Optimize configuration (#271)

install/deb/templates/mail/nginx/web_system.tpl

@@ -1,27 +1,30 @@
 server {
     listen      %ip%:%web_port%;
     server_name %domain% %alias%;
-    root /var/lib/roundcube;
-    index index.php;
+    root        /var/lib/roundcube;
+    index       index.php;
 
     include %home%/%user%/conf/mail/%root_domain%/nginx.forcessl.conf*;
+    
+    location ~ /(config|temp|logs) {
+        deny all
+        return 404;
+    }
+    
+    location ~ /\.(?!well-known\/) {
+        deny all;
+        return 404;
+    }
 
     location / {
-        try_files      $uri $uri/ /index.php?$args;
-        location ~* ^.+\.(jpg,jpeg,gif,png,ico,svg,css,zip,tgz,gz,rar,bz2,doc,xls,exe,pdf,ppt,txt,odt,ods,odp,odf,tar,wav,bmp,rtf,js,mp3,avi,mpeg,flv,html,htm)$ {
-            alias          /var/lib/roundcube/;
-            expires        15m;
+        try_files $uri $uri/ /index.php?$args;
+        location ~* ^.+\.(ogg|ogv|svg|svgz|swf|eot|otf|woff|mov|mp3|mp4|webm|flv|ttf|rss|atom|jpg|jpeg|gif|png|ico|bmp|mid|midi|wav|rtf|css|js|jar)$ {
+            alias /var/lib/roundcube/;
+            expires 1h;
+            fastcgi_hide_header "Set-Cookie";
         }
     }
 
-    location /error/ {
-        alias   %home%/%user%/web/%root_domain%/document_errors/;
-    }
-
-    location ~ /(config|temp|logs) {
-        return 404;
-    }
-    
     location ~ ^/(.*\.php)$ {
         alias /var/lib/roundcube/$1;
         fastcgi_pass 127.0.0.1:9000;
@@ -30,11 +33,13 @@ server {
         fastcgi_param SCRIPT_FILENAME $request_filename;
     }
     
-    location ~ /\.ht    {return 404;}
-    location ~ /\.svn/  {return 404;}
-    location ~ /\.git/  {return 404;}
-    location ~ /\.hg/   {return 404;}
-    location ~ /\.bzr/  {return 404;}
+    error_page 403 /error/404.html;
+    error_page 404 /error/404.html;
+    error_page 500 502 503 504 /error/50x.html;
+    
+    location /error/ {
+        alias   %home%/%user%/web/%root_domain%/document_errors/;
+    }
 
     include %home%/%user%/conf/mail/%root_domain%/%web_system%.conf_*;
 }