# ============================================================
# Nginx-Direktiven für taschenmuschi-kaufen.de
# generiert: 2026-05-23T13:06:46+02:00
#
# In ispconfig: Sites → taschenmuschi-kaufen.de → Reiter „Optionen" → „Nginx-Direktiven"
# (komplett einfügen, oben drüber/drunter setzt ispconfig server/location auto).
# Server-Hauptblock + Listen + SSL kommen aus den ispconfig-Site-Settings.
# ============================================================

# -- Performance / Sicherheit ---------------------------------
client_max_body_size 64M;
server_tokens off;

add_header X-Frame-Options "SAMEORIGIN"        always;
add_header X-Content-Type-Options "nosniff"    always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "interest-cohort=()" always;

# -- WordPress Pretty-Permalinks ------------------------------
location / {
    try_files $uri $uri/ /index.php?$args;
}

# -- PHP-Handler (ispconfig setzt fastcgi_pass selbst — wir geben nur die
#    Datei-Maschen + Fallback an, damit Plugin-/Theme-Updates funktionieren).
location ~ \.php$ {
    try_files $uri =404;
    include /etc/nginx/fastcgi_params;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    fastcgi_param  PATH_INFO        $fastcgi_path_info;
    fastcgi_intercept_errors on;
    # Hinweis: fastcgi_pass kommt aus dem ispconfig-Auto-Block (unix:/var/lib/php7.x-fpm/web*.sock).
}

# -- Static-Asset-Caching -------------------------------------
location ~* \.(?:css|js|woff2?|ttf|eot|otf|svg|ico|png|jpe?g|gif|webp|avif|mp4|webm)$ {
    expires 30d;
    access_log off;
    add_header Cache-Control "public, max-age=2592000, immutable";
    try_files $uri =404;
}

# -- Schutz vor Crawlern bei sensiblen WP-Dateien --------------
location = /wp-config.php           { deny all; return 404; }
location = /wp-config-sample.php    { deny all; return 404; }
location = /readme.html             { deny all; return 404; }
location = /license.txt             { deny all; return 404; }
location = /xmlrpc.php              { deny all; return 404; }
location = /wp-admin/install.php    { deny all; return 404; }
location = /wp-admin/maint/repair.php { deny all; return 404; }

# -- Dev-/Build-Dateien dieses Projekts blockieren ------------
location = /install.sh              { deny all; return 404; }
location = /install.log             { deny all; return 404; }
location = /install-wp.php          { deny all; return 404; }
location = /nginx-directives.conf   { deny all; return 404; }
location = /router.php              { deny all; return 404; }
location = /start-local.sh          { deny all; return 404; }
location ~ /\.local-server\.      { deny all; return 404; }
location ^~ /_staging/              { deny all; return 404; }
location ^~ /tools/                 { deny all; return 404; }

# -- Schutz vor Hidden-/Dotfiles + Logs -----------------------
location ~ /\.(git|env|htaccess|svn|hg) { deny all; return 404; }
location ~ /(?:\.|wp-content/debug\.log$) { deny all; return 404; }

# -- Keine PHP-Ausführung in uploads/ -------------------------
location ~* /wp-content/uploads/.+\.(?:php|phtml|phar|pl|py|jsp|asp|sh|cgi)$ {
    deny all;
    return 404;
}

# -- Author-Enumeration verhindern ----------------------------
if ($args ~* "author=\d") {
    return 403;
}

# -- xmlrpc.php komplett zu (siehe oben), zusätzlich path-tolerant:
location ~* ^/xmlrpc\.php$ { deny all; return 404; }

# -- Optionale Auth für wp-login.php (HTTP-Basic-Schutz, falls erwünscht).
# location = /wp-login.php {
#     auth_basic "Login geschützt";
#     auth_basic_user_file /var/www/clients/clientX/webY/.htpasswd;
#     try_files $uri =404;
#     include /etc/nginx/fastcgi_params;
#     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#     # fastcgi_pass siehe ispconfig-Auto-Block
# }

# -- Health-Check für Monitoring (optional) -------------------
# location = /health.txt { return 200 "ok"; add_header Content-Type text/plain; }