zzgandClaude Opus 5.5
506bc20652
Serves the same fields and formats as the old PHP scripts, with HTML/XML/CSV output escaped, X-Real-IP trusted only from loopback, and a 2s reverse-DNS timeout. m.z.gd becomes an nginx return. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
947 B
Plaintext
33 lines
947 B
Plaintext
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name i.z.gd;
|
|
server_tokens off;
|
|
|
|
root /srv/http/i.z.gd;
|
|
|
|
charset utf-8;
|
|
|
|
ssl_certificate /usr/local/etc/letsencrypt/live/i.z.gd/fullchain.pem;
|
|
ssl_certificate_key /usr/local/etc/letsencrypt/live/i.z.gd/privkey.pem;
|
|
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
|
|
add_header X-Frame-Options DENY;
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
add_header Content-Security-Policy "default-src 'self'; style-src * 'unsafe-inline'";
|
|
|
|
location = / {
|
|
proxy_pass http://127.0.0.1:8490;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
|
|
location = /index.php {
|
|
proxy_pass http://127.0.0.1:8490;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
}
|