Настройка Nginx для GLPI и OsTicket

				
					# Редирект HTTP → HTTPS
server {
    listen 80;
    server_name help.itforprof.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;  # Для Nginx < 1.25.1 используйте: listen 443 ssl http2;

    ssl_certificate /path_to_cert/help.itforprof.com_ecc/fullchain.cer;
    ssl_certificate_key /path_to_cert/help.itforprof.com_ecc/help.itforprof.com.key;

    server_name help.itforprof.com;

    # Заголовки безопасности
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "0" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    # add_header Content-Security-Policy "default-src 'self'; ..." always;

    client_max_body_size 200m;

    # Кэширование только для статических файлов
    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
        add_header Cache-Control "public, max-age=8640000";
        access_log off;
    }

    # Защита служебных файлов
    location ~ /\.ht {
        deny all;
    }

    location = /robots.txt {
        add_header Content-Type text/plain;
        return 200 "User-agent: *\nDisallow: /\n";
    }

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location ^~ /.well-known/acme-challenge/ {
        root /tmp;
        allow all;
        default_type "text/plain";
    }

    # === OsTicket ===
    location ^~ /tickets/ {
        alias /var/www/osticket/upload/;
        index index.php;
        access_log /var/log/nginx/osticket_access.log;
        error_log /var/log/nginx/osticket_error.log;

        # Запрет доступа к каталогу include (конфиги OsTicket)
        location ~ /tickets/include {
            deny all;
            return 403;
        }

        # Маршрутизация API OsTicket
        location ~ ^/tickets/api/(?:tickets|tasks).*$ {
            try_files $uri $uri/ /tickets/api/http.php?$query_string;
        }

        # AJAX для admin-панели (SCP)
        location ~ ^/tickets/scp/ajax.php/.*$ {
            try_files $uri $uri/ /tickets/scp/ajax.php?$query_string;
        }

        # Обработка PHP
        location ~ ^/tickets/(.+\.php)(/.*)?$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php8.2-fpm.sock;
            fastcgi_split_path_info ^/tickets/(.+\.php)(/.*)$;
            set $path_info $fastcgi_path_info;
            fastcgi_param PATH_INFO $path_info;
            fastcgi_param SCRIPT_FILENAME $request_filename;
            fastcgi_param PHP_VALUE "cgi.fix_pathinfo=1";
            fastcgi_param HTTPS on;
            include fastcgi_params;
            access_log /var/log/nginx/osticket_access.log;
            error_log /var/log/nginx/osticket_error.log;
        }

        try_files $uri $uri/ /tickets/index.php?$query_string;
    }

    # === GLPI ===
    # Защита внутренних каталогов GLPI
    location ~ ^/(config|files|lib|locales|install|phpunit|tests|tools|vendor)/ {
        deny all;
        return 403;
    }

    location / {
        root /var/www/glpi;
        index index.php;
        try_files $uri /public/index.php$is_args$args;
        access_log /var/log/nginx/glpi_access.log;
        error_log /var/log/nginx/glpi_error.log;
    }

    location ~ \.php$ {
        root /var/www/glpi;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTP_COOKIE $http_cookie;
        fastcgi_param HTTPS on;
        access_log /var/log/nginx/glpi_access.log;
        error_log /var/log/nginx/glpi_error.log;
    }
}