provizioning 0.8.6 → 0.8.7

data/lib/provizioning/version.rb

@@ -1,3 +1,3 @@
 module Provizioning
-  VERSION = "0.8.6"
+  VERSION = "0.8.7"
 end

data/puppet/modules/nginx/templates/fcgi_drupal_site.erb

@@ -64,4 +64,10 @@ server {
       expires max;
       log_not_found off;
     }
+
+    # Deny access to .htaccess files,
+    # git & svn repositories, etc
+    location ~ /(\.ht|\.git|\.svn) {
+        deny  all;
+    }
 }

data/puppet/modules/nginx/templates/fcgi_site.erb

@@ -1,38 +1,57 @@
 server {
-        listen   <%= listen %> ;
-
-	server_name  <% real_server_name.each do |s_n| -%><%= s_n %> <% end -%>;
-
-        access_log  <%= real_access_log %>;
-
-	root <%= root %>;
+  server_name  <% real_server_name.each do |s_n| -%><%= s_n %> <% end -%>;
+  access_log  <%= real_access_log %>;
+  error_log <%= real_error_log %>;
+  root <%= root %>;
 
 <% if listen == '443' %>
-        ssl  on;
-        ssl_certificate  <%= real_ssl_certificate %>;
-        ssl_certificate_key  <%= real_ssl_certificate_key %>;
+  ssl  on;
+  ssl_certificate  <%= real_ssl_certificate %>;
+  ssl_certificate_key  <%= real_ssl_certificate_key %>;
 
-        ssl_session_timeout  <%= ssl_session_timeout %>;
+  ssl_session_timeout  <%= ssl_session_timeout %>;
 
-        ssl_protocols  SSLv2 SSLv3 TLSv1;
-        ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
-        ssl_prefer_server_ciphers   on;
+  ssl_protocols  SSLv2 SSLv3 TLSv1;
+  ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
+  ssl_prefer_server_ciphers   on;
 <% end -%>
-        location / {
-        }
-
-	location ~ \.php$ {
-		fastcgi_pass <%= fastcgi_pass %>;
-		fastcgi_index index.php;
-		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-		include /etc/nginx/includes/fastcgi_params.inc;
-	}
-
-	location ~ /\.ht {
-                deny  all;
-        }
-
-<% if include  != '' %>	<%include.each do |inc| %>include <%= inc %>;
-	<% end -%><% end -%>
+  # Very rarely should these ever be accessed outside of your LAN
+  location ~* \.(txt|log)$ {
+    allow 10.0.0.0/8;
+    allow 172.16.0.0/12;
+    allow 192.168.0.0/16;
+    deny all;
+  }
+
+  location ~ \..*/.*\.php$ {
+    return 403;
+  }
+
+  location / {
+    # This is cool because no php is touched for static content
+     try_files $uri @rewrite;
+  }
+
+  location @rewrite {
+    # Some modules enforce no slash (/) at the end of the URL
+    # Else this rewrite block wouldn't be needed (GlobalRedirect)
+     rewrite ^/(.*)$ /index.php?url=$1;
+  }
+
+  location ~ \.php$ {
+    fastcgi_pass <%= fastcgi_pass %>;
+    fastcgi_index index.php;
+    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    include /etc/nginx/includes/fastcgi_params.inc;
+  }
+
+  # Deny access to .htaccess files,
+  # git & svn repositories, etc
+  location ~ /(\.ht|\.git|\.svn) {
+      deny  all;
+  }
+
+<% if include  != '' %> <%include.each do |inc| %>include <%= inc %>;
+  <% end -%><% end -%>
 }
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: provizioning
 version: !ruby/object:Gem::Version
-  version: 0.8.6
+  version: 0.8.7
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ date: 2012-03-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: capistrano
-  requirement: &70322742592560 !ruby/object:Gem::Requirement
+  requirement: &70223413217020 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70322742592560
+  version_requirements: *70223413217020
 - !ruby/object:Gem::Dependency
   name: capistrano-ext
-  requirement: &70322742582000 !ruby/object:Gem::Requirement
+  requirement: &70223413216500 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,7 +32,7 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70322742582000
+  version_requirements: *70223413216500
 description: Puppet server provisioning tools, recipes and templates
 email:
 - victor.castell@season.es