# multiOTP open source
# @version 5.9.5.1
# @date 2022-11-11
# since 5.9.0.1, http is redirected to https
# since 5.0.3.8, fastcgi_read_timeout 86400;
server {
listen 80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name localhost;
ssl_certificate /etc/multiotp/certificates/multiotp.crt;
ssl_certificate_key /etc/multiotp/certificates/multiotp.key;
# SSL v3 protocol removed due to the POODLE attack (CVE-2014-3566)
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ALL:!RC4:HIGH:!IDEA:!MD5:!aNULL:!eNULL:!EDH:!SSLv2:!ADH:!EXPORT40:!EXP:!LOW:!ADH:!AECDH:!DSS:@STRENGTH;
ssl_prefer_server_ciphers on;
root /usr/local/bin/multiotp;
index index.php;
gzip on;
gzip_comp_level 4;
gzip_disable msie6;
gzip_min_length 1000;
gzip_proxied any;
gzip_static on;
gzip_types application/xml application/x-javascript text/css text/plain;
gzip_vary on;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
try_files $uri $uri/ /index.php;
location ~* \.(appcache|manifest)$ {
expires -1;
}
location ~ /(config|log|users|tokens|devices|groups|radius|webservice) {
deny all;
return 404;
}
location ~ \.php$ {
include /etc/nginx/fastcgi_params;
try_files $uri /index.php;
fastcgi_param HTTPS on;
fastcgi_index index.php;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/php5-fpm.sock;
# since 5.0.3.8, fastcgi_read_timeout 86400;
fastcgi_read_timeout 86400;
}
location / {
try_files $uri $uri/ /index.php;
}
}
|