IP.Board IPB v4.1.x Files

Same but as I said you'd need to test it as I haven't yet.

---

 

This is not for nexus but for ALL applications.
About order: How nginx processes a request

 

Be nice if @Jimmy puts the NginX cons on Git hub for tracking and updates

 

Thanks - github will be cool

I have slightly modified your conf file for my use to try - as i use the ssl code from here

Cipherli.st - Strong Ciphers for Apache, nginx and Lighttpd

Full instructions here

Strong SSL Security on nginx - Raymii.org

I use it on Apache servers (just the above) and one single nginx server (not mine) and it works very well for an A+ ssl server labs test result

Anyway here is your conf but modified (as i want to try this on a test server) and ill also try your code as will with your ssl block

Code:

# IPB4 Working NGINX site conf file
# This file is for a FORCED SSL site.  Non-SSL requests will be directed to SSL.

# Information gathered from
# Centminmod.com / Information pulled from multiple guides.  Thx eva2000!
# Makoto on IPB Forum via https://community.invisionpower.com/topic/384522-how-to-set-up-a-secure-ipboard-installation-with-nginx-and-php-fpm/ version 3.4.8 guide.
# Ahmad on the Centminmod forum.
# Base building forum thread:  https://community.centminmod.com/threads/ipb-v4-1-x-files.4922/

# Redirect to HTTPS from port 80
# Redirect from www to non-www with forced SSL
server {
    listen  80;
    server_name 10.0.0.121;
    return 301 https://10.0.0.121$request_uri;
   
    # Access and Error Logs
    access_log /home/nginx/domains/10.0.0.121/log/access_via80.log combined buffer=256k flush=60m;
    error_log /home/nginx/domains/10.0.0.121/log/error_via80.log;
}

server {
    listen 443 ssl http2;
    server_name  10.0.0.121;
    root /home/nginx/domains/10.0.0.121/public;
   
    ssl_dhparam /usr/local/nginx/conf/ssl/10.0.0.121/dhparam.pem;
    ssl_certificate      /usr/local/nginx/conf/ssl/10.0.0.121/10.0.0.121.crt;
    ssl_certificate_key  /usr/local/nginx/conf/ssl/10.0.0.121/10.0.0.121.key;
    include /usr/local/nginx/conf/ssl_include.conf;
   
    # Mozilla Recommended
    ssl_buffer_size 1400;

    # Added from https://cipherli.st Tutorial here https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
    # Thanks and Credit to Remy van Elst
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off; # Requires nginx >= 1.5.9
    ssl_stapling on; # Requires nginx >= 1.3.7
    ssl_stapling_verify on; # Requires nginx => 1.3.7
    resolver $DNS-IP-1 $DNS-IP-2 valid=300s;
    resolver_timeout 5s;
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;

    # ngx_pagespeed & ngx_pagespeed handler
    # include /usr/local/nginx/conf/pagespeed.conf;
    # include /usr/local/nginx/conf/pagespeedhandler.conf;
    # include /usr/local/nginx/conf/pagespeedstatslog.conf;

    # Limit Connections Per IP Address
    # Modified from default to allow Admin directory to have more connections
    # Modified in nginx.conf
    # limit_conn_zone $limitconn_map zone=limit_per_ip:16m;
   
    # ssi  on;

    # Access and Error Logs
    access_log /home/nginx/domains/10.0.0.121/log/access_via443.log combined buffer=256k flush=60m;
    error_log /home/nginx/domains/10.0.0.121/log/error_via443.log;

    # Prevent access to ./directories and files
    location ~ (?:^|/)\. {
        deny all;
    }

    location / {

        # block common exploits, sql injections etc
        include /usr/local/nginx/conf/block.conf;

        # Enables directory listings when index file not found
        # autoindex  on;

        # Shows file listing times as local time
        autoindex_localtime on;

        try_files    $uri $uri/ /index.php;

    }
   
    location ~^(/page/).*(\.php)$ {
        try_files  $uri $uri/ /index.php;
    }
   
    # Mask fake admin directory
    location ~^/admin/(.*)$ {
        deny all;
    }
   
    # Secure real admin directory
    location ~^(/spanky/).*(\.php) {
        include /usr/local/nginx/conf/php.conf;
        allow           10.0.0.245;
        deny            all;
        #auth_basic     "Restricted Area";
        #auth_basic_user_file /usr/local/nginx/conf/htpasswd;      
    }
   
    # IP.Board PHP/CGI Protection
   
    # Allow access
    location ~^(/applications/*/interface/).*(\.php)$ {
        allow all;
    }
   
    # Allow access to imageproxy
    location ^~ /applications/core/interface/imageproxy/imageproxy.php {
        include /usr/local/nginx/conf/php.conf;
        allow  all;
    }

    # Allow access to JS file
    location ^~ /applications/core/interface/js/js.php {
        include /usr/local/nginx/conf/php.conf;
        allow  all;
    }
   
    location ~^(/uploads/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/system/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/datastore/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/plugins/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/applications/blog/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/applications/calendar/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/applications/chat/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/applications/cms/).*(\.php)$ {
        deny     all;
    }  

    location ~^(/applications/core/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/applications/downloads/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/applications/forums/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/applications/gallery/).*(\.php)$ {
        deny     all;
    }
   
    location ~^(/applications/nexus/).*(\.php)$ {
        deny     all;
    }  

    include /usr/local/nginx/conf/staticfiles.conf;
    include /usr/local/nginx/conf/php.conf;
    include /usr/local/nginx/conf/drop.conf;
    #include /usr/local/nginx/conf/errorpage.conf;
    include /usr/local/nginx/conf/vts_server.conf;
}

I haven't tried it yet as only just got the vps provisioned and centminmod installed and then will have a play

I too think NginX is the way forward for a VPS running IPB4.x and am looking forward to learning about Nginx

Also love the ease of centminmod - Thanks Eva2000

 

Thanks Eva

So the code i put in the nginx.conf above - is that the best place for it ?

Where is HSTS, in the ssl conf ?

Yes the site I'm planning on running nginx with ipb4 will be purely https and no other sites, purely ips4

 

Just found it in

/usr/local/nginx/conf/conf.d/yourdomain.com.ssl.conf

Looks like ill remove some of the above i added to nginx.conf and uncomment it out of

yourdomain.com.ssl.conf

 

Thanks Eva - Just had a read - this is looking really neat

Some of the entries i had from the site linked above are not in the ssl domain config or the nginx config - is there anywhere else to look for these (to enable them perhaps) - before i add them and then later find they are elsewhere ?!

 

I couldn't find this anywhere

Code:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

Thanks and will do