rename posterg → xamxam throughout: nginx conf, scripts, PHP source, docs

nginx/xamxam.conf.reference

@@ -0,0 +1,195 @@
+# Nginx configuration for Post-ERG thesis website (Production)
+# Updated for new directory structure
+# Place this in /etc/nginx/sites-available/xamxam
+# Then symlink: ln -s /etc/nginx/sites-available/xamxam /etc/nginx/sites-enabled/
+
+# Rate limiting zones
+limit_req_zone $binary_remote_addr zone=general:10m rate=30r/m;
+limit_req_zone $binary_remote_addr zone=search:10m rate=30r/m;
+limit_req_zone $binary_remote_addr zone=admin:10m rate=10r/m;
+
+# Main server block
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    
+    server_name xamxam.erg.be www.xamxam.erg.be;
+
+    # Document root points to /public (only web-accessible files)
+    # Project structure: /var/www/xamxam/
+    #   /config      - Configuration (outside webroot)
+    #   /docs        - Documentation (outside webroot)
+    #   /nginx       - Server configs (outside webroot)
+    #   /public      - Web root ← THIS DIRECTORY
+    #     /admin     - Admin interface
+    #     /assets    - CSS, fonts, icons
+    #   /scripts     - Deployment scripts (outside webroot)
+    #   /src         - PHP source classes (outside webroot)
+    #   /storage     - SQLite databases (outside webroot)
+    #   /templates   - PHP templates (outside webroot)
+    #   /tests       - Test suites (outside webroot)
+    root /var/www/xamxam/public;
+    
+    # Add index.php to the list
+    index index.php index.html index.htm;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    # X-XSS-Protection intentionally omitted — deprecated and counterproductive in modern browsers.
+    # CSP (Content-Security-Policy) is the correct mitigation.
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
+
+    # Server tokens already disabled in nginx.conf
+    # server_tokens off;
+
+    # Max upload size (for thesis files)
+    client_max_body_size 100M;
+    client_body_timeout 120s;
+
+    # Logging
+    access_log /var/log/nginx/xamxam_access.log;
+    error_log /var/log/nginx/xamxam_error.log warn;
+
+    # Block access to hidden files (except .well-known for Let's Encrypt)
+    location ~ /\.(?!well-known).* {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Deny access to sensitive files and extensions
+    location ~* \.(md|txt|sql|sh|json|gitignore|git|env|db-journal)$ {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Deny access to SQLite database files
+    location ~* \.db$ {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Deny access to log files
+    location ~* \.log$ {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Deny access to directories outside webroot (defense-in-depth)
+    # These paths shouldn't be accessible anyway since they're outside /public
+    # but we deny explicitly for additional security
+    location ^~ /storage/ {
+        deny all;
+    }
+
+    location ^~ /src/ {
+        deny all;
+    }
+
+    location ^~ /templates/ {
+        deny all;
+    }
+
+    location ^~ /config/ {
+        deny all;
+    }
+
+    location ^~ /tests/ {
+        deny all;
+    }
+
+    location ^~ /scripts/ {
+        deny all;
+    }
+
+    location ^~ /docs/ {
+        deny all;
+    }
+
+    # Admin panel - password protected
+    location ^~ /admin/ {
+        # HTTP Basic Authentication (first layer)
+        auth_basic "Admin Access - Post-ERG";
+        auth_basic_user_file /etc/nginx/.htpasswd-xamxam;
+
+        # Rate limiting for admin
+        limit_req zone=admin burst=5 nodelay;
+
+        # Content-Security-Policy - Tighter policy for admin
+        add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
+
+        # Disable directory listing
+        autoindex off;
+
+        # PHP handling for admin (AdminAuth provides second layer)
+        location ~ \.php$ {
+            include snippets/fastcgi-php.conf;
+            fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;
+            
+            # Security parameters
+            fastcgi_param PHP_VALUE "upload_max_filesize=50M \n post_max_size=100M";
+            
+            # Timeouts
+            fastcgi_read_timeout 120;
+            fastcgi_send_timeout 120;
+        }
+
+        # Additional security headers for admin
+        add_header X-Robots-Tag "noindex, nofollow" always;
+        
+        # Try to serve file, otherwise 404
+        try_files $uri $uri/ =404;
+    }
+
+    # Search endpoint - rate limiting
+    location = /search.php {
+        limit_req zone=search burst=10 nodelay;
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;
+    }
+
+    # PHP files handler (public pages)
+    location ~ \.php$ {
+        # Rate limiting for general PHP requests
+        limit_req zone=general burst=20 nodelay;
+
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;
+
+        # Security parameters
+        fastcgi_param PHP_VALUE "upload_max_filesize=50M \n post_max_size=100M";
+        
+        # Timeouts
+        fastcgi_read_timeout 120;
+        fastcgi_send_timeout 120;
+    }
+
+    # Static files caching
+    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|otf)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    # PDF files (thesis documents)
+    location ~* \.pdf$ {
+        expires 7d;
+        add_header Cache-Control "public";
+        add_header Content-Disposition "inline";
+    }
+
+    # Root location - try files or 404
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    # Deny access to .htaccess files
+    location ~ /\.ht {
+        deny all;
+    }
+}