Instalasi Nginx-Joomla pada Linux¶

cp /etc/nginx/nginx.conf{,.`date +%Y%m%d%H%M`}
cat << EOF > /etc/nginx/nginx.conf
# Brotli
load_module modules/ngx_http_brotli_filter_module.so;
load_module modules/ngx_http_brotli_static_module.so;

user                 nginx;
pid                  /var/run/nginx.pid;
worker_processes     auto;
worker_rlimit_nofile 65535;

events {
    multi_accept       on;
    worker_connections 65535;
}

http {
    charset              utf-8;
    sendfile             on;
    tcp_nopush           on;
    tcp_nodelay          on;
    server_tokens        off;
    types_hash_max_size  2048;
    client_max_body_size 16M;

    # MIME
    include              mime.types;
    default_type         application/octet-stream;

    # Logging
    access_log           /var/log/nginx/access.log;
    error_log            /var/log/nginx/error.log warn;

    # Limits
    limit_req_log_level  warn;
    limit_req_zone       \$binary_remote_addr zone=login:10m rate=10r/m;

    # SSL
    ssl_session_timeout  1d;
    ssl_session_cache    shared:SSL:10m;
    ssl_session_tickets  off;

    # Diffie-Hellman parameter for DHE ciphersuites
    ssl_dhparam          /etc/nginx/dhparam.pem;

    # Mozilla Intermediate configuration
    ssl_protocols        TLSv1.2 TLSv1.3;
    ssl_ciphers          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    # OCSP Stapling
    ssl_stapling         on;
    ssl_stapling_verify  on;
    resolver             1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout     2s;

    # Load configs
    include              /etc/nginx/conf.d/*.conf;
    include              /etc/nginx/sites-enabled/*;
}
EOF

cat << EOF > $DIREKTORI_CONFIG/$FQDN_INSTALASI.conf
server {
    listen                  443 ssl http2;
    listen                  [::]:443 ssl http2;
    server_name             $FQDN_INSTALASI;
    set                     \$base /home/$FQDN_INSTALASI;
    root                    \$base/www;

    # SSL
    ssl_certificate         /etc/letsencrypt/live/$FQDN_INSTALASI/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/$FQDN_INSTALASI/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/$FQDN_INSTALASI/chain.pem;

    # security
    include                 $DIREKTORI_CONFIG/security.conf;

    # logging
    access_log              $DIREKTORI_LOG/$FQDN_INSTALASI.access.log;
    error_log               $DIREKTORI_LOG/$FQDN_INSTALASI.error.log warn;

    # index.php
    index                   index.php index.html index.htm default.html default.htm;;

    # index.php fallback
    location / {
        try_files \$uri \$uri/ /index.php?\$query_string;
    #    try_files \$uri \$uri/ /index.php?\$args;
    }

    # additional config
    include $DIREKTORI_CONFIG/general.conf;
    include $DIREKTORI_CONFIG/joomla.conf;

    # handle .php
    location ~ \.php\$ {
        fastcgi_param       SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
        include             $DIREKTORI_CONFIG/php_fastcgi.conf;
    }
}

# subdomains redirect
server {
    listen                  443 ssl http2;
    listen                  [::]:443 ssl http2;
    server_name             *.$FQDN_INSTALASI;

    # SSL
    ssl_certificate         /etc/letsencrypt/live/$FQDN_INSTALASI/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/$FQDN_INSTALASI/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/$FQDN_INSTALASI/chain.pem;
    return                  301 https://$FQDN_INSTALASI\$request_uri;
}

# HTTP redirect
server {
    listen                  80;
    listen                  [::]:80;
    server_name             .$FQDN_INSTALASI;
    #server_name_in_redirect off;
    include                 $DIREKTORI_CONFIG/letsencrypt.conf;

    location / {
        return 301 https://$FQDN_INSTALASI\$request_uri;
    }
}
EOF

cat << EOF > $DIREKTORI_CONFIG/letsencrypt.conf
# ACME-challenge
location ^~ /.well-known/acme-challenge/ {
    root /var/www/_letsencrypt;
}
EOF

cat << EOF > $DIREKTORI_CONFIG/security.conf
# security headers
add_header X-Frame-Options           "SAMEORIGIN" always;
add_header X-XSS-Protection          "1; mode=block" always;
add_header X-Content-Type-Options    "nosniff" always;
add_header Referrer-Policy           "no-referrer-when-downgrade" always;
add_header Content-Security-Policy   "default-src 'self' http: https: data: blob: 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}
EOF

cat << EOF > $DIREKTORI_CONFIG/general.conf
# favicon.ico
location = /favicon.ico {
    log_not_found off;
    access_log    off;
}

# robots.txt
location = /robots.txt {
    log_not_found off;
    access_log    off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires    7d;
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires    7d;
    access_log off;
}

# gzip
gzip              on;
#gzip_http_version 1.1;
#gzip_comp_level   6;
#gzip_min_length   1100;
#gzip_buffers      4 8k;
gzip_vary         on;
gzip_proxied      any;
gzip_comp_level   6;
#gzip_types        text/plain application/xhtml+xml text/css application/xml application/xml+rss text/javascript application/javascript application/x-javascript
gzip_types        text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

# brotli
brotli            on;
brotli_comp_level 6;
brotli_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
EOF

cat << EOF > $DIREKTORI_CONFIG/joomla.conf

# Joomla: deny general stuff
location ~* ^/(?:configuration\.php|htaccess\.txt|LICENSE\.txt|README\.txt|robot\.txt|web\.config\.txt)$ {
    deny all;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires    7d;
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires    7d;
    access_log off;
}

# Support Clean (aka Search Engine Friendly) URLs
#location / {
#        try_files \$uri \$uri/ /index.php?\$args;
#}

# deny running scripts inside writable directories
location ~* /(images|cache|media|logs|tmp)/.*\.(php|pl|py|jsp|asp|sh|cgi)$ {
        return 403;
        error_page 403 /403_error.html;
}

# caching of files 
location ~* \.(ico|pdf|flv)$ {
        expires 1y;
}

location ~* \.(js|css|png|jpg|jpeg|gif|swf|xml|txt)$ {
        expires 14d;
}
EOF

cat << EOF > $DIREKTORI_CONFIG/php_fastcgi.conf
# 404
try_files                     \$fastcgi_script_name =404;

# default fastcgi_params
include                       fastcgi_params;

# fastcgi settings
fastcgi_pass                  unix:/var/run/php-fpm/www.sock;
fastcgi_index                 index.php;
fastcgi_buffers               8 16k;
fastcgi_buffer_size           32k;

# fastcgi params
fastcgi_param DOCUMENT_ROOT   \$realpath_root;
fastcgi_param SCRIPT_FILENAME \$realpath_root\$fastcgi_script_name;
fastcgi_param PHP_ADMIN_VALUE "open_basedir=\$base/:/usr/lib/php/:/tmp/";
EOF