Hi

We had Nginx setup on a domain serving static content (images[0-9].domain.com). Recently we've made our main domain also use the same Nginx installation and proxy any php requests to Apache.

All is working fine. We've set it to serve all static content from our images.domain.com domains, and it will also catch any static content served from the main www.domain.com as well, before finally passing any dynamic php requests through to Apache.

What I want to check is that there are no problems with the configuration that would let someone view the source of our PHP pages or access restricted 'admin' directories, etc. I've not configured NGinx before so would appreciate some help checking my config?


user www;
worker_processes 6;

error_log /var/log/nginx-error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;


events {
worker_connections 1024;
}


http {
include mime.types;
default_type application/octet-stream;
#access_log logs/access.log main;

sendfile on;
#tcp_nopush on;

## Timeouts
client_body_timeout 10;
client_header_timeout 10;
keepalive_timeout 5 5;
send_timeout 10;

gzip on;
# gzip_static on;
gzip_comp_level 5;
gzip_http_version 1.0;
gzip_min_length 1000;
gzip_types text/plain text/css image/x-icon application/x-javascript;

server{
listen 80 default_server; #all other hosts deny
server_name _;
return 444;
}

server { #IMAGES DOMAIN
listen x.x.x.x:80;
server_name images.x.com images1.x.com images2.x.com stat

server_tokens off;
gzip_comp_level 9;
if ($request_method !~ ^(GET|HEAD)$ ) {
return 444;
}



# Only serve these locations
location ^~ /images/folder1/{

if ($request_uri ~* (^\/|\.ico|\.css|\.js|\.swf|\.gif|\.jp?g|\.png)$ ) {
break;
}

root /home/vhosts/x.com/httpdocs;
expires 7d;

}
location ^~ /images/folder2/{
root /home/vhosts/x.com/httpdocs;
expires 7d;

}

location ^~/images/ {
root /home/vhosts/x.com/httpdocs;


}


location ^~ /applets/{
root /home/vhosts/x.com/httpdocs;
expires max;
}
location ^~ /css/{
root /home/vhosts/x.com/httpdocs;
expires max;
}


location ~* \.(ico|css|js|swf|gif|jp?g|png)$ {
root /home/vhosts/x.com/httpdocs;

}
location ~* \.(php|html){
return 444; #should not happen, but just incase
}
if ($host !~ ^(images.x.com|images1.x.com|images2.x.com)){
return 444;
}
location ^~/admin/ {
deny all;


}



}

server { #MAIN DOMAIN - REDIRECT TO www.
listen x.x.x.x:80;
server_name x.com;
rewrite ^(.*) http://www.x.com$1 permanent;

}
server { #MAIN DOMAIN
listen x.x.x.x:80;
server_name www.x.com;

#access_log /var/log/nginx.access.log;
error_log /var/log/nginx.error.log;

location /nginx_status {

stub_status on;
access_log off;
allow x.x.x.x/24;
deny all;
}

location ^~ /images/folder1/{
root /home/vhosts/x.com/httpdocs;
expires 7d;

}
location ^~ /images/folder2/{
root /home/vhosts/x.com/httpdocs;
expires 7d;

}


location ^~/images/ {
root /home/vhosts/x.com/httpdocs;

}


location ^~ /applets/{
root /home/vhosts/x.com/httpdocs;
expires max;
}
location ^~ /css/{
root /home/vhosts/x.com/httpdocs;
expires max;
}


location ~* \.(ico|css|js|swf|gif|jp?g|png)$ {
root /home/vhosts/x.com/httpdocs;
#expires max;
}

location / {
proxy_pass http://127.0.0.1:8080;

#CACHING
#proxy_cache my-cache;
#proxy_cache_valid 200 302 1m;
#proxy_cache_valid 404 1m;

#proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

client_max_body_size 200m; #max upload size

client_body_buffer_size 128k;
proxy_connect_timeout 900;
proxy_send_timeout 900;
proxy_read_timeout 900;
#proxy_buffer_size 4k;
#proxy_buffers 4 32k;
#proxy_busy_buffers_size 64k;
#proxy_temp_file_write_size 64k;

}
}

}