Enable proc_open

[chef.git] / cookbooks / nominatim / templates / default / nginx.erb

diff --git a/cookbooks/nominatim/templates/default/nginx.erb b/cookbooks/nominatim/templates/default/nginx.erb
index 969f625bd077f1b18569b27ef0fe528df1ca0f46..2e851c517087020c659f677c8decab434d940c87 100644 (file)
--- a/cookbooks/nominatim/templates/default/nginx.erb
+++ b/cookbooks/nominatim/templates/default/nginx.erb
@@ -56,7 +56,7 @@ map $missing_email$missing_ua$http_referer $blocked_referrer {
    include <%= @confdir %>/nginx_blocked_referrer.conf;
 }
 
-map $missing_referer$missing_ua$http_referer $blocked_email {
+map $missing_referer$missing_ua$email_id $blocked_email {
    default 0;
    include <%= @confdir %>/nginx_blocked_email.conf;
 }
@@ -100,9 +100,9 @@ server {
 
 server {
     # IPv4
-    listen       443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
+    listen       443 ssl deferred backlog=16384 reuseport http2 default_server;
     # IPv6
-    listen       [::]:443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
+    listen       [::]:443 ssl deferred backlog=16384 reuseport http2 default_server;
     server_name  localhost;
 
     ssl_certificate /etc/ssl/certs/<%= node[:fqdn] %>.pem;
@@ -133,6 +133,10 @@ server {
     }
 
     location / {
+        try_files $uri $uri/ @php;
+    }
+
+    location @php {
         if ($blocked_user_agent ~ ^2$)
         { return 403; }
         if ($blocked_referrer)
@@ -140,10 +144,6 @@ server {
         if ($blocked_email)
         { return 403; }
 
-        try_files $uri $uri/ @php;
-    }
-
-    location @php {
         limit_req zone=www burst=10;
         limit_req zone=tarpit burst=2;
         limit_req_status 429;
@@ -155,6 +155,13 @@ server {
     }
 
     location ~* \.php$ {
+        if ($blocked_user_agent ~ ^2$)
+        { return 403; }
+        if ($blocked_referrer)
+        { return 403; }
+        if ($blocked_email)
+        { return 403; }
+
         limit_req zone=www burst=10;
         limit_req zone=tarpit burst=2;
         limit_req_status 429;