Add an nginx.conf.sample analog to the .htaccess provided

[Flyingmana]

see for example: https://github.com/magento/magento2/blob/2.4-develop/nginx.conf.sample

We have still several directories which should be protected, so we should also provide a config example for nginx, which is one of the most important webserver.

[keshav0001]

Following is the conf file developed over time, which I use on my website https://screenguards.co.in with hitch+varnish->apache+nginx solution. Just change the ports in the conf file.

---

add this code in your nginx.conf

upstream phpfpmsock {
    	server unix:/var/run/php-fpm/php-fpm.sock;
        keepalive 10;
	}

add the below code in the .conf file of your magento website under conf.d folder

server {
	listen 8880 backlog=1024;
	listen [::]:8880 backlog=1024;
	#listen 8443 ssl http2 backlog=1024;
	#listen [::]:8443 ssl http2 backlog=1024;
  	server_name screenguards.co.in www.screenguards.co.in cdn.screenguards.co.in;
	access_log off;
	root /<ROOT_DIRECTORY>/sgdirectory;
	index index.php;
	fastcgi_param  HTTPS $fastcgi_https;
	fastcgi_index index.php;
	fastcgi_param  MAGE_RUN_CODE sgcode;
	fastcgi_param  MAGE_RUN_TYPE sgtype;
	
	#START#for cloudflare#
	set_real_ip_from 127.0.0.1;
	set_real_ip_from 103.21.244.0/22;
	set_real_ip_from 103.22.200.0/22;
	set_real_ip_from 103.31.4.0/22;
	set_real_ip_from 104.16.0.0/12;
	set_real_ip_from 108.162.192.0/18;
	set_real_ip_from 131.0.72.0/22;
	set_real_ip_from 141.101.64.0/18;
	set_real_ip_from 162.158.0.0/15;
	set_real_ip_from 172.64.0.0/13;
	set_real_ip_from 173.245.48.0/20;
	set_real_ip_from 188.114.96.0/20;
	set_real_ip_from 190.93.240.0/20;
	set_real_ip_from 197.234.240.0/22;
	set_real_ip_from 198.41.128.0/17;
	set_real_ip_from 2400:cb00::/32;
	set_real_ip_from 2606:4700::/32;
	set_real_ip_from 2803:f800::/32;
	set_real_ip_from 2405:b500::/32;
	set_real_ip_from 2405:8100::/32;
	set_real_ip_from 2c0f:f248::/32;
	set_real_ip_from 2a06:98c0::/29;
	#END#for cloudflare#
	
	#set correct ip#
	real_ip_header X-Forwarded-For;
	real_ip_recursive on;
		
	location / {
	 if (!-e $request_filename){
	  rewrite / /index.php last;
     }
	 if ($http_origin ~* (https?:\/\/(.*\.)?screenguards\.co\.in(:[0-9]+)?$)) {
	  add_header 'Access-Control-Allow-Origin' "$http_origin";
	 }
     expires 30d;
	}
    
	location ~ /(/app|/var|/downloader|/includes|/pkginfo|/lib)/ {
	deny all;
	}
    
	location ~ rss/(order|catalog) { deny all; }
	location ~ ^/([^/])+\.(sh|pl|py|lua|inc|swp|phar|php_|log|ini|md|sql|conf|yml|sample)$ { deny all; }
	location ~ /\.(svn|git|hg|htpasswd|bash|ssh) { deny all; }
	location ~ /(dev/tests/|errors/local.xml) { deny all; }
	location ~* /(/lib|/media|/shell|/skin)/.*\.php$ { deny all; }
    
	location ^~ /media/downloadable/ {
		deny all;
	}
	location ^/(media|js|skin|img|css)/ {
		if ($http_origin ~* (https?:\/\/(.*\.)?screenguards\.co\.in(:[0-9]+)?$)) {
			add_header 'Access-Control-Allow-Origin' "$http_origin";
		}
		sendfile_max_chunk 1m;
	}
    
	location ^~ /report/config.xml {
		deny all;
	}

	location /var/export/ {
		auth_basic		   "Restricted";
		auth_basic_user_file htpasswd;
	}

	location  /. {
		return 404;
	}

	location @handler {
		index index.php;
		rewrite ^(/.*)$ /index.php$1;
   		fastcgi_param  HTTPS $fastcgi_https;
		fastcgi_index index.php;
		fastcgi_param  MAGE_RUN_CODE sgcode;
		fastcgi_param  MAGE_RUN_TYPE sgtype;
	}
	
	location ~ .php$ {
		index index.php;
		expires		off;
		if (!-e $request_filename){
			rewrite / /index.php last;
		}
		proxy_read_timeout 120s;
        proxy_send_timeout 120s;
		include		/etc/nginx/fastcgi_params;
        fastcgi_pass phpfpmsock;
		fastcgi_read_timeout 120s;
		fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
		fastcgi_param  HTTPS $fastcgi_https;
		fastcgi_index index.php;
		fastcgi_param  MAGE_RUN_CODE sgcode;
		fastcgi_param  MAGE_RUN_TYPE sgtype;
	}
}

---

[kiatng]

See PR #1209