fix: nginx config (#30)

- Updated Nginx config.

.build/common/nginx/default.conf.template

@@ -1,90 +1,59 @@
-##
-# You should look at the following URL's in order to grasp a solid understanding
-# of Nginx configuration files in order to fully unleash the power of Nginx.
-# http://wiki.nginx.org/Pitfalls
-# http://wiki.nginx.org/QuickStart
-# http://wiki.nginx.org/Configuration
-#
-# Generally, you will want to move this file somewhere, and start with a clean
-# file but keep this around for reference. Or just disable in sites-enabled.
-#
-# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
-##
-
-# Default server configuration
-#
 server {
-	listen 3000 default_server;
-	listen [::]:3000 default_server;
-
-	# SSL configuration
-	#
-	# listen 443 ssl default_server;
-	# listen [::]:443 ssl default_server;
-	#
-	# Note: You should disable gzip for SSL traffic.
-	# See: https://bugs.debian.org/773332
-	#
-	# Read up on ssl_ciphers to ensure a secure configuration.
-	# See: https://bugs.debian.org/765782
-	#
-	# Self signed certs generated by the ssl-cert package
-	# Don't use them in a production server!
-	#
-	# include snippets/snakeoil.conf;
-
-	root /var/www/html;
-
-	# Add index.php to the list if you are using PHP
-	index index.php index.html index.htm index.nginx-debian.html;
-
-	server_name _;
-
-	location / {
-		# First attempt to serve request as file, then
-		# as directory, then fall back to displaying a 404.
-		# try_files $uri $uri/ =404;
-        try_files $uri $uri/ /index.php?$args;
-	}
-
-	# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
-	location ~ \.php$ {
-		fastcgi_split_path_info ^(.+\.php)(/.+)$;
-		# NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
-
-		# With php5-cgi alone:
-		# fastcgi_pass 127.0.0.1:9000;
-		# With php5-fpm:
-		fastcgi_pass unix:/run/php/php{{ php_version }}-fpm.sock;
-		fastcgi_index index.php;
-		fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
-		include fastcgi_params;
-	}
-	# deny access to .htaccess files, if Apache's document root
-	# concurs with nginx's one
-	location ~ /\.ht {
-		deny all;
-	}
-
-	include /var/www/html/nginx.conf;
+        # listen on port
+        listen 3000 default_server;
+        listen [::]:3000 default_server;
+
+        root /var/www/html;
+
+        # default index list - rule 'default match rule` for match `$uri\` will serve index file in list if present in directory
+        index index.php index.html index.htm index.nginx-debian.html;
+
+        server_name _;
+
+		# name: serve index rule
+        # precedence 1
+        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+        location = /index.php {
+                fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                fastcgi_pass unix:/run/php/php{{ php_version }}-fpm.sock;
+                fastcgi_index index.php;
+                fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
+                include fastcgi_params;
+        }
+
+		# name: deny all dot files rule
+        # precedence 4
+        # deny access to all dot files in any directory.
+        location ~ /\. {
+                deny all;
+        }
+
+		# name: deny php files rule
+        # precedence 4
+        # deny all php files
+        location ~ \.php$ {
+                deny all;
+        }
+
+		# name: deny storage rule
+        # precedence 4
+        # deny access to storage directory.
+        location ~ /storage {
+                deny all;
+        }
+
+		# name: deny files extension rule
+		# precedence 4
+        # deny access to these file extensions
+        location ~ \.(json|lock|phar|example|xml|md|config|txt|help|html|ds|yml|yaml|sql)$ {
+            deny all;
+        }
+
+		# name: default match rule
+        # precedence 5
+        # try serve uri $uri/, (append /), if present else internally redirect to /index.php
+        location / {
+                try_files $uri $uri/ /index.php?$args;
+        }
 }
 
-
-# Virtual Host configuration for example.com
-#
-# You can move that to a different file under sites-available/ and symlink that
-# to sites-enabled/ to enable it.
-#
-#server {
-#	listen 80;
-#	listen [::]:80;
-#
-#	server_name example.com;
-#
-#	root /var/www/example.com;
-#	index index.html;
-#
-#	location / {
-#		try_files $uri $uri/ =404;
-#	}
-#}