从0开始做 oneman, 搭建 FOSSBilling + 切 LXC 小鸡教程

server
{
    listen 80;
    server_name idc.qzq.im;
    index index.php index.html index.htm default.php default.htm default.html;
    root /www/wwwroot/idc.qzq.im;
    include /www/server/panel/vhost/nginx/extension/idc.qzq.im/*.conf;

-   #SSL-START SSL related configuration, do NOT delete or modify the next line of commented-out 404 rules
-   #error_page 404/404.html;
-   #SSL-END
-   
-   #ERROR-PAGE-START  Error page configuration, allowed to be commented, deleted or modified
-   error_page 404 /404.html;
-   error_page 502 /502.html;
-   #ERROR-PAGE-END
-   
-   #PHP-INFO-START  PHP reference configuration, allowed to be commented, deleted or modified
-   include enable-php-72.conf;
-   #PHP-INFO-END
-   
-   #REWRITE-START URL rewrite rule reference, any modification will invalidate the rewrite rules set by the panel
-   include /www/server/panel/vhost/rewrite/idc.qzq.im.conf;
-   #REWRITE-END
-   
-   # Forbidden files or directories
-   location ~ ^/(\.user.ini|\.htaccess|\.git|\.env|\.svn|\.project|LICENSE|README.md)
-   {
-       return 404;
-   }
-   
-   # Directory verification related settings for one-click application for SSL certificate
-   location ~ \.well-known{
-       allow all;
-   }
-   
-   #Prohibit putting sensitive files in certificate verification directory
-   if ( $uri ~ "^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$" ) {
-       return 403;
-   }
-   
-   location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
-   {
-       expires      30d;
-       error_log /dev/null;
-       access_log /dev/null;
-   }
-   
-   location ~ .*\.(js|css)?$
-   {
-       expires      12h;
-       error_log /dev/null;
-       access_log /dev/null; 
-   }
    access_log  /www/wwwlogs/idc.qzq.im.log;
    error_log  /www/wwwlogs/idc.qzq.im.error.log;
}

server
{
    listen 80;
    server_name idc.qzq.im;
    index index.php index.html index.htm default.php default.htm default.html;
    root /www/wwwroot/idc.qzq.im;
    include /www/server/panel/vhost/nginx/extension/idc.qzq.im/*.conf;
+
+   try_files $uri $uri/ @rewrite; 
  	
+   sendfile off;
	
+   # Block access to sensitive files
+   location ~* .(ini|sh|inc|bak|twig|sql)$ {
+   	return 403;
+   }
+  	
+ 	# Block /vendor completely
+ 	location ^~ /vendor/ {
+ 		return 403;
+ 	}
+ 	
+ 	# Block direct access to config.php
+ 	location = /config.php {
+ 		return 403;
+ 	}
+ 	
+ 	# Block access to hidden files except .well-known
+ 	location ~ /\.(?!well-known\/) {
+ 		return 403;
+ 	}
+ 	
+ 	# Disable PHP execution in /uploads
+ 	location ~* /uploads/.*\.php$ {
+ 		return 403;
+ 	}
+	
+ 	# Deny access to /data, except /assets/gateways
+ 	location ~* /data/(?!(assets/gateways/)) {
+ 		return 403;
+ 	}
+   	
+ 	location @rewrite {
+ 		rewrite ^/page/(.*)$ /index.php?_url=/custompages/$1;
+ 		rewrite ^/(.*)$ /index.php?_url=/$1;
+ 	}
+	
+ 	location ~ \.php {
+ 		fastcgi_split_path_info ^(.+\.php)(/.+)$;
+ 		fastcgi_pass unix:/tmp/php-cgi-82.sock;
+ 			fastcgi_param PATH_INFO       $fastcgi_path_info;
+ 			fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+ 			fastcgi_intercept_errors on;
+ 			include fastcgi_params;
+		  }
+		
+		location ~* ^/(css|img|js|flv|swf|download)/(.+)$ {
+			root /www/wwwroot/idc.qzq.im; # 替换成实际的网站目录
+			expires off;
+		}

    access_log  /www/wwwlogs/idc.qzq.im.log;
    error_log  /www/wwwlogs/idc.qzq.im.error.log;
}