宝塔面板安装kodbox配置文件样本

server
{
    listen 80;
    listen 443 ssl http2 ;
    server_name www.www.com 192.168.1.2;
    index index.php index.html index.htm default.php default.htm default.html;
    root /www/wwwroot/192_168_1_2;

    #CERT-APPLY-CHECK--START
    # 用于SSL证书申请时的文件验证相关配置 -- 请勿删除
    include /www/server/panel/vhost/nginx/well-known/www.www.com.conf;
    #CERT-APPLY-CHECK--END

    #SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则
    #error_page 404/404.html;
    ssl_certificate    /www/server/panel/vhost/cert/www.www.com/fullchain.pem;
    ssl_certificate_key    /www/server/panel/vhost/cert/www.www.com/privkey.pem;
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_tickets on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    add_header Strict-Transport-Security "max-age=31536000";
    error_page 497  https://$host$request_uri;
    #SSL-END
    
    client_body_timeout 432000s;

    fastcgi_hide_header X-Powered-By;

    gzip_types     text/plain application/javascript application/x-javascript text/javascript text/css application/xml;

    # 任何情况下都不发送Referrer信息, 启用后无法拖动下载
    # add_header Referrer-Policy                      "no-referrer"   always;
    # 禁止显示来自其他网站的页面, 启用后影响内网穿透域名
    # add_header X-Frame-Options                      "SAMEORIGIN"    always;
    # 禁止跨域名访问, 启用后影响onlyoffice域名IP同时使用
    # add_header X-Permitted-Cross-Domain-Policies    "none"          always;
    
    add_header X-Content-Type-Options               "nosniff"       always;
    add_header X-Download-Options                   "noopen"        always;
    add_header X-Robots-Tag                         "none"          always;
    add_header X-XSS-Protection                     "1; mode=block" always;

    #PHP-INFO-START  PHP引用配置，可以注释或修改
    #include enable-php-82.conf;
    #PHP-INFO-END

    #REWRITE-START URL重写规则引用,修改后将导致面板设置的伪静态规则失效
    #include /www/server/panel/vhost/rewrite/www.www.com.conf;
    #REWRITE-END

    location ~ [^/]\.php(/|$) {
            try_files $uri =404;
            fastcgi_pass unix:/tmp/php-cgi-82.sock;
            fastcgi_index index.php;
            set $path_info $fastcgi_path_info;
            set $real_script_name $fastcgi_script_name;
            if ($fastcgi_script_name ~ "^(.+?\.php)(/.+)$") {
                set $real_script_name $1;
                set $path_info $2;
            }
            fastcgi_param SCRIPT_FILENAME $document_root$real_script_name;
            fastcgi_param SCRIPT_NAME $real_script_name;
            fastcgi_param PATH_INFO $path_info;
            include fastcgi_params;
            fastcgi_request_buffering off;
    }

    location ~ ^/(?:config|data)(?:$|/)  { 
        return 404; 
    }

    location ~ ^/(?:static|plugins).*(jpg|jpeg|gif|png|css|js|ico|webp|tiff|ttf|svg)$ {
        access_log off;     # Optional: Don't log access to assets
        expires 30d;
    }

    location = /favicon.ico {
        log_not_found off;
    }
    

    #一键申请SSL证书验证目录相关设置
    location ~ \.well-known{
        allow all;
    }

    #禁止在证书验证目录放入敏感文件
    if ( $uri ~ "^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$" ) {
        return 403;
    }

    access_log  /www/wwwlogs/www.www.com.log;
    error_log  /www/wwwlogs/www.www.com.error.log;
}