tarsystem.webctf.it.vhost

# NGINX vhost for TarSystem Challenge PHP-FPM container

# Redirect HTTP (port 80) to HTTPS (port 443)
server {
	# Ports
	listen 80;
	listen [::]:80;

	# Server name
	server_name tarsystem.webctf.it;

	# Logs
	error_log /var/log/nginx/error_tarsystem_webctf.log warn;
	access_log /var/log/nginx/access_tarsystem_webctf.log combined if=$is_not_docker_whitelist;

	# Bad Bot Blocker + DDOS
	include /etc/nginx/bots.d/blockbots.conf;
	include /etc/nginx/bots.d/ddos.conf;

	# Redirect
	return 301 https://$server_name$request_uri;
}

# HTTPS server block
server {
	# Ports
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	# Server name
	server_name tarsystem.webctf.it;

	# Root for static contents
	root /var/docker/tarsystem.webctf.it/public_html;

	# Indexes
	index index.php index.html;

	# Logs
	error_log /var/log/nginx/error_tarsystem_webctf.log warn;
	access_log /var/log/nginx/access_tarsystem_webctf.log combined if=$is_not_docker_whitelist;

	# Bad Bot Blocker + DDOS
	include /etc/nginx/bots.d/blockbots.conf;
	include /etc/nginx/bots.d/ddos.conf;

	# Max upload size
	client_max_body_size 1m;

	# TLS/SSL certificates
	include ssl_params;

	# Security headers
	include security_header_params;

	# Security.txt implementation
	include security_txt_params;

	# Custom error pages
	error_page 403 404 =404 /404.php; # /404.php is the default 403/404 error page
	location /404.php {internal;}     # Direct access to 404 page generates a 404 error	

	# Main location
	location / {
		try_files $uri $uri/ =404; # First attempt to serve request as file, then as directory, then fall back to displaying a 404
	}

	# Upload location
	location ^~ /upload {
		alias /var/docker/tarsystem.webctf.it/public_html_upload;
		autoindex off;
		location ~ /upload/users/(.+) {
			location ~* \.(php|sh)$ {add_header Content-Type text/plain;} # In this challenge, some files inside /upload/ must be served as plain/text
			autoindex on;
		}		
	}

	# PHP-FPM connection
	location ~ \.php$ {
		try_files $uri =404;
		fastcgi_split_path_info ^(.+\.php)(/.+)$;
		fastcgi_pass unix:/var/docker/tarsystem.webctf.it/sock/app.sock;
		# HERE WE FORCE /var/www/html INSTEAD OF $document_root BECAUSE WE NEED TO TELL TO PHP-FPM FILE'S PATH INSIDE DOCKER
		fastcgi_param SCRIPT_FILENAME /var/www/html/$fastcgi_script_name;
		fastcgi_param SCRIPT_NAME $fastcgi_script_name;
		fastcgi_index index.php;
		include fastcgi_params;
	}

	# Block flag file
	location = /upload/.flag {deny all;}

	# Deny access to hidden files
	location ~ /\.(?!well-known).* {deny all;}
}