site-wiki-ssl

# This configuration file can go into a sites-available/sites-enabled
# setup, which works nicely with the default ubuntu nginx setup.  It
# uses hard-coded ports, as nginx doesn't support variables in
# configuration files--adjust these as needed, and proxy accordingly
# from your root server if this is part of a shared installation (or
# if you want to separate ssl termination from serving wiki content).


limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

# The non-SSL server just redirects traffic to the equivalent `https` URL.
server {
  # With help from http://serverfault.com/questions/250476/how-to-force-or-redirect-to-ssl-in-nginx
  listen 80;

  server_name changeme.bioreachables.com;
  rewrite ^ https://$server_name$request_uri? permanent;
}

# The SSL server does all the heavy lifting.
server {
  listen 443 ssl;
  server_name changeme.bioreachables.com;

  keepalive_timeout 70;

  ssl_certificate /etc/nginx/ssl/bioreachables.com.crt;
  ssl_certificate_key /etc/nginx/ssl/bioreachables.com.key;

  # Use a custom, 4096 bit DH parameter file.  This prevents old traffic from being decrypted if ever our key is compromised.
  ssl_dhparam /etc/nginx/ssl/dhparam.pem;

  # Hardening parameters from https://mozilla.github.io/server-side-tls/ssl-config-generator/
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off;

  # modern configuration. tweak to your needs.
  ssl_protocols TLSv1.2;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
  ssl_prefer_server_ciphers on;

  # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
  add_header Strict-Transport-Security max-age=15768000;

  # OCSP Stapling ---
  # fetch OCSP records from URL in ssl_certificate and cache them
  ssl_stapling on;
  ssl_stapling_verify on;

  # With help from https://manual.seafile.com/deploy/https_with_nginx.html
  fastcgi_param HTTPS on;
  fastcgi_param HTTP_SCHEME https;

  # Run all the mediawiki php codes.
  # with help from:
  # http://askubuntu.com/questions/134666/what-is-the-easiest-way-to-enable-php-on-nginx
  # https://www.nginx.com/resources/wiki/start/topics/recipes/mediawiki/

  # Note that we also host some static content from the mediawiki directory.
  # This is a little sketchy, but I think it's better than
  root /var/www/mediawiki;

  client_max_body_size 5m;
  client_body_timeout 60;

  auth_basic "20n Wiki 1";
  auth_basic_user_file /etc/nginx/htpasswd;

  # Substructure search service
  location = /search {
    proxy_set_header   Host             $host:$server_port;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_pass         http://localhost:8888; # Shouldn't be publicly accessible.
    proxy_redirect     default;

    break;
    # Break required to prevent additional processing by other location blocks.
  }

  location /substructure {
    autoindex off;
    index  index.html index.htm;
  }

  # Orders service
  location = /order {
    proxy_set_header   Host             $host:$server_port;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_pass         http://localhost:8889; # Shouldn't be publicly accessible.
    proxy_redirect     default;

    break;
    # Break required to prevent additional processing by other location blocks.
  }

  # Normal mediawiki config, with some extra rate limiting and hardening.
  location / {
    limit_req zone=one burst=5;
    index index.php;
    try_files $uri $uri/ @rewrite;
  }

  location @rewrite {
    rewrite ^/(.*)$ /index.php?title=$1&$args;
  }

  location ^~ /mw-config/ {
    allow 127.0.0.1;
    deny all;

    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
  }

  location ^~ /maintenance/ {
    return 403;
  }

  location ^~ /tests/ {
    return 403;
  }

  location ^~ /docs/ {
    return 403;
  }

  location = /api.php {
    allow 127.0.0.1;
    deny all;

    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
  }

  location = /LocalSettings.php {
    return 403;
  }

  location ~ \.php$ {
    limit_req zone=one burst=5;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
  }

  location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
    try_files $uri /index.php;
    expires max;
    log_not_found off;
  }

  location = /_.gif {
    expires max;
    empty_gif;
  }

  location ^~ /cache/ {
    deny all;
  }

  location /dumps {
    root /var/www/mediawiki/local;
    autoindex on;
  }
}