c

2026-06-12 17:19:26 +08:00
parent a3ebb28ce0
commit 8d2e18c5a4
20 changed files with 3011 additions and 411 deletions
@@ -0,0 +1,91 @@
+# Redirect all HTTP traffic to HTTPS (forces secure connections)
+server {
+    listen 80;
+    server_name www.thereisnospoonadu.com thereisnospoonadu.com;
+
+    # Certbot ACME challenge - must be served over HTTP for Let's Encrypt validation
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+        allow all;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# Custom log format: $remote_user is populated by auth_basic, captures real username
+log_format download '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" "$http_user_agent"';
+
+# HTTPS Server Configuration (core SSL setup + Basic Auth download portal)
+server {
+    listen 443 ssl;
+    server_name www.thereisnospoonadu.com thereisnospoonadu.com;
+
+    # Path to your Certbot SSL certificate (unchanged—valid path)
+    ssl_certificate /etc/letsencrypt/live/www.thereisnospoonadu.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.thereisnospoonadu.com/privkey.pem;
+
+    # Modern SSL security settings (A+ grade)
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    root /www/wwwroot/soft_download;
+    index index.html index.htm;
+    charset utf-8;
+
+    # Entry points: no auth required
+    location = / {
+        try_files /index.html =404;
+        add_header Access-Control-Allow-Origin *;
+    }
+    location = /index.html {
+        add_header Access-Control-Allow-Origin *;
+    }
+    location = /login.html {
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    # API validation endpoint: HTTP Basic Auth
+    location = /api/validate {
+        auth_basic "App Download Portal";
+        auth_basic_user_file /etc/tengine/.htpasswd;
+        default_type text/plain;
+        alias /www/wwwroot/soft_download/api/validate.txt;
+    }
+
+    # JSON file listing: HTTP Basic Auth
+    location /list/ {
+        auth_basic "App Download Portal";
+        auth_basic_user_file /etc/tengine/.htpasswd;
+        alias /www/wwwroot/soft_download/;
+        index nothing_will_match;
+        autoindex on;
+        autoindex_exact_size off;
+        autoindex_localtime on;
+        autoindex_format json;
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    # File downloads: no auth required (username tracked via ?u= query param)
+    location ~ \.(exe|md|pdf|zip|rar|7z|tar|gz|txt|doc|docx|xls|xlsx|ppt|pptx|deb)$ {
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    # All other paths: serve static files (no auth)
+    location / {
+        try_files $uri $uri/ =404;
+        error_page 403 = /index.html;
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    access_log /usr/local/nginx/logs/download_access.log download;
+    error_log /usr/local/nginx/logs/download_error.log warn;
+
+    # Security: Hide Nginx version
+    server_tokens off;
+}