sysadmin/sprpcb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

repo inicializado

Browse Source
This commit is contained in:
Juan Burgos
2026-03-17 00:48:20 -04:00
parent 157c93736c
commit 717cc11a03
33 changed files with 9416 additions and 197 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
nginx/Dockerfile Normal file
View File

@@ -0,0 +1,18 @@
FROM nginx:1.18-alpine-perl
RUN apk add --no-cache nginx-mod-http-perl
RUN apk add --no-cache openssl
COPY nginx.conf /etc/nginx/nginx.conf
COPY default.conf /etc/nginx/conf.d/default.conf
COPY options-ssl-nginx.conf /etc/nginx/
COPY hsts.conf /etc/nginx/
RUN mkdir -p /customization
COPY blacklist.conf /customization/blacklist.conf
RUN mkdir -p /etc/symb_link_ssl
RUN mkdir -p /logs/nginx
COPY nginx.sh /customization/nginx.sh
RUN chmod +x /customization/nginx.sh
EXPOSE 80
CMD ["/customization/nginx.sh"]

132
nginx/blacklist.conf Normal file
View File

@@ -0,0 +1,132 @@
### This file implements a blacklist for certain user agents and
### referrers. It's a first line of defense. It must be included
### inside an http block.
###
### Author: mariusv
###
### Contributors: mitchellkrogza https://github.com/mitchellkrogza/nginx-badbot-blocker
###
### Last Updated: 2017-01-11
###
### Bad URL Referer lists extracted from:
### https://perishablepress.com/blacklist/ultimate-referrer-blacklist.txt
###
### Tested on: version: nginx/1.10.0 (Ubuntu)
###
### Modifications: - Added to bad_bot list
###
### - Added to bad_referer list (excuse the nasty words)
###
### - Added bad_urls1 bad_urls2 bad_urls3 and bad_urls4
### (Broken up into 4 sections for ease of maintenance)
###
### - Added validate_client (allowing all except Cyveillance IP's)
### (originally from https://github.com/oohnoitz/nginx-blacklist)
###
### I have this set up on my server as /etc/nginx/conf.d/blacklist.conf
### This is loaded and available for any vhost to use in its config
###
### Need I say, please don't just copy and paste this without reviewing what bots and
### referers are being blocked, you may want to exclude certain of them
### Also make SURE to whitelist your own IP's in the geo $bad_referer section.
###
### Note that: 0 = allow 1 = deny
###
### To enable it in a host file the following will go in the server block
### You can use all or just pick the one's you want on a host configuration
### You may also want to {return 444;} which is an Nginx feature that drops the
### connection immediately without even sending headers.
###
### # Block Bad Bots
### # Send 403 Forbidden or 444 Drop Connection
### if ($bad_bot) { return 444; }
### # Block Bad Referers
### # Send 403 Forbidden or 444 Drop Connection
### if ($bad_referer) { return 403; }
### if ($bad_urls1) { return 403; }
### if ($bad_urls2) { return 403; }
### if ($bad_urls3) { return 403; }
### if ($bad_urls4) { return 403; }
### if ($bad_urls5) { return 403; }
### if ($bad_urls6) { return 403; }
### # Block Snoopers
### # Send 444 Connection Closed Without Response
### if ($validate_client) { return 444;}
###
### NOTE: You need to change the hash max values or add them if they are not specified in your nginx.conf file
### This is because the defaults are too small and loading a big file like this into Nginx can cause errors
### Add the following into your nginx.conf file
### server_names_hash_bucket_size 64;
### server_names_hash_max_size 4096;
###
### Make sure to "sudo nginx -t" to check the config
map $http_user_agent $bad_bot {
default 0;
~*^Lynx 0; # Let Lynx go through
libwww-perl 1;
~*(?i)(80legs|360Spider|Aboundex|Abonti|Acunetix|^AIBOT|^Alexibot|Alligator|AllSubmitter|Apexoo|^asterias|^attach|^BackDoorBot|^BackStreet|^BackWeb|Badass|Bandit|Baid|Baiduspider|^BatchFTP|^Bigfoot|^Black.Hole|^BlackWidow|BlackWidow|^BlowFish|Blow|^BotALot|Buddy|^BuiltBotTough|^Bullseye|^BunnySlippers|BBBike|^Cegbfeieh|^CheeseBot|^CherryPicker|^ChinaClaw|^Cogentbot|CPython|Collector|cognitiveseo|Copier|^CopyRightCheck|^cosmos|^Crescent|CSHttp|^Custo|^Demon|^Devil|^DISCo|^DIIbot|discobot|^DittoSpyder|Download.Demon|Download.Devil|Download.Wonder|^dragonfly|^Drip|^eCatch|^EasyDL|^ebingbong|^EirGrabber|^EmailCollector|^EmailSiphon|^EmailWolf|^EroCrawler|^Exabot|^Express|Extractor|^EyeNetIE|FHscan|^FHscan|^flunky|^Foobot|^FrontPage|GalaxyBot|^gotit|Grabber|^GrabNet|^Grafula|^Harvest|^HEADMasterSEO|^hloader|^HMView|^HTTrack|httrack|HTTrack|htmlparser|^humanlinks|^IlseBot|Image.Stripper|Image.Sucker|imagefetch|^InfoNaviRobot|^InfoTekies|^Intelliseek|^InterGET|^Iria|^Jakarta|^JennyBot|^JetCar|JikeSpider|^JOC|^JustView|^Jyxobot|^Kenjin.Spider|^Keyword.Density|libwww|^larbin|LeechFTP|LeechGet|^LexiBot|^lftp|^libWeb|^likse|^LinkextractorPro|^LinkScan|^LNSpiderguy|^LinkWalker|msnbot|MSIECrawler|MJ12bot|MegaIndex|^Magnet|^Mag-Net|^MarkWatch|Mass.Downloader|masscan|^Mata.Hari|^Memo|^MIIxpc|^NAMEPROTECT|^Navroad|^NearSite|^NetAnts|^Netcraft|^NetMechanic|^NetSpider|^NetZIP|^NextGenSearchBot|^NICErsPRO|^niki-bot|^NimbleCrawler|^Nimbostratus-Bot|^Ninja|^Nmap|nmap|^NPbot|Offline.Explorer|Offline.Navigator|OpenLinkProfiler|^Octopus|^Openfind|^OutfoxBot|Pixray|probethenet|proximic|^PageGrabber|^pavuk|^pcBrowser|^Pockey|^ProPowerBot|^ProWebWalker|^psbot|^Pump|python-requests|^QueryN.Metasearch|^RealDownload|Reaper|^Reaper|^Ripper|Ripper|Recorder|^ReGet|^RepoMonkey|^RMA|scanbot|SEOkicks-Robot|seoscanners|^Stripper|^Sucker|Siphon|Siteimprove|^SiteSnagger|SiteSucker|^SlySearch|^SmartDownload|^Snake|^Snapbot|^Snoopy|Sosospider|^sogou|spbot|^SpaceBison|^spanner|^SpankBot|Spinn4r|^Sqworm|Sqworm|Stripper|Sucker|^SuperBot|SuperHTTP|^SuperHTTP|^Surfbot|^suzuran|^Szukacz|^tAkeOut|^Teleport|^Telesoft|^TurnitinBot|^The.Intraformant|^TheNomad|^TightTwatBot|^Titan|^True_Robot|^turingos|^TurnitinBot|^URLy.Warning|^Vacuum|^VCI|VidibleScraper|^VoidEYE|^WebAuto|^WebBandit|^WebCopier|^WebEnhancer|^WebFetch|^Web.Image.Collector|^WebLeacher|^WebmasterWorldForumBot|WebPix|^WebReaper|^WebSauger|Website.eXtractor|^Webster|WebShag|^WebStripper|WebSucker|^WebWhacker|^WebZIP|Whack|Whacker|^Widow|Widow|WinHTTrack|^WISENutbot|WWWOFFLE|^WWWOFFLE|^WWW-Collector-E|^Xaldon|^Xenu|^Zade|^Zeus|ZmEu|^Zyborg|SemrushBot|^WebFuck|^MJ12bot|^majestic12|^WallpapersHD) 1;
}
## Add here all referrers that are to blocked.
map $http_referer $bad_referer_block {
default 0;
~(?i)(adcash|advair|allegra|ambien|amoxicillin|adult|anal|asshole|babes|baccarat|betting|bithack|blackjack|cash|casino|celeb|cheap|cialis|craps|credit|click|cunt|deal|debt|drug|diamond|effexor|equity|faxo|finance|fisting|forsale|gambling|gaysex|girl|hardcore|hold-em|holdem|iconsurf|ilovevitaly|insurance|interest|internetsupervision|jewelry|keno|levitra|lipitor|loan|loans|love|makemoneyonline|make-money-online|meds|money|mortgage|myftpupload|nudit|omaha|organic|paxil|pharmacy|pharmacies|phentermine|pheromone|pills|piss|poker|porn|poweroversoftware|refinance|replica|rimming|roulette|screentoolkit|seoexperimenty|sex|snuff|scout|seventwentyfour|slot|slots|syntryx|teen|texas|t0phackteam|tournament|tramadol|tramidol|valtrex|vvakhrin-ws1|viagra|vicodin|webcam|xanax|xnxx|xxxrus|zanax|zippo|zoloft) 1;
}
## Add here all bad referer domains to be blocked - broken up into sections
## Alphabetical A - E (incl numbers)
map $http_referer $bad_urls1 {
default 0;
~(?i)(^http://(www\.)?38ha(-|.).*$|^http://(www\.)?4free(-|.).*$|^http://(www\.)?4hs8(-|.).*$|^http://(www\.)?4t(-|.).*$|^http://(www\.)?4u(-|.).*$|^http://(www\.)?6q(-|.).*$|^http://(www\.)?7makemoneyonline(-|.).*$|^http://(www\.)?8gold(-|.).*$|^http://(www\.)?911(-|.).*$|^http://(www\.)?adcash(-|.).*$|^http://(www\.)?.*(-|.)?adult(-|.).*$|^http://(www\.)?.*(-|.)?acunetix-referrer(-|.).*$|^http://(www\.)?abalone(-|.).*$|^http://(www\.)?adminshop(-|.).*$|^http://(www\.)?adultactioncam(-|.).*$|^http://(www\.)?aizzo(-|.).*$|^http://(www\.)?alphacarolinas(-|.).*$|^http://(www\.)?amateur(-|.).*$|^http://(www\.)?amateurxpass(-|.).*$|^http://(www\.)?.*(-|.)?anal(-|.).*$|^http://(www\.)?ansar-u-deen(-|.).*$|^http://(www\.)?atelebanon(-|.).*$|^http://(www\.)?beastiality(-|.).*$|^http://(www\.)?bestiality(-|.).*$|^http://(www\.)?belize(-|.).*$|^http://(www\.)?best-deals(-|.).*$|^http://(www\.)?bithack(-|.).*$|^http://(www\.)?blogincome(-|.).*$|^http://(www\.)?bontril(-|.).*$|^http://(www\.)?bruce-holdeman(-|.).*$|^http://(www\.)?.*(-|.)?blow.?job(-|.).*$|^http://(www\.)?buttons-for-website(-|.).*$|^http://(www\.)?ca-america(-|.).*$|^http://(www\.)?chatt-net(-|.).*$|^http://(www\.)?cenokos(-|.).*$|^http://(www\.)?cenoval(-|.).*$|^http://(www\.)?cityadspix(-|.).*$|^http://(www\.)?commerce(-|.).*$|^http://(www\.)?condo(-|.).*$|^http://(www\.)?conjuratia(-|.).*$|^http://(www\.)?consolidate(-|.).*$|^http://(www\.)?coswap(-|.).*$|^http://(www\.)?crescentarian(-|.).*$|^http://(www\.)?crepesuzette(-|.).*$|^http://(www\.)?darodar(-|.).*$|^http://(www\.)?dating(-|.).*$|^http://(www\.)?devaddict(-|.).*$|^http://(www\.)?discount(-|.).*$|^http://(www\.)?doobu(-|.).*$|^http://(www\.)?domainsatcost(-|.).*$|^http://(www\.)?econom.co(-|.).*$|^http://(www\.)?edakgfvwql(-|.).*$|^http://(www\.)?.*(-|.)?sex(-|.).*$|^http://(www\.)?e-site(-|.).*$|^http://(www\.)?egygift(-|.).*$|^http://(www\.)?empathica(-|.).*$|^http://(www\.)?empirepoker(-|.).*$|^http://(www\.)?e-poker-2005(-|.).*$|^http://(www\.)?escal8(-|.).*$|^http://(www\.)?eurip(-|.).*$|^http://(www\.)?exitq(-|.).*$|^http://(www\.)?eyemagination(-|.).*$) 1;
}
## F - I
map $http_referer $bad_urls2 {
default 0;
~(?i)(^http://(www\.)?fastcrawl(-|.).*$|^http://(www\.)?fearcrow(-|.).*$|^http://(www\.)?ferretsoft(-|.).*$|^http://(www\.)?fick(-|.).*$|^http://(www\.)?finance(-|.).*$|^http://(www\.)?flafeber(-|.).*$|^http://(www\.)?fidelityfunding(-|.).*$|^http://(www\.)?freakycheats(-|.).*$|^http://(www\.)?freeality(-|.).*$|^http://(www\.)?fuck(-|.).*$|^http://(www\.)?future-2000(-|.).*$|^http://(www\.)?.*(-|.)?gay(-|.).*$|^http://(www\.)?gobongo.info(-|.).*$|^http://(www\.)?gabriola(-|.).*$|^http://(www\.)?gallerylisting(-|.).*$|^http://(www\.)?gb.com(-|.).*$|^http://(www\.)?ghostvisitor(-|.).*$|^http://(www\.)?globusy(-|.).*$|^http://(www\.)?golf-e-course(-|.).*$|^http://(www\.)?gospelcom(-|.).*$|^http://(www\.)?gradfinder(-|.).*$|^http://(www\.)?hasfun(-|.).*$|^http://(www\.)?herbal(-|.).*$|^http://(www\.)?hermosa(-|.).*$|^http://(www\.)?highprofitclub(-|.).*$|^http://(www\.)?hilton(-|.).*$|^http://(www\.)?teaminspection(-|.).*$|^http://(www\.)?hotel(-|.).*$|^http://(www\.)?houseofseven(-|.).*$|^http://(www\.)?hurricane(-|.).*$|^http://(www\.)?.*(-|.)?incest(-|.).*$|^http://(www\.)?iaea(-|.).*$|^http://(www\.)?ilovevitality(-|.).*$|^http://(www\.)?ime(-|.).*$|^http://(www\.)?info(-|.).*$|^http://(www\.)?ingyensms(-|.).*$|^http://(www\.)?inkjet-toner(-|.).*$|^http://(www\.)?isacommie(-|.).*$|^http://(www\.)?istarthere(-|.).*$|^http://(www\.)?it.tt(-|.).*$|^http://(www\.)?italiancharms(-|.).*$|^http://(www\.)?iwantu(-|.).*$|^http://(www\.)?ilovevitality(-|.).*$|^http://(www\.)?iskalko.ru(-|.).*$) 1;
}
## J - P
map $http_referer $bad_urls3 {
default 0;
~(?i)(^http://(www\.)?jfcadvocacy(-|.).*$|^http://(www\.)?jmhic(-|.).*$|^http://(www\.)?juris(-|.).*$|^http://(www\.)?kylos(-|.).*$|^http://(www\.)?laser-eye(-|.).*$|^http://(www\.)?leathertree(-|.).*$|^http://(www\.)?lillystar(-|.).*$|^http://(www\.)?linkerdome(-|.).*$|^http://(www\.)?livenet(-|.).*$|^http://(www\.)?low-limit(-|.).*$|^http://(www\.)?lowest-price(-|.).*$|^http://(www\.)?luxup.ru(-|.).*$|^http://(www\.)?macsurfer(-|.).*$|^http://(www\.)?mall.uk(-|.).*$|^http://(www\.)?maloylawn(-|.).*$|^http://(www\.)?marketing(-|.).*$|^http://(www\.)?.*(-|.)?mature(-|.).*$|^http://(www\.)?mcdortaklar(-|.).*$|^http://(www\.)?mediavisor(-|.).*$|^http://(www\.)?medications(-|.).*$|^http://(www\.)?mirror.sytes(-|.).*$|^http://(www\.)?mp3(-|.).*$|^http://(www\.)?(-|.)musicbox1(-|.).*$|^http://(www\.)?myftpupload(-|.).*$|^http://(www\.)?naked(-|.).*$|^http://(www\.)?netdisaster(-|.).*$|^http://(www\.)?netfirms(-|.).*$|^http://(www\.)?newtruths(-|.).*$|^http://(www\.)?no-limit(-|.).*$|^http://(www\.)?nude(-|.).*$|^http://(www\.)?nudeceleb(-|.).*$|^http://(www\.)?nutzu(-|.).*$|^http://(www\.)?odge(-|.).*$|^http://(www\.)?oiline(-|.).*$|^http://(www\.)?onlinegamingassoc(-|.).*$|^http://(www\.)?outpersonals(-|.).*$|^http://(www\.)?o-o-6-o-o.ru(-|.).*$|^http://(www\.)?o-o-8-o-o.ru(-|.).*$|^http://(www\.)?pagetwo(-|.).*$|^http://(www\.)?paris(-|.).*$|^http://(www\.)?passions(-|.).*$|^http://(www\.)?peblog(-|.).*$|^http://(www\.)?peng(-|.).*$|^http://(www\.)?perfume-cologne(-|.).*$|^http://(www\.)?personal(-|.).*$|^http://(www\.)?php-soft(-|.).*$|^http://(www\.)?pisoc(-|.).*$|^http://(www\.)?pisx(-|.).*$|^http://(www\.)?popwow(-|.).*$|^http://(www\.)?porn(-|.).*$|^http://(www\.)?prescriptions(-|.).*$|^http://(www\.)?priceg(-|.).*$|^http://(www\.)?.*(-|.)?pus*y(-|.).*$|^http://(www\.)?printdirectforless(-|.).*$|^http://(www\.)?ps2cool(-|.).*$|^http://(www\.)?psnarones(-|.).*$|^http://(www\.)?psxtreme(-|.).*$) 1;
}
## Q - Z
map $http_referer $bad_urls4 {
default 0;
~(?i)(^http://(www\.)?quality-traffic(-|.).*$|^http://(www\.)?registrarprice(-|.).*$|^http://(www\.)?reliableresults(-|.).*$|^http://(www\.)?rimpim(-|.).*$|^http://(www\.)?ro7kalbe(-|.).*$|^http://(www\.)?rohkalby(-|.).*$|^http://(www\.)?ronnieazza(-|.).*$|^http://(www\.)?rulo.biz(-|.).*$|^http://(www\.)?responsinator(-|.).*$|^http://(www\.)?s5(-|.).*$|^http://(www\.)?samiuls(-|.).*$|^http://(www\.)?savefrom(-|.).*$|^http://(www\.)?savetubevideo.com(-|.).*$|^http://(www\.)?screentoolkit.com(-|.).*$|^http://(www\.)?searchedu(-|.).*$|^http://(www\.)?semalt.com(-|.).*$|^http://(www\.)?seoexperimenty(-|.).*$|^http://(www\.)?seventwentyfour(-|.).*$|^http://(www\.)?seventwentyfour.*$|^http://(www\.)?sex(-|.).*$|^http://(www\.)?sexsearch(-|.).*$|^http://(www\.)?sexsq(-|.).*$|^http://(www\.)?shoesdiscount(-|.).*$|^http://(www\.)?site-4u(-|.).*$|^http://(www\.)?site5(-|.).*$|^http://(www\.)?slatersdvds(-|.).*$|^http://(www\.)?slftsdybbg.ru(-|.).*$|^http://(www\.)?sml338(-|.).*$|^http://(www\.)?sms(-|.).*$|^http://(www\.)?smsportali(-|.).*$|^http://(www\.)?socialseet.ru(-|.).*$|^http://(www\.)?software(-|.).*$|^http://(www\.)?sortthemesitesby(-|.).*$|^http://(www\.)?spears(-|.).*$|^http://(www\.)?spoodles(-|.).*$|^http://(www\.)?sportsparent(-|.).*$|^http://(www\.)?srecorder(-|.).*$|^http://(www\.)?stmaryonline(-|.).*$|^http://(www\.)?superiends.org(-|.).*$|^http://(www\.)?strip(-|.).*$|^http://(www\.)?suttonjames(-|.).*$|^http://(www\.)?talk.uk-yankee(-|.).*$|^http://(www\.)?tecrep-inc(-|.).*$|^http://(www\.)?teen(-|.).*$|^http://(www\.)?terashells(-|.).*$|^http://(www\.)?thatwhichis(-|.).*$|^http://(www\.)?thorcarlson(-|.).*$|^http://(www\.)?.*(-|.)?tits(-|.).*$|^http://(www\.)?.*(-|.)?titten(-|.).*$|^http://(www\.)?tmsathai(-|.).*$|^http://(www\.)?traffixer(-|.).*$|^http://(www\.)?tranny(-|.).*$|^http://(www\.)?valeof(-|.).*$|^http://(www\.)?video(-|.).*$|^http://(www\.)?vinhas(-|.).*$|^http://(www\.)?vixen1(-|.).*$|^http://(www\.)?vpshs(-|.).*$|^http://(www\.)?vrajitor(-|.).*$|^http://(www\.)?vodkoved.ru(-|.).*$|^http://(www\.)?w3md(-|.).*$|^http://(www\.)?websocial.me(-|.).*$|^http://(www\.)?webdevsquare(-|.).*$|^http://(www\.)?whois(-|.).*$|^http://(www\.)?withdrawal(-|.).*$|^http://(www\.)?worldemail(-|.).*$|^http://(www\.)?wslp24(-|.).*$|^http://(www\.)?ws-op(-|.).*$|^http://(www\.)?xnxx(-|.).*$|^http://(www\.)?xopy(-|.).*$|^http://(www\.)?xxx(-|.).*$|^http://(www\.)?yelucie(-|.).*$|^http://(www\.)?youradulthosting(-|.).*$|^http://(www\.)?ykecwqlixx.ru(-|.).*$|^http://(www\.)?yougetsignal.com(-|.).*$|^http://(www\.)?(-|.)zindagi(-|.).*$) 1;
}
## Domains Linked to Yontoo Browser Malware and a Few Other New Ones
## Have split this into it's own section to keep lines shorter NOTE: changes to instructions
## adding if ($bad_urls5) and if ($bad_urls6) to your site(s) config.
map $http_referer $bad_urls5 {
default 0;
~(?i)(^http://(www\.)?101raccoon.ru(-|.).*$|^http://(www\.)?28n2gl3wfyb0.ru(-|.).*$|^http://(www\.)?627ad6438b58439cad1fc8cf6d67a92e.com(-|.).*$|^http://(www\.)?6ab9743d0152486387559b4abaa02ada.com(-|.).*$|^http://(www\.)?a342ae9750004b14b55f7310eff0ab65.com(-|.).*$|^http://(www\.)?aa08daf7e13b6345e09e92f771507fa5f4.com(-|.).*$|^http://(www\.)?aa14ab57a3339c4064bd9ae6fad7495b5f.com(-|.).*$|^http://(www\.)?aa625d84f1587749c1ab011d6f269f7d64.com(-|.).*$|^http://(www\.)?aa81bf391151884adfa3dd677e41f94be1.com(-|.).*$|^http://(www\.)?aa8780bb28a1de4eb5bff33c28a218a930.com(-|.).*$|^http://(www\.)?aa8b68101d388c446389283820863176e7.com(-|.).*$|^http://(www\.)?aa9bd78f328a6a41279d0fad0a88df1901.com(-|.).*$|^http://(www\.)?aa9d046aab36af4ff182f097f840430d51.com(-|.).*$|^http://(www\.)?aaa38852e886ac4af1a3cff9b47cab6272.com(-|.).*$|^http://(www\.)?aab94f698f36684c5a852a2ef272e031bb.com(-|.).*$|^http://(www\.)?aac500b7a15b2646968f6bd8c6305869d7.com(-|.).*$|^http://(www\.)?aac52006ec82a24e08b665f4db2b5013f7.com(-|.).*$|^http://(www\.)?aad1f4acb0a373420d9b0c4202d38d94fa.com(-|.).*$|^http://(www\.)?asrv-a.akamoihd.net(-|.).*$|^http://(www\.)?asrvrep-a.akamaihd.net(-|.).*$|^http://(www\.)?bestpriceninja.com(-|.).*$|^http://(www\.)?bronzeaid-a.akamaihd.net(-|.).*$|^http://(www\.)?browsepulse-a.akamaihd.net(-|.).*$|^http://(www\.)?cashkitten-a.akamaihd.net(-|.).*$|^http://(www\.)?coolbar.pro(-|.).*$) 1;
}
map $http_referer $bad_urls6 {
default 0;
~(?i)(^http://(www\.)?davebestdeals.com(-|.).*$|^http://(www\.)?discovertreasure-a.akamaihd.net(-|.).*$|^http://(www\.)?discovertreasurenow.com(-|.).*$|^http://(www\.)?foxydeal.com(-|.).*$|^http://(www\.)?gameonasia.com(-|.).*$|^http://(www\.)?gameplexcity.com(-|.).*$|^http://(www\.)?gamerextra.com(-|.).*$|^http://(www\.)?gamerscorps.com(-|.).*$|^http://(www\.)?gamewrath.com(-|.).*$|^http://(www\.)?generousdeal-a.akamaihd.net(-|.).*$|^http://(www\.)?girlgamerdaily.com(-|.).*$|^http://(www\.)?hdapp1008-a.akamaihd.net(-|.).*$|^http://(www\.)?highstairs-a.akamaihd.net(-|.).*$|^http://(www\.)?hotshoppymac.com(-|.).*$|^http://(www\.)?matchpal-a.akamaihd.net(-|.).*$|^http://(www\.)?mecash.ru(-|.).*$|^http://(www\.)?monarchfind-a.akamaihd.net(-|.).*$|^http://(www\.)?myshopmatemac.com(-|.).*$|^http://(www\.)?nottyu.xyz(-|.).*$|^http://(www\.)?onlinemegax.com(-|.).*$|^http://(www\.)?outrageousdeal-a.akamaihd.net(-|.).*$|^http://(www\.)?pijoto.net(-|.).*$|^http://(www\.)?recordpage-a.akamaihd.net(-|.).*$|^http://(www\.)?resultshub-a.akamaihd.net(-|.).*$|^http://(www\.)?rvzr-a.akamaihd.net(-|.).*$|^http://(www\.)?savingsslider-a.akamaihd.net(-|.).*$|^http://(www\.)?searchinterneat-a.akamaihd.net(-|.).*$|^http://(www\.)?searchwebknow-a.akamaihd.net(-|.).*$|^http://(www\.)?seeresultshub-a.akamaihd.net(-|.).*$|^http://(www\.)?shoppytoolmac.com(-|.).*$|^http://(www\.)?skytraf.xyz(-|.).*$|^http://(www\.)?splendorsearch-a.akamaihd.net(-|.).*$|^http://(www\.)?strongsignal-a.akamaihd.net(-|.).*$|^http://(www\.)?surfbuyermac.com(-|.).*$|^http://(www\.)?treasuretrack-a.akamaihd.net(-|.).*$|^http://(www\.)?webshoppermac.com(-|.).*$|^http://(www\.)?pospr.waw.pl(-|.).*$|^http://(www\.)?abclauncher.com(-|.).*$|^http://(www\.)?alert-fjg.xyz(-|.).*$|^http://(www\.)?analytics-ads.xyz(-|.).*$|^http://(www\.)?bamo.xsl.pt(-|.).*$|^http://(www\.)?compliance-olga.top(-|.).*$|^http://(www\.)?digital-video-processing.com(-|.).*$|^http://(www\.)?eu-cookie-law.info(-|.).*$|^http://(www\.)?findpik.com(-|.).*$|^http://(www\.)?forum20.smailik.org(-|.).*$|^http://(www\.)?free-share-buttons.top(-|.).*$|^http://(www\.)?free-social-buttons2.xyz(-|.).*$|^http://(www\.)?free-social-buttons3.xyz(-|.).*$|^http://(www\.)?free-social-buttons4.xyz(-|.).*$|^http://(www\.)?free-social-buttons5.xyz(-|.).*$|^http://(www\.)?front.to(-|.).*$|^http://(www\.)?infokonkurs.ru(-|.).*$|^http://(www\.)?mapquestz.us(-|.).*$|^http://(www\.)?quick-offer.com(-|.).*$|^http://(www\.)?rank-checker.online(-|.).*$|^http://(www\.)?rankchecker.online(-|.).*$|^http://(www\.)?rapidokbrain.com(-|.).*$|^http://(www\.)?real-time-analytics.com(-|.).*$|^http://(www\.)?sharebutton.net(-|.).*$|^http://(www\.)?sharebutton.org(-|.).*$|^http://(www\.)?shemale-sex.net(-|.).*$|^http://(www\.)?site-speed-check.site(-|.).*$|^http://(www\.)?site-speed-checker.site(-|.).*$|^http://(www\.)?trafficmania.com(-|.).*$|^http://(www\.)?website-speed-up.site(-|.).*$|^http://(www\.)?website-speed-up.top(-|.).*$|^http://(www\.)?xn--80aagddcgkbcqbad7amllnejg6dya.xn--p1ai(-|.).*$|^http://(www\.)?xn--80aikhbrhr.net(-|.).*$|^http://(www\.)?pila.pl(-|.).*$|^http://(www\.)?dytohqka.su(-|.).*$|^http://(www\.)?fqvjhqciw.net.ru(-|.).*$|^http://(www\.)?wycjrqzy.ua(-|.).*$|^http://(www\.)?0ca29773681c7e82.com(-|.).*$|^http://(www\.)?intervsem.ru(-|.).*$|^http://(www\.)?candy-glam-hp.com(-|.).*$|^http://(www\.)?thecoolimages.net(-|.).*$|^http://(www\.)?rebuildermedical.com(-|.).*$|^http://(www\.)?gaygalls.net(-|.).*$|^http://(www\.)?keywordteam.net(-|.).*$|^http://(www\.)?netfacet.net(-|.).*$|^http://(www\.)?pattersonsweb.com(-|.).*$|^http://(www\.)?trapit.com.gg(-|.).*$) 1;
}
## Add here all hosts that should be spared any referrer checking.
## Whitelist all your own IPs in this section, each IP followed by a 0;
geo $bad_referer {
127.0.0.1 0;
111.111.111.111 0;
}
# Geo directive to deny certain ip addresses
geo $validate_client {
default 0;
# Cyveillance
38.100.19.8/29 1;
38.100.21.0/24 1;
38.100.41.64/26 1;
38.105.71.0/25 1;
38.105.83.0/27 1;
38.112.21.140/30 1;
38.118.42.32/29 1;
65.213.208.128/27 1;
65.222.176.96/27 1;
65.222.185.72/29 1;
}

209
nginx/default.conf Normal file
View File

@@ -0,0 +1,209 @@
server_names_hash_bucket_size 64;
proxy_headers_hash_bucket_size 512;
server_names_hash_max_size 512;
large_client_header_buffers 8 64k;
proxy_read_timeout 3600;
proxy_connect_timeout 3600;
# include configs for spamers, bad bots to reject
include /customization/blacklist.conf;
# Rate limit configurations
limit_req_zone $binary_remote_addr zone=all:10m rate=20r/s;
map $http_user_agent $limit_bots {
default '';
~*(google|bing|yandex|msnbot|baidu|crawler|robot) $binary_remote_addr;
}
limit_req_zone $limit_bots zone=bots:10m rate=2r/m;
# Connect to the Arches Django app running with
# Gunicorn. Note, you need to match more than the port
# number, you need match the Docker container NAME where
# we've launched the Arches Djagno app.
upstream django {
server arches:8000;
}
upstream mapas {
server pg_tilesrv:7800;
}
server {
listen 80;
charset utf-8;
server_name ${DEPLOY_HOST} www.${DEPLOY_HOST};
location ^~ /.well-known/acme-challenge/ {
default_type "text/plain";
autoindex on;
allow all;
root /var/www/certbot/$host;
}
access_log /logs/nginx/access.log;
error_log /logs/nginx/error.log;
proxy_read_timeout 3600;
proxy_set_header X-Forwarded-Protocol $scheme;
gzip on;
gzip_disable "msie6";
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_types text/plain text/css application/json application/ld+json
application/geo+json text/xml application/xml application/xml+rss
text/javascript application/javascript text/html;
# block the evil spammers and bad bots
if ($bad_bot) {
return 444;
}
if ($bad_referer_block) {
return 444;
}
if ($bad_urls1) {
return 403;
}
if ($bad_urls2) {
return 403;
}
if ($bad_urls3) {
return 403;
}
if ($bad_urls4) {
return 403;
}
if ($bad_urls5) {
return 403;
}
if ($bad_urls6) {
return 403;
}
location /.nginx {
alias /var/www/html/${DEPLOY_HOST};
}
location / {
return 301 https://$host$request_uri;
}
}
server {
listen 443 ssl;
server_name ${DEPLOY_HOST} www.${DEPLOY_HOST};
access_log /logs/nginx/ssl_access.log;
error_log /logs/nginx/ssl_error.log;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_read_timeout 3600;
ssl_certificate /etc/symb_link_ssl/fullchain.pem;
ssl_certificate_key /etc/symb_link_ssl/privkey.pem;
include /etc/nginx/options-ssl-nginx.conf;
ssl_dhparam /etc/nginx/sites/ssl/ssl-dhparams.pem;
include /etc/nginx/hsts.conf;
# Allows upload of up to a 100MB file
client_max_body_size 100M;
gzip on;
gzip_disable "msie6";
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_types text/plain text/css application/json application/ld+json
application/geo+json text/xml application/xml application/xml+rss
text/javascript application/javascript text/html;
# block the evil spammers and bad bots
if ($bad_bot) {
return 444;
}
if ($bad_referer_block) {
return 444;
}
if ($bad_urls1) {
return 403;
}
if ($bad_urls2) {
return 403;
}
if ($bad_urls3) {
return 403;
}
if ($bad_urls4) {
return 403;
}
if ($bad_urls5) {
return 403;
}
if ($bad_urls6) {
return 403;
}
location /pgtileserv/ {
proxy_pass http://mapas/;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}
location /.nginx {
autoindex on;
alias /var/www/html/${DEPLOY_HOST};
}
location ^~ /.well-known/acme-challenge/ {
default_type "text/plain";
autoindex on;
allow all;
root /var/www/certbot/$host;
}
# See the nginx docker-compose.yml where we
# provide this volume mapping to "static"
location /static/ {
# Note: No rate limit
autoindex on;
allow all;
alias /static_root/;
include /etc/nginx/mime.types;
}
location / {
# rate limit
limit_req zone=all burst=30;
limit_req zone=bots burst=10;
try_files $uri @proxy_to_django;
}
location @proxy_to_django {
proxy_pass http://django;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
}

1
nginx/hsts.conf Normal file
View File

@@ -0,0 +1 @@
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

29
nginx/nginx.conf Normal file
View File

@@ -0,0 +1,29 @@
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
load_module "modules/ngx_http_perl_module.so";
env ENV;
env DOMAINS;
env FRONTEND;
env DJANGO_PORT;
env CERT_PATH;
events {
worker_connections 1024;
}
http {
include mime.types;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
keepalive_timeout 65;
perl_set $ENV 'sub { return $ENV{"ENV"}; }';
perl_set $DOMAINS 'sub { return $ENV{"DOMAINS"}; }';
perl_set $DEPLOY_HOST 'sub { return $ENV{"DEPLOY_HOST"}; }';
perl_set $DJANGO_PORT 'sub { return $ENV{"DJANGO_PORT"}; }';
perl_set $CERT_PATH 'sub { return $ENV{"CERT_PATH"}; }';
include /etc/nginx/conf.d/*.conf;
}

106
nginx/nginx.sh Normal file
View File

@@ -0,0 +1,106 @@
#!/bin/sh
set -e
if [ -z "$DOMAINS" ]; then
echo "DOMAINS environment variable is not set"
exit 1;
fi
use_dummy_certificate() {
# Switch sympolic links to reference the apprpriate SSL keys
mkdir -p /etc/symb_link_ssl;
if [ -f "/etc/letsencrypt/live/$1/fullchain.pem" ]; then
echo "Nginx to use Let's Encrypt certificate for $1";
ln -sfn "/etc/letsencrypt/live/$1/fullchain.pem" /etc/symb_link_ssl/fullchain.pem;
ln -sfn "/etc/letsencrypt/live/$1/privkey.pem" /etc/symb_link_ssl/privkey.pem;
else
echo "Nginx to use dummy (testing) SSL certificate for $1"
ln -sfn "/etc/nginx/sites/ssl/dummy/$1/fullchain.pem" /etc/symb_link_ssl/fullchain.pem;
ln -sfn "/etc/nginx/sites/ssl/dummy/$1/privkey.pem" /etc/symb_link_ssl/privkey.pem;
fi
}
use_lets_encrypt_certificate() {
# Switch sympolic links to reference the apprpriate SSL keys
mkdir -p /etc/symb_link_ssl;
if [ -f "/etc/letsencrypt/live/$1/fullchain.pem" ]; then
echo "Nginx to use Let's Encrypt certificate for $1";
ln -sfn "/etc/letsencrypt/live/$1/fullchain.pem" /etc/symb_link_ssl/fullchain.pem;
ln -sfn "/etc/letsencrypt/live/$1/privkey.pem" /etc/symb_link_ssl/privkey.pem;
else
echo "Nginx to use dummy (testing) SSL certificate for $1"
ln -sfn "/etc/nginx/sites/ssl/dummy/$1/fullchain.pem" /etc/symb_link_ssl/fullchain.pem;
ln -sfn "/etc/nginx/sites/ssl/dummy/$1/privkey.pem" /etc/symb_link_ssl/privkey.pem;
fi
}
reload_nginx() {
echo "Reloading Nginx configuration"
nginx -s reload;
}
wait_for_lets_encrypt() {
certpath_fixed=$(echo "$CERT_PATH" | tr -d \");
until [ -d "/etc/letsencrypt/live/$1" ]; do
echo "CERT_PATH is apparently $certpath_fixed, with contents: ";
ls $certpath_fixed;
echo "Waiting for Let's Encrypt certificates for $1";
sleep 10s & wait ${!}
done
use_lets_encrypt_certificate "$1"
reload_nginx
}
if [ ! -f /etc/nginx/sites/ssl/ssl-dhparams.pem ]; then
mkdir -p "/etc/nginx/sites/ssl"
openssl dhparam -out /etc/nginx/sites/ssl/ssl-dhparams.pem 2048
fi
domains_fixed=$(echo "$DOMAINS" | tr -d \")
for domain in $domains_fixed; do
echo "Checking configuration for $domain"
echo "Make sure we have a cerbot directory for $domain";
mkdir -p /var/www/certbot/$domain;
echo "Prepping cerbot acme-challenge folder for: $domain"
mkdir -p /var/www/certbot/$domain/.well-known/acme-challenge
echo "look here for $domain cert dir (deep)!" > /var/www/certbot/$domain/.well-known/acme-challenge/hello.txt;
chmod 644 /var/www/certbot/$domain/.well-known/acme-challenge/hello.txt;
echo "look here for $domain cert dir (shallow)!" > /var/www/certbot/$domain/hello.txt;
chmod 644 /var/www/certbot/$domain/hello.txt;
if [ ! -f "/etc/nginx/sites/$domain.conf" ]; then
echo "Skip creating Nginx configuration file /etc/nginx/sites/$domain.conf"
# sed "s/\${domain}/$domain/g" /customization/site.conf.tpl > "/etc/nginx/sites/$domain.conf"
fi
if [ ! -f "/etc/nginx/sites/ssl/dummy/$domain/fullchain.pem" ]; then
echo "Generating dummy ceritificate for $domain"
mkdir -p /etc/nginx/sites/ssl/dummy/$domain
printf "[dn]\nCN=${domain}\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:$domain, DNS:www.$domain\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth" > openssl.cnf
openssl req -x509 -out "/etc/nginx/sites/ssl/dummy/$domain/fullchain.pem" -keyout "/etc/nginx/sites/ssl/dummy/$domain/privkey.pem" \
-newkey rsa:2048 -nodes -sha256 \
-subj "/CN=${domain}" -extensions EXT -config openssl.cnf
rm -f openssl.cnf
fi
if [ ! -d "/etc/letsencrypt/live/$domain" ]; then
use_dummy_certificate "$domain"
wait_for_lets_encrypt "$domain" &
else
use_lets_encrypt_certificate "$domain"
fi
echo "-----------------------------------------------";
echo "Check out the contents of /static_root/";
ls /static_root;
echo "-----------------------------------------------";
done
exec nginx -g "daemon off;"

8
nginx/options-ssl-nginx.conf Normal file
View File

@@ -0,0 +1,8 @@
ssl_session_cache shared:le_nginx_SSL:10m;
ssl_session_timeout 1440m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";