free
/
freedombone
Tarkkaile 1
Äänestä 0
Fork 0
Koodi Ongelmat 0 Pull-pyynnöt 0 Julkaisut 0 Wiki Activity
Selaa lähdekoodia

Blog configuration

Bob Mottram 10 vuotta sitten
vanhempi
2b62251773
commit
ee7c35155b
1 muutettua tiedostoa jossa 157 lisäystä ja 48 poistoa
Jaettu näkymä Näytä diff tilastot
  1. 157
    48
      install-freedombone.sh

+ 157
- 48
install-freedombone.sh Näytä tiedosto 

@@ -167,6 +167,8 @@ WIKI_FREEDNS_SUBDOMAIN_CODE=
167 167 
 # Domain name and freedns subdomain for your blog
168 168 
 FULLBLOG_DOMAIN_NAME=
169 169 
 FULLBLOG_FREEDNS_SUBDOMAIN_CODE=
170 
+MY_BLOG_TITLE="My Blog"
171 
+MY_BLOG_SUBTITLE="Another Freedombone Blog"
170 172
171 173 
 GPG_KEYSERVER="hkp://keys.gnupg.net"
172 174 
 
@@ -359,6 +361,12 @@ function read_configuration {
359 361 
       if grep -q "FULLBLOG_FREEDNS_SUBDOMAIN_CODE" $CONFIGURATION_FILE; then
360 362 
           FULLBLOG_FREEDNS_SUBDOMAIN_CODE=$(grep "FULLBLOG_FREEDNS_SUBDOMAIN_CODE" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
361 363 
       fi
364 
+      if grep -q "MY_BLOG_TITLE" $CONFIGURATION_FILE; then
365 
+          MY_BLOG_TITLE=$(grep "MY_BLOG_TITLE" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
366 
+      fi
367 
+      if grep -q "MY_BLOG_SUBTITLE" $CONFIGURATION_FILE; then
368 
+          MY_BLOG_SUBTITLE=$(grep "MY_BLOG_SUBTITLE" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
369 
+      fi
362 370 
       if grep -q "GPG_ENCRYPT_STORED_EMAIL" $CONFIGURATION_FILE; then
363 371 
           GPG_ENCRYPT_STORED_EMAIL=$(grep "GPG_ENCRYPT_STORED_EMAIL" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
364 372 
       fi
 
@@ -3652,72 +3660,173 @@ function install_blog {
3652 3660 
   fi
3653 3661
3654 3662 
   echo 'server {' > /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3655 
-  echo '  listen 80;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3656 
-  echo "  server_name $FULLBLOG_DOMAIN_NAME;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3657 
-  echo "  root /var/www/$FULLBLOG_DOMAIN_NAME/htdocs;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3663 
+  echo '    listen 80;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3664 
+  echo "    root /var/www/$FULLBLOG_DOMAIN_NAME/htdocs;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3665 
+  echo "    server_name $FULLBLOG_DOMAIN_NAME;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3666 
+  echo "    error_log /var/www/$FULLBLOG_DOMAIN_NAME/error.log;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3667 
+  echo '    index index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3668 
+  echo '    charset utf-8;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3669 
+  echo '    client_max_body_size 20m;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3670 
+  echo '    client_body_buffer_size 128k;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3671 
+  echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3672 
+  echo '    # rewrite to front controller as default rule' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3673 
+  echo '    location / {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3674 
+  echo '        rewrite ^/(.*) /index.php?q=$uri&$args last;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3675 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3658 3676 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3659 
-  echo "  access_log /var/www/$FULLBLOG_DOMAIN_NAME/access.log;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3660 
-  echo "  error_log /var/www/$FULLBLOG_DOMAIN_NAME/error.log;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3677 
+  echo "    # make sure webfinger and other well known services aren't blocked" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3678 
+  echo '    # by denying dot files and rewrite request to the front controller' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3679 
+  echo '    location ^~ /.well-known/ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3680 
+  echo '        allow all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3681 
+  echo '        rewrite ^/(.*) /index.php?q=$uri&$args last;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3682 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3661 3683 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3662 
-  echo '  index index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3684 
+  echo '    # statically serve these file types when possible' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3685 
+  echo '    # otherwise fall back to front controller' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3686 
+  echo '    # allow browser to cache them' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3687 
+  echo '    # added .htm for advanced source code editor library' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3688 
+  echo '    location ~* \.(jpg|jpeg|gif|png|ico|css|js|htm|html|ttf|woff|svg)$ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3689 
+  echo '        expires 30d;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3690 
+  echo '        try_files $uri /index.php?q=$uri&$args;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3691 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3663 3692 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3664 
-  echo '  location ~ /config/ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3665 
-  echo '     deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3666 
-  echo '  }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3693 
+  echo '    # block these file types' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3694 
+  echo '    location ~* \.(tpl|md|tgz|log|out)$ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3695 
+  echo '        deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3696 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3667 3697 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3668 
-  echo '  location / {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3669 
-  echo '    try_files $uri $uri/ /index.php?$args;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3670 
-  echo '  }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3698 
+  echo '    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3699 
+  echo '    # or a unix socket' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3700 
+  echo '    location ~* \.php$ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3701 
+  echo '        # Zero-day exploit defense.' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3702 
+  echo '        # http://forum.nginx.org/read.php?2,88845,page=3' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3703 
+  echo "        # Won't work properly (404 error) if the file is not stored on this" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3704 
+  echo "        # server, which is entirely possible with php-fpm/php-fcgi." >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3705 
+  echo "        # Comment the 'try_files' line out if you set up php-fpm/php-fcgi on" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3706 
+  echo "        # another machine. And then cross your fingers that you won't get hacked." >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3707 
+  echo '        try_files $uri $uri/ /index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3708 
+  echo '        # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3709 
+  echo '        fastcgi_split_path_info ^(.+\.php)(/.+)$;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3710 
+  echo '        # With php5-cgi alone:' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3711 
+  echo '        # fastcgi_pass 127.0.0.1:9000;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3712 
+  echo '        # With php5-fpm:' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3713 
+  echo '        fastcgi_pass unix:/var/run/php5-fpm.sock;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3714 
+  echo '        include fastcgi_params;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3715 
+  echo '        fastcgi_index index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3716 
+  echo '        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3717 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3671 3718 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3672 
-  echo '  location ~ \.php$ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3673 
-  echo '        fastcgi_pass   127.0.0.1:9000;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3674 
-  echo '        fastcgi_index  index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3675 
-  echo '        fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3676 
-  echo '        include        fastcgi_params;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3677 
-  echo '  }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3719 
+  echo '    # deny access to all dot files' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3720 
+  echo '    location ~ /\. {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3721 
+  echo '        deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3722 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3723 
+  echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3724 
+  echo '    #deny access to store' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3725 
+  echo '    location ~ /store {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3726 
+  echo '        deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3727 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3728 
+  echo '    location ~ /(data|conf|bin|inc)/ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3729 
+  echo '      deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3730 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3731 
+  echo '    location ~ /\.ht {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3732 
+  echo '      deny  all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3733 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3678 3734 
   echo '}' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3679 3735 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3680 3736 
   echo 'server {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3681 
-  echo '  listen 443;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3682 
-  echo "  server_name $FULLBLOG_DOMAIN_NAME;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3683 
-  echo "  root /var/www/$FULLBLOG_DOMAIN_NAME/htdocs;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3737 
+  echo '    listen 443 ssl;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3738 
+  echo "    root /var/www/$FULLBLOG_DOMAIN_NAME/htdocs;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3739 
+  echo "    server_name $FULLBLOG_DOMAIN_NAME;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3740 
+  echo "    error_log /var/www/$FULLBLOG_DOMAIN_NAME/error_ssl.log;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3741 
+  echo '    index index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3742 
+  echo '    charset utf-8;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3743 
+  echo '    client_max_body_size 20m;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3744 
+  echo '    client_body_buffer_size 128k;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3745 
+  echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3746 
+  echo '    ssl on;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3747 
+  echo "    ssl_certificate /etc/ssl/certs/$FULLBLOG_DOMAIN_NAME.crt;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3748 
+  echo "    ssl_certificate_key /etc/ssl/private/$FULLBLOG_DOMAIN_NAME.key;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3749 
+  echo "    ssl_dhparam /etc/ssl/certs/$FULLBLOG_DOMAIN_NAME.dhparam;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3750 
+  echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3751 
+  echo '    ssl_session_timeout 5m;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3752 
+  echo '    ssl_prefer_server_ciphers on;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3753 
+  echo '    ssl_session_cache  builtin:1000  shared:SSL:10m;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3754 
+  echo "    ssl_protocols $SSL_PROTOCOLS; # not possible to do exclusive" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3755 
+  echo "    ssl_ciphers '$SSL_CIPHERS';" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3756 
+  echo '    add_header X-Frame-Options DENY;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3757 
+  echo '    add_header X-Content-Type-Options nosniff;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3758 
+  echo '    add_header Strict-Transport-Security "max-age=0;";' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3684 3759 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3685 
-  echo "  access_log /var/www/$FULLBLOG_DOMAIN_NAME/access_ssl.log;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3686 
-  echo "  error_log /var/www/$FULLBLOG_DOMAIN_NAME/error_ssl.log;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3760 
+  echo '    # rewrite to front controller as default rule' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3761 
+  echo '    location / {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3762 
+  echo '        rewrite ^/(.*) /index.php?q=$uri&$args last;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3763 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3687 3764 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3688 
-  echo '  index index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3765 
+  echo "    # make sure webfinger and other well known services aren't blocked" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3766 
+  echo '    # by denying dot files and rewrite request to the front controller' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3767 
+  echo '    location ^~ /.well-known/ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3768 
+  echo '        allow all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3769 
+  echo '        rewrite ^/(.*) /index.php?q=$uri&$args last;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3770 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3689 3771 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3690 
-  echo '  ssl on;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3691 
-  echo "  ssl_certificate /etc/ssl/certs/$FULLBLOG_DOMAIN_NAME.crt;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3692 
-  echo "  ssl_certificate_key /etc/ssl/private/$FULLBLOG_DOMAIN_NAME.key;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3693 
-  echo "  ssl_dhparam /etc/ssl/certs/$FULLBLOG_DOMAIN_NAME.dhparam;" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3772 
+  echo '    # statically serve these file types when possible' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3773 
+  echo '    # otherwise fall back to front controller' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3774 
+  echo '    # allow browser to cache them' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3775 
+  echo '    # added .htm for advanced source code editor library' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3776 
+  echo '    location ~* \.(jpg|jpeg|gif|png|ico|css|js|htm|html|ttf|woff|svg)$ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3777 
+  echo '        expires 30d;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3778 
+  echo '        try_files $uri /index.php?q=$uri&$args;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3779 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3694 3780 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3695 
-  echo '  ssl_session_timeout 5m;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3696 
-  echo '  ssl_prefer_server_ciphers on;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3697 
-  echo '  ssl_session_cache  builtin:1000  shared:SSL:10m;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3698 
-  echo "  ssl_protocols $SSL_PROTOCOLS; # not possible to do exclusive" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3699 
-  echo "  ssl_ciphers '$SSL_CIPHERS';" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3700 
-  echo '  add_header X-Frame-Options DENY;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3701 
-  echo '  add_header X-Content-Type-Options nosniff;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3702 
-  echo '  add_header Strict-Transport-Security "max-age=0;";' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3781 
+  echo '    # block these file types' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3782 
+  echo '    location ~* \.(tpl|md|tgz|log|out)$ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3783 
+  echo '        deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3784 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3703 3785 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3704 
-  echo '  location ~ /config/ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3705 
-  echo '     deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3706 
-  echo '  }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3786 
+  echo '    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3787 
+  echo '    # or a unix socket' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3788 
+  echo '    location ~* \.php$ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3789 
+  echo '        # Zero-day exploit defense.' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3790 
+  echo '        # http://forum.nginx.org/read.php?2,88845,page=3' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3791 
+  echo "        # Won't work properly (404 error) if the file is not stored on this" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3792 
+  echo "        # server, which is entirely possible with php-fpm/php-fcgi." >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3793 
+  echo "        # Comment the 'try_files' line out if you set up php-fpm/php-fcgi on" >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3794 
+  echo "        # another machine. And then cross your fingers that you won't get hacked." >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3795 
+  echo '        try_files $uri $uri/ /index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3796 
+  echo '        # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3797 
+  echo '        fastcgi_split_path_info ^(.+\.php)(/.+)$;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3798 
+  echo '        # With php5-cgi alone:' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3799 
+  echo '        # fastcgi_pass 127.0.0.1:9000;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3800 
+  echo '        # With php5-fpm:' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3801 
+  echo '        fastcgi_pass unix:/var/run/php5-fpm.sock;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3802 
+  echo '        include fastcgi_params;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3803 
+  echo '        fastcgi_index index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3804 
+  echo '        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3805 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3707 3806 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3708 
-  echo '  location / {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3709 
-  echo '    try_files $uri $uri/ /index.php?$args;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3710 
-  echo '  }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3807 
+  echo '    # deny access to all dot files' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3808 
+  echo '    location ~ /\. {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3809 
+  echo '        deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3810 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3711 3811 
   echo '' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3712 
-  echo '  location ~ \.php$ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3713 
-  echo '        fastcgi_pass   127.0.0.1:9000;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3714 
-  echo '        fastcgi_index  index.php;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3715 
-  echo '        fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3716 
-  echo '        include        fastcgi_params;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3717 
-  echo '  }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3812 
+  echo '    #deny access to store' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3813 
+  echo '    location ~ /store {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3814 
+  echo '        deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3815 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3816 
+  echo '    location ~ /(data|conf|bin|inc)/ {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3817 
+  echo '      deny all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3818 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3819 
+  echo '    location ~ /\.ht {' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3820 
+  echo '      deny  all;' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3821 
+  echo '    }' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3718 3822 
   echo '}' >> /etc/nginx/sites-available/$FULLBLOG_DOMAIN_NAME
3719 3823
3720 3824 
   configure_php
3825 
+  cp /var/www/$FULBLOG_DOMAIN_NAME/htdocs/config/config.ini.example /var/www/$FULBLOG_DOMAIN_NAME/htdocs/config/config.ini
3826 
+  sed -i "s/site.url.*/site.url = '$FULLBLOG_DOMAIN_NAME'/g" /var/www/$FULBLOG_DOMAIN_NAME/htdocs/config/config.ini
3827 
+  sed -i "s/blog.title.*/blog.title = '$MY_BLOG_TITLE'/g" /var/www/$FULBLOG_DOMAIN_NAME/htdocs/config/config.ini
3828 
+  sed -i "s/blog.tagline.*/blog.tagline = '$MY_BLOG_SUBTITLE'/g" /var/www/$FULBLOG_DOMAIN_NAME/htdocs/config/config.ini
3829 
+  sed -i 's|timezone.*|timezone = "Europe/London"|g' /var/www/$FULBLOG_DOMAIN_NAME/htdocs/config/config.ini
3721 3830
3722 3831 
   nginx_ensite $FULLBLOG_DOMAIN_NAME
3723 3832 
   service php5-fpm restart