diff --git a/server/logrotate.conf b/server/logrotate.conf index 4e9ddcc..ee333a6 100644 --- a/server/logrotate.conf +++ b/server/logrotate.conf @@ -1,6 +1,7 @@ /srv/dpaste.de/var/*.log { - daily - rotate 7 - missingok + monthly + rotate 52 + dateext + missingok compress } diff --git a/server/nginx.conf b/server/nginx.conf index 9d892e9..26954e1 100644 --- a/server/nginx.conf +++ b/server/nginx.conf @@ -2,18 +2,17 @@ upstream app_server { server 127.0.0.1:12000 fail_timeout=0; } +# Combined log with remote:local port logged +log_format combined_port '$remote_addr - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent" "$remote_port:$server_port"'; + # ----------------------------------------------------------------------------- # Redirect all sort of non-ssl (with and without www) to ssl without www # ----------------------------------------------------------------------------- server { listen 80; - server_name dpaste.de www.dpaste.de dpaste.org www.dpaste.org; - - # Do not redirect to SSL for API calls (some clients dont support - # this automatically) - location /api { - include /srv/dpaste.de/src/dpaste/server/nginx_server_appforward.conf; - } + server_name ~(www\.)?dpaste\.(de|org); location / { rewrite ^ https://$server_name$request_uri? permanent; @@ -23,39 +22,62 @@ server { # ----------------------------------------------------------------------------- # SSL Hosts # ----------------------------------------------------------------------------- + server { - listen 443; + listen 443 ssl; + server_name dpaste.org www.dpaste.org; + + ssl_certificate /srv/dpaste.de/var/ssl/dpaste_org_unified.crt; + ssl_certificate_key /srv/dpaste.de/var/ssl/dpaste_org.key; + add_header Strict-Transport-Security max-age=25200; + + # Redirect to dpaste.de + location / { + rewrite ^/(.*)$ https://dpaste.de/$1 permanent; + } +} + +server { + listen 443 ssl; server_name dpaste.de www.dpaste.de; - ssl on; ssl_certificate /srv/dpaste.de/var/ssl/dpaste_de_unified.crt; ssl_certificate_key /srv/dpaste.de/var/ssl/dpaste_de.key; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers AES256+EECDH:AES256+EDH; + ssl_session_cache builtin:1000 shared:SSL:5m; + ssl_prefer_server_ciphers on; - + add_header Strict-Transport-Security max-age=25200; + # Rewrite www to non-www if ($host = www.dpaste.de) { rewrite ^/(.*)$ https://dpaste.de/$1 permanent; } - add_header Strict-Transport-Security max-age=25200; + access_log /srv/dpaste.de/var/nginx.access.log combined_port; + error_log /srv/dpaste.de/var/nginx.error.log; - include /srv/dpaste.de/src/dpaste/server/nginx_server.conf; -} + keepalive_timeout 5; + client_max_body_size 4G; -server { - listen 443; - server_name dpaste.org www.dpaste.org; - - ssl on; - ssl_certificate /srv/dpaste.de/var/ssl/dpaste_org_unified.crt; - ssl_certificate_key /srv/dpaste.de/var/ssl/dpaste_org.key; - - add_header Strict-Transport-Security max-age=25200; - - # Rewrite www to non-www - if ($host = www.dpaste.org) { - rewrite ^/(.*)$ https://dpaste.org/$1 permanent; + location /media/ { + alias /srv/dpaste.de/var/media/; } - include /srv/dpaste.de/src/dpaste/server/nginx_server.conf; + location /static/ { + alias /srv/dpaste.de/var/static/; + } + + location / { + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $http_host; + proxy_redirect off; + proxy_buffering off; + if (!-f $request_filename) { + proxy_pass http://app_server; + break; + } + } } + diff --git a/server/nginx_server.conf b/server/nginx_server.conf deleted file mode 100644 index a29676b..0000000 --- a/server/nginx_server.conf +++ /dev/null @@ -1,15 +0,0 @@ - error_log /srv/dpaste.de/var/nginx.error.log; - keepalive_timeout 5; - client_max_body_size 4G; - - location /media/ { - alias /srv/dpaste.de/var/media/; - } - - location /static/ { - alias /srv/dpaste.de/var/static/; - } - - location / { - include /srv/dpaste.de/src/dpaste/server/nginx_server_appforward.conf; - } diff --git a/server/nginx_server_appforward.conf b/server/nginx_server_appforward.conf deleted file mode 100644 index ab287fd..0000000 --- a/server/nginx_server_appforward.conf +++ /dev/null @@ -1,8 +0,0 @@ - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $http_host; - proxy_redirect off; - proxy_buffering off; - if (!-f $request_filename) { - proxy_pass http://app_server; - break; - }