weakbank2.webctf.it.vhost

# NGINX vhost for WeakBank2 Challenge (by Franco Marino) PHP-FPM container

# Redirect HTTP (port 80) to HTTPS (port 443)
server {
	# Ports
	listen 80;
	listen [::]:80;
	
	# Server name
	server_name weakbank2.webctf.it;

	# Logs
	error_log /var/log/nginx/error_weakbank2_webctf.log warn;
	access_log /var/log/nginx/access_weakbank2_webctf.log combined if=$is_not_docker_whitelist;

	# Bad Bot Blocker + DDOS
	include /etc/nginx/bots.d/blockbots.conf;
	include /etc/nginx/bots.d/ddos.conf;
	
	# Redirect
	return 301 https://$server_name$request_uri;
}

# HTTPS server block
server {
	# Ports
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	# Server name
	server_name weakbank2.webctf.it;

	# Root for static contents
	root /var/docker/weakbank2.webctf.it/public_html;

	# Indexes
	index index.php index.html;

	# Logs
	error_log /var/log/nginx/error_weakbank2_webctf.log warn;
	access_log /var/log/nginx/access_weakbank2_webctf.log combined if=$is_not_docker_whitelist;

	# Bad Bot Blocker + DDOS
	include /etc/nginx/bots.d/blockbots.conf;
	include /etc/nginx/bots.d/ddos.conf;

	# TLS/SSL certificates
	include ssl_params;

	# Security headers
	include security_header_params;

	# Security.txt implementation
	include security_txt_params;

	# Custom error pages
	error_page 403 404 =404 /404.php; # /404.php is the default 403/404 page
	location /404.php {internal;}     # Direct access to 404 page generates a 404 error

	# Main location
	location / {
		try_files $uri $uri/ =404; # First attempt to serve request as file, then as directory, then fall back to displaying a 404
	}

	# Upload location
	location ^~ /upload {
		alias /var/docker/weakbank2.webctf.it/public_html_upload;
		location ~ \.php$ {
			try_files $uri =404;
			fastcgi_split_path_info ^(.+\.php)(/.+)$;
			fastcgi_pass unix:/var/docker/weakbank2.webctf.it/sock/app.sock;
			# HERE WE FORCE /var/www/html INSTEAD OF $document_root BECAUSE WE NEED TO TELL TO PHP-FPM FILE'S PATH INSIDE DOCKER
			fastcgi_param SCRIPT_FILENAME /var/www/html/$fastcgi_script_name;
			fastcgi_index index.php;
			include fastcgi_params;
		}
		# Block all files without filename (eg ".flag")
		location ~ /\. {deny all;}
	}

	# PHP-FPM connection
	location ~ \.php$ {
		try_files $uri =404;
		fastcgi_split_path_info ^(.+\.php)(/.+)$;
		fastcgi_pass unix:/var/docker/weakbank2.webctf.it/sock/app.sock;
		# HERE WE FORCE /var/www/html INSTEAD OF $document_root BECAUSE WE NEED TO TELL TO PHP-FPM FILE'S PATH INSIDE DOCKER
		fastcgi_param SCRIPT_FILENAME /var/www/html/$fastcgi_script_name;
		fastcgi_param SCRIPT_NAME $fastcgi_script_name;
		fastcgi_index index.php;
		include fastcgi_params;
	}

	# Deny access to hidden files
	location ~ /\.(?!well-known).* {deny all;}
}