|api|login|logout|library|media|tags|redirects|settings)\.php$ {
    try_files $uri =404;
    fastcgi_pass unix:/tmp/php-cgi-82.sock;
    fastcgi_index index.php;
    include fastcgi.conf;
    fastcgi_read_timeout 300s;
    fastcgi_buffers 16 16k;
    fastcgi_buffer_size 32k;
}
# ============ 新增结束 ============

#PHP-INFO-START
include enable-php-82.conf;
#PHP-INFO-END
#REWRITE-START
include /www/server/panel/vhost/rewrite/cms.gooli.fun.conf;
#REWRITE-END

location ~ ^/(\.user.ini|\.htaccess|\.git|\.env|\.svn|\.project|LICENSE|README.md)
{ return 404; }

location ~ \.well-known{ allow all; }
if ( $uri ~ "^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$" ) { return 403; }

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{ expires 30d; error_log /dev/null; access_log /dev/null; }
location ~ .*\.(js|css)?$
{ expires 12h; error_log /dev/null; access_log /dev/null; }

access_log  /www/wwwlogs/cms.gooli.fun.log;
error_log  /www/wwwlogs/cms.gooli.fun.error.log;

}