Вот рабочий конфиг:
>>> BOF
server {
if ($host =
Для просмотра ссылки Войди или Зарегистрируйся) {
return 301
Для просмотра ссылки Войди или Зарегистрируйся
} # managed by Certbot
if ($host = <host.address>) {
return 301
Для просмотра ссылки Войди или Зарегистрируйся
} # managed by Certbot
listen 80;
server_name <host.address>
Для просмотра ссылки Войди или Зарегистрируйся
return 301
Для просмотра ссылки Войди или Зарегистрируйся
expires $expires;
}
server {
pagespeed on;
pagespeed Disallow "*/callme.min.js";
pagespeed FileCachePath /tmp/ngx_pagespeed_cache;
location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" {}
location ~ "^/pagespeed_static/" { }
location ~ "^/ngx_pagespeed_beacon$" { }
expires $expires;
listen 443 ssl http2;
server_name <host.address>
Для просмотра ссылки Войди или Зарегистрируйся
ssl on;
set $primary_domain <host.address>;
root $MAGE_ROOT;
set $MAGE_ROOT /var/www/<path>;
set $MAGE_MODE production; # or developer
access_log /var/log/nginx/
Для просмотра ссылки Войди или Зарегистрируйся
error_log /var/log/nginx/
Для просмотра ссылки Войди или Зарегистрируйся
client_max_body_size 50m;
include /etc/nginx/nginx.conf.m2;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384
HE-RSA-AES128-GCM-SHA256
HE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA
HE-RSA-AES128-SHA256
HE-RSA-AES128-SHA
HE-DSS-AES128-SHA256
HE-RSA-AES256-SHA256
HE-DSS-AES256-SHA
HE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK;
ssl_session_cache shared:SSL:10m;
add_header Strict-Transport-Security max-age=15768000;
ssl_stapling off;
ssl_session_timeout 24h;
keepalive_timeout 3600s;
fastcgi_send_timeout 3600s;
fastcgi_read_timeout 3600s;
proxy_connect_timeout 3600s;
proxy_send_timeout 3600s;
proxy_read_timeout 3600s;
send_timeout 3600;
fastcgi_buffers 8 128k;
fastcgi_buffer_size 256k;
client_header_timeout 3000;
client_body_timeout 3000;
ssl_certificate /etc/letsencrypt/live/
Для просмотра ссылки Войди или Зарегистрируйся # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/
Для просмотра ссылки Войди или Зарегистрируйся # managed by Certbot
#Redirect non-https traffic to https
if ($scheme != "https") {
return 301
Для просмотра ссылки Войди или Зарегистрируйся
} # managed by Certbot
}
EOF>>>
>>>
nginx.conf.m2
>>>
#root $MAGE_ROOT/pub;
index index.php;
autoindex off;
charset UTF-8;
error_page 404 403 = /errors/404.php;
#add_header "X-UA-Compatible" "IE=Edge";
# PHP entry point for setup application
location ~* ^/setup($|/) {
location ~ ^/setup/index.php {
# fastcgi_pass fastcgi_backend;
fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
fastcgi_param PHP_FLAG "session.auto_start=off \n suhosin.session.cryptua=off";
fastcgi_param PHP_VALUE "memory_limit=768M \n max_execution_time=3600s";
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
location ~ ^/setup/(?!pub/). {
deny all;
}
location ~ ^/setup/pub/ {
add_header X-Frame-Options "SAMEORIGIN";
}
}
# PHP entry point for update application
location ~* ^/update($|/) {
location ~ ^/update/index.php {
fastcgi_split_path_info ^(/update/index.php)(/.+)$;
# fastcgi_pass fastcgi_backend;
fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
include fastcgi_params;
}
# Deny everything but index.php
location ~ ^/update/(?!pub/). {
deny all;
}
location ~ ^/update/pub/ {
add_header X-Frame-Options "SAMEORIGIN";
}
}
location / {
try_files $uri $uri/ /index.php$is_args$args;
}
location /pub/ {
location ~ ^/pub/media/(downloadable|customer|import|theme_customization/.*\.xml) {
deny all;
}
# alias $MAGE_ROOT/pub/;
add_header X-Frame-Options "SAMEORIGIN";
}
#location /static/ {
# # Uncomment the following line in production mode
# # expires max;
#
# # Remove signature of the static files that is used to overcome the browser cache
# location ~ ^/static/version {
# rewrite ^/static/(version\d*/)?(.*)$ /static/$2 last;
# }
#
# location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
# add_header Cache-Control "public";
# add_header X-Frame-Options "SAMEORIGIN";
# expires +1y;
#
# if (!-f $request_filename) {
# rewrite ^/static/?(.*)$ /static.php?resource=$1 last;
# }
# }
# location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
# add_header Cache-Control "no-store";
# add_header X-Frame-Options "SAMEORIGIN";
# expires off;
#
# if (!-f $request_filename) {
# rewrite ^/static/?(.*)$ /static.php?resource=$1 last;
# }
# }
# if (!-f $request_filename) {
# rewrite ^/static/?(.*)$ /static.php?resource=$1 last;
# }
# add_header X-Frame-Options "SAMEORIGIN";
#}
location /static/ {
if ($MAGE_MODE = "production") {
expires max;
}
# Remove signature of the static files that is used to overcome the browser cache
location ~ ^/static/version {
rewrite ^/static/(version\d*/)?(.*)$ /static/$2 last;
}
location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
add_header Cache-Control "public";
add_header X-Frame-Options "SAMEORIGIN";
expires +1y;
if (!-f $request_filename) {
rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
}
}
location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
add_header Cache-Control "no-store";
add_header X-Frame-Options "SAMEORIGIN";
expires off;
if (!-f $request_filename) {
rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
}
}
if (!-f $request_filename) {
rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
}
add_header X-Frame-Options "SAMEORIGIN";
}
location /media/ {
try_files $uri $uri/ /get.php$is_args$args;
location ~ ^/media/theme_customization/.*\.xml {
deny all;
}
location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
add_header Cache-Control "public";
add_header X-Frame-Options "SAMEORIGIN";
expires +1y;
try_files $uri $uri/ /get.php$is_args$args;
}
location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
add_header Cache-Control "no-store";
add_header X-Frame-Options "SAMEORIGIN";
expires off;
try_files $uri $uri/ /get.php$is_args$args;
}
add_header X-Frame-Options "SAMEORIGIN";
}
location /media/customer/ {
deny all;
}
location /media/downloadable/ {
deny all;
}
location /media/import/ {
deny all;
}
# PHP entry point for main application
location ~ (index|get|static|report|404|503)\.php$ {
try_files $uri =404;
fastcgi_param MAGE_RUN_TYPE website;
fastcgi_param MAGE_RUN_CODE $MAGE_RUN_CODE;
# proxy_pass
Для просмотра ссылки Войди или Зарегистрируйся
fastcgi_read_timeout 3600;
fastcgi_connect_timeout 3600;
proxy_connect_timeout 3600;
fastcgi_buffers 8 128k;
fastcgi_cache_key "$scheme$request_method$host$request_uri";
fastcgi_param PHP_FLAG "session.auto_start=off \n suhosin.session.cryptua=off";
fastcgi_param PHP_VALUE "memory_limit=768M \n max_execution_time=18000";
uwsgi_read_timeout 3600;
fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
add_header X-Fastcgi-Cache $upstream_cache_status; # Add header so we can see if the cache hits or misses
}
brotli_static on;
brotli on;
brotli_comp_level 6;
brotli_types text/plain text/css text/xml application/x-javascript brotli_types text/html text/plain text/css application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript image/x-icon;
gzip on;
gzip_disable "msie6";
gzip_vary on;
gzip_proxied any;
gzip_comp_level 9;
gzip_buffers 8 64k;
gzip_http_version 1.1;
gzip_min_length 64;
#gzip_types text/plain text/css application/json text/xml application/xml application/xml+rss text/javascript application/vnd.ms-fontobject application/x-font-ttf font/opentype image/svg+xml image/x-icon application/javascript application/x-javascript image/svg+xml;
gzip_types *;
# Banned locations (only reached if the earlier PHP entry point regexes don't match)
location ~* (\.php$|\.htaccess$|\.git) {
deny all;
}
(довольно долго оно все это меняет и не всегда помогает)
