Enable proc_open

[chef.git] / cookbooks / nominatim / templates / default / nginx.erb

diff --git a/cookbooks/nominatim/templates/default/nginx.erb b/cookbooks/nominatim/templates/default/nginx.erb
index fd4ed93fad36f8e103d358012feec1ba7babd77f..2e851c517087020c659f677c8decab434d940c87 100644 (file)
--- a/cookbooks/nominatim/templates/default/nginx.erb
+++ b/cookbooks/nominatim/templates/default/nginx.erb
@@ -100,9 +100,9 @@ server {
 
 server {
     # IPv4
-    listen       443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
+    listen       443 ssl deferred backlog=16384 reuseport http2 default_server;
     # IPv6
-    listen       [::]:443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
+    listen       [::]:443 ssl deferred backlog=16384 reuseport http2 default_server;
     server_name  localhost;
 
     ssl_certificate /etc/ssl/certs/<%= node[:fqdn] %>.pem;
@@ -133,6 +133,10 @@ server {
     }
 
     location / {
+        try_files $uri $uri/ @php;
+    }
+
+    location @php {
         if ($blocked_user_agent ~ ^2$)
         { return 403; }
         if ($blocked_referrer)
@@ -140,10 +144,6 @@ server {
         if ($blocked_email)
         { return 403; }
 
-        try_files $uri $uri/ @php;
-    }
-
-    location @php {
         limit_req zone=www burst=10;
         limit_req zone=tarpit burst=2;
         limit_req_status 429;
@@ -155,6 +155,13 @@ server {
     }
 
     location ~* \.php$ {
+        if ($blocked_user_agent ~ ^2$)
+        { return 403; }
+        if ($blocked_referrer)
+        { return 403; }
+        if ($blocked_email)
+        { return 403; }
+
         limit_req zone=www burst=10;
         limit_req zone=tarpit burst=2;
         limit_req_status 429;