Optimize configuration

install/deb/templates/mail/nginx/web_system.stpl

@@ -1,27 +1,28 @@
 server {
     listen      %ip%:%web_ssl_port% ssl http2;
     server_name %domain% %alias%;
-    root /var/lib/roundcube;
-    index index.php;
-
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
-
-    location / {
-        try_files      $uri $uri/ /index.php?$args;
-        location ~* ^.+\.(jpg,jpeg,gif,png,ico,svg,css,zip,tgz,gz,rar,bz2,doc,xls,exe,pdf,ppt,txt,odt,ods,odp,odf,tar,wav,bmp,rtf,js,mp3,avi,mpeg,flv,html,htm)$ {
-            alias          /var/lib/roundcube/;
-            expires        15m;
-        }
+    root        /var/lib/roundcube;
+    index       index.php;
+   
+    location ~ /(config|temp|logs) {
+        deny all
+        return 404;
     }
-
-    location /error/ {
-        alias   %home%/%user%/web/%root_domain%/document_errors/;
+    
+    location ~ /\.(?!well-known\/) {
+        deny all;
+        return 404;
     }
 
-    location ~ /(config|temp|logs) {
-        return 404;
+    location / {
+        try_files $uri $uri/ /index.php?$args;
+        location ~* ^.+\.(ogg|ogv|svg|svgz|swf|eot|otf|woff|mov|mp3|mp4|webm|flv|ttf|rss|atom|jpg|jpeg|gif|png|ico|bmp|mid|midi|wav|rtf|css|js|jar)$ {
+            alias /var/lib/roundcube/;
+            expires 1h;
+            fastcgi_hide_header "Set-Cookie";
+        }
     }
 
     location ~ ^/(.*\.php)$ {
@@ -32,11 +33,13 @@ server {
         fastcgi_param SCRIPT_FILENAME $request_filename;
     }
     
-    location ~ /\.ht    {return 404;}
-    location ~ /\.svn/  {return 404;}
-    location ~ /\.git/  {return 404;}
-    location ~ /\.hg/   {return 404;}
-    location ~ /\.bzr/  {return 404;}
+    error_page 403 /error/404.html;
+    error_page 404 /error/404.html;
+    error_page 500 502 503 504 /error/50x.html;
+    
+    location /error/ {
+        alias   %home%/%user%/web/%root_domain%/document_errors/;
+    }
 
-    include %home%/%user%/conf/mail/%root_domain%/%web_system%.ssl.conf_*;
+    include %home%/%user%/conf/mail/%root_domain%/%web_system%.conf_*;
 }