Some fixes in configuration files:

  after upgrade from D6 to D7 uploaded in D6 images stay in there old path;
  added htc extention to static served files;
  restrict direct access to pot files;
  disallow access to .bzr, .git, .hg, .svn, .cvs directories;
  some other comments correction.

Author: iryston

apps/drupal/drupal.conf

@@ -61,7 +61,20 @@ location / {
         log_not_found off;
     }
 
-    ## Drupal 7 image handling, i.e., imagecache in core. See:
+    ## If accessing an image generated by Drupal 6 imagecache, serve it
+    ## directly if available, if not relay the request to Drupal to (re)generate
+    ## the image.
+    location ~* /imagecache/ {
+        ## Image hotlinking protection. If you want hotlinking
+        ## protection for your images uncomment the following line.
+        #include apps/drupal/hotlinking_protection.conf;
+
+        access_log off;
+        expires 30d;
+        try_files $uri @drupal;
+    }
+
+    ## Drupal 7 generated image handling, i.e., imagecache in core. See:
     ## http://drupal.org/node/371374.
     location ~* /files/styles/ {
         ## Image hotlinking protection. If you want hotlinking
@@ -98,7 +111,7 @@ location / {
     }
 
     ## All static files will be served directly.
-    location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|html|xml)$ {
+    location ~* ^.+\.(?:css|cur|js|jpg|jpeg|gif|htc|ico|png|html|xml)$ {
         access_log off;
         expires 30d;
         ## No need to bleed constant updates. Send the all shebang in one
@@ -145,7 +158,7 @@ location / {
     ## Pseudo streaming of FLV files:
     ## http://wiki.nginx.org/HttpFlvStreamModule.
     ## If pseudo streaming isn't working, try to comment
-    ## out line 115 in nginx.conf:
+    ## out in nginx.conf line with:
     ## add_header X-Frame-Options SAMEORIGIN;
     location ^~ /sites/default/files/video/flv {
         location ~* ^/sites/default/files/video/flv/.*\.flv$ {
@@ -190,7 +203,7 @@ location / {
     ## Replicate the Apache <FilesMatch> directive of Drupal standard
     ## .htaccess. Disable access to any code files. Return a 404 to curtail
     ## information disclosure. Hide also the text files.
-    location ~* ^(?:.+\.(?:htaccess|make|txt|engine|inc|info|install|module|profile|po|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
+    location ~* ^(?:.+\.(?:htaccess|make|txt|engine|inc|info|install|module|profile|po|pot|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
         return 404;
     }
 
@@ -222,7 +235,7 @@ location @drupal {
 
     ## Filefield Upload progress
     ## http://drupal.org/project/filefield_nginx_progress support
-    ## through the NgninxUploadProgress modules.
+    ## through the NginxUploadProgress modules.
     track_uploads uploads 60s;
 }
 
@@ -247,12 +260,28 @@ location @drupal-no-args {
     #include apps/drupal/microcache_proxy_auth.conf;
 }
 
-## Disallow access to .git directory: return 404 as not to disclose
+## Disallow access to .bzr, .git, .hg, .svn, .cvs directories: return 404 as not to disclose
 ## information.
+location ^~ /.bzr {
+    return 404;
+}
+
 location ^~ /.git {
     return 404;
 }
 
+location ^~ /.hg {
+    return 404;
+}
+
+location ^~ /.svn {
+    return 404;
+}
+
+location ^~ /.cvs {
+    return 404;
+}
+
 ## Disallow access to patches directory.
 location ^~ /patches {
     return 404;

apps/drupal/drupal_boost.conf

@@ -1,8 +1,7 @@
 # -*- mode: nginx; mode: flyspell-prog; ispell-local-dictionary: "american" -*-
 ### Nginx configuration for using Boost with Drupal. This
-### configuration makes use of drush
-### (http:///drupal.org/project/drush) for site maintenance and like
-### tasks:
+### configuration makes use of drush (http:///drupal.org/project/drush)
+### for site maintenance and like tasks:
 ###
 ### 1. Run the cronjobs.
 ### 2. Run the DB and code updates: drush up or drush upc followed by
@@ -62,9 +61,9 @@ location / {
         log_not_found off;
     }
 
-    ## If accessing an image generated by imagecache, serve it directly if
-    ## available, if not relay the request to Drupal to (re)generate the
-    ## image.
+    ## If accessing an image generated by Drupal 6 imagecache, serve it
+    ## directly if available, if not relay the request to Drupal to (re)generate
+    ## the image.
     location ~* /imagecache/ {
         ## Image hotlinking protection. If you want hotlinking
         ## protection for your images uncomment the following line.
@@ -78,6 +77,10 @@ location / {
     ## Drupal 7 generated image handling, i.e., imagecache in core. See:
     ## http://drupal.org/node/371374.
     location ~* /files/styles/ {
+        ## Image hotlinking protection. If you want hotlinking
+        ## protection for your images uncomment the following line.
+        #include apps/drupal/hotlinking_protection.conf;
+
         access_log off;
         expires 30d;
         try_files $uri @drupal;
@@ -108,7 +111,7 @@ location / {
     }
 
     ## All static files will be served directly.
-    location ~* ^.+\.(?:css|cur|js|jpg|jpeg|gif|ico|png|html|xml)$ {
+    location ~* ^.+\.(?:css|cur|js|jpg|jpeg|gif|htc|ico|png|html|xml)$ {
         access_log off;
         expires 30d;
         ## No need to bleed constant updates. Send the all shebang in one
@@ -149,6 +152,9 @@ location / {
 
     ## Pseudo streaming of FLV files:
     ## http://wiki.nginx.org/HttpFlvStreamModule.
+    ## If pseudo streaming isn't working, try to comment
+    ## out in nginx.conf line with:
+    ## add_header X-Frame-Options SAMEORIGIN;
     location ^~ /sites/default/files/video/flv {
         location ~* ^/sites/default/files/video/flv/.*\.flv$ {
             flv;
@@ -192,7 +198,7 @@ location / {
     ## Replicate the Apache <FilesMatch> directive of Drupal standard
     ## .htaccess. Disable access to any code files. Return a 404 to curtail
     ## information disclosure. Hide also the text files.
-    location ~* ^(?:.+\.(?:htaccess|make|txt|engine|inc|info|install|module|profile|po|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
+    location ~* ^(?:.+\.(?:htaccess|make|txt|engine|inc|info|install|module|profile|po|pot|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
         return 404;
     }
 
@@ -259,7 +265,7 @@ location @drupal {
 
     ## Filefield Upload progress
     ## http://drupal.org/project/filefield_nginx_progress support
-    ## through the NgninxUploadProgress modules.
+    ## through the NginxUploadProgress modules.
     track_uploads uploads 60s;
 }
 
@@ -280,12 +286,28 @@ location @drupal-no-args {
     #include apps/drupal/microcache_proxy_auth.conf;
 }
 
-## Disallow access to .git directory: return 404 as not to disclose
+## Disallow access to .bzr, .git, .hg, .svn, .cvs directories: return 404 as not to disclose
 ## information.
+location ^~ /.bzr {
+    return 404;
+}
+
 location ^~ /.git {
     return 404;
 }
 
+location ^~ /.hg {
+    return 404;
+}
+
+location ^~ /.svn {
+    return 404;
+}
+
+location ^~ /.cvs {
+    return 404;
+}
+
 ## Disallow access to patches directory.
 location ^~ /patches {
     return 404;

apps/drupal/drupal_boost_escaped.conf

@@ -1,8 +1,7 @@
 # -*- mode: nginx; mode: flyspell-prog; ispell-local-dictionary: "american" -*-
 ### Nginx configuration for using Boost with Drupal. This
-### configuration makes use of drush
-### (http:///drupal.org/project/drush) for site maintenance and like
-### tasks:
+### configuration makes use of drush (http:///drupal.org/project/drush)
+### for site maintenance and like tasks:
 ###
 ### 1. Run the cronjobs.
 ### 2. Run the DB and code updates: drush up or drush upc followed by
@@ -65,9 +64,9 @@ location / {
         log_not_found off;
     }
 
-    ## If accessing an image generated by imagecache, serve it directly if
-    ## available, if not relay the request to Drupal to (re)generate the
-    ## image.
+    ## If accessing an image generated by Drupal 6 imagecache, serve it
+    ## directly if available, if not relay the request to Drupal to (re)generate
+    ## the image.
     location ~* /imagecache/ {
         ## Image hotlinking protection. If you want hotlinking
         ## protection for your images uncomment the following line.
@@ -81,6 +80,10 @@ location / {
     ## Drupal 7 generated image handling, i.e., imagecache in core. See:
     ## http://drupal.org/node/371374.
     location ~* /files/styles/ {
+        ## Image hotlinking protection. If you want hotlinking
+        ## protection for your images uncomment the following line.
+        #include apps/drupal/hotlinking_protection.conf;
+
         access_log off;
         expires 30d;
         try_files $escaped_uri @drupal;
@@ -111,7 +114,7 @@ location / {
     }
 
     ## All static files will be served directly.
-    location ~* ^.+\.(?:css|cur|js|jpg|jpeg|gif|ico|png|html|xml)$ {
+    location ~* ^.+\.(?:css|cur|js|jpg|jpeg|gif|htc|ico|png|html|xml)$ {
         access_log off;
         expires 30d;
         ## No need to bleed constant updates. Send the all shebang in one
@@ -152,6 +155,9 @@ location / {
 
     ## Pseudo streaming of FLV files:
     ## http://wiki.nginx.org/HttpFlvStreamModule.
+    ## If pseudo streaming isn't working, try to comment
+    ## out in nginx.conf line with:
+    ## add_header X-Frame-Options SAMEORIGIN;
     location ^~ /sites/default/files/video/flv {
         location ~* ^/sites/default/files/video/flv/.*\.flv$ {
             flv;
@@ -195,7 +201,7 @@ location / {
     ## Replicate the Apache <FilesMatch> directive of Drupal standard
     ## .htaccess. Disable access to any code files. Return a 404 to curtail
     ## information disclosure. Hide also the text files.
-    location ~* ^(?:.+\.(?:htaccess|make|txt|engine|inc|info|install|module|profile|po|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
+    location ~* ^(?:.+\.(?:htaccess|make|txt|engine|inc|info|install|module|profile|po|pot|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
         return 404;
     }
 
@@ -262,7 +268,7 @@ location @drupal {
 
     ## Filefield Upload progress
     ## http://drupal.org/project/filefield_nginx_progress support
-    ## through the NgninxUploadProgress modules.
+    ## through the NginxUploadProgress modules.
     track_uploads uploads 60s;
 }
 
@@ -283,12 +289,28 @@ location @drupal-no-args {
     #include apps/drupal/microcache_proxy_auth.conf;
 }
 
-## Disallow access to .git directory: return 404 as not to disclose
+## Disallow access to .bzr, .git, .hg, .svn, .cvs directories: return 404 as not to disclose
 ## information.
+location ^~ /.bzr {
+    return 404;
+}
+
 location ^~ /.git {
     return 404;
 }
 
+location ^~ /.hg {
+    return 404;
+}
+
+location ^~ /.svn {
+    return 404;
+}
+
+location ^~ /.cvs {
+    return 404;
+}
+
 ## Disallow access to patches directory.
 location ^~ /patches {
     return 404;

apps/drupal/drupal_escaped.conf

@@ -64,9 +64,9 @@ location / {
         log_not_found off;
     }
 
-    ## If accessing an image generated by imagecache, serve it directly if
-    ## available, if not relay the request to Drupal to (re)generate the
-    ## image.
+    ## If accessing an image generated by Drupal 6 imagecache, serve it
+    ## directly if available, if not relay the request to Drupal to (re)generate
+    ## the image.
     location ~* /imagecache/ {
         ## Image hotlinking protection. If you want hotlinking
         ## protection for your images uncomment the following line.
@@ -80,6 +80,10 @@ location / {
     ## Drupal 7 generated image handling, i.e., imagecache in core. See:
     ## http://drupal.org/node/371374.
     location ~* /files/styles/ {
+        ## Image hotlinking protection. If you want hotlinking
+        ## protection for your images uncomment the following line.
+        #include apps/drupal/hotlinking_protection.conf;
+
         access_log off;
         expires 30d;
         try_files $escaped_uri @drupal;
@@ -110,7 +114,7 @@ location / {
     }
 
     ## All static files will be served directly.
-    location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|html|xml)$ {
+    location ~* ^.+\.(?:css|cur|js|jpg|jpeg|gif|htc|ico|png|html|xml)$ {
         access_log off;
         expires 30d;
         ## No need to bleed constant updates. Send the all shebang in one
@@ -157,7 +161,7 @@ location / {
     ## Pseudo streaming of FLV files:
     ## http://wiki.nginx.org/HttpFlvStreamModule.
     ## If pseudo streaming isn't working, try to comment
-    ## out line 115 in nginx.conf:
+    ## out in nginx.conf line with:
     ## add_header X-Frame-Options SAMEORIGIN;
     location ^~ /sites/default/files/video/flv {
         location ~* ^/sites/default/files/video/flv/.*\.flv$ {
@@ -202,7 +206,7 @@ location / {
     ## Replicate the Apache <FilesMatch> directive of Drupal standard
     ## .htaccess. Disable access to any code files. Return a 404 to curtail
     ## information disclosure. Hide also the text files.
-    location ~* ^(?:.+\.(?:htaccess|make|txt|engine|inc|info|install|module|profile|po|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
+    location ~* ^(?:.+\.(?:htaccess|make|txt|engine|inc|info|install|module|profile|po|pot|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
         return 404;
     }
 
@@ -234,7 +238,7 @@ location @drupal {
 
     ## Filefield Upload progress
     ## http://drupal.org/project/filefield_nginx_progress support
-    ## through the NgninxUploadProgress modules.
+    ## through the NginxUploadProgress modules.
     track_uploads uploads 60s;
 }
 
@@ -259,12 +263,28 @@ location @drupal-no-args {
     #include apps/drupal/microcache_proxy_auth.conf;
 }
 
-## Disallow access to .git directory: return 404 as not to disclose
+## Disallow access to .bzr, .git, .hg, .svn, .cvs directories: return 404 as not to disclose
 ## information.
+location ^~ /.bzr {
+    return 404;
+}
+
 location ^~ /.git {
     return 404;
 }
 
+location ^~ /.hg {
+    return 404;
+}
+
+location ^~ /.svn {
+    return 404;
+}
+
+location ^~ /.cvs {
+    return 404;
+}
+
 ## Disallow access to patches directory.
 location ^~ /patches {
     return 404;

apps/drupal/microcache_fcgi.conf

@@ -36,4 +36,4 @@ expires epoch;
 #fastcgi_cache_lock on;
 ## The default timeout, i.e., the time to way before forwarding the
 ## second request upstream if no reply as arrived in the meantime is 5s.
-# fastcgi_cache_lock_timeout 8000; # in miliseconds.
+#fastcgi_cache_lock_timeout 8000; # in miliseconds.

apps/drupal/microcache_fcgi_auth.conf

@@ -34,4 +34,4 @@ expires epoch;
 #fastcgi_cache_lock on;
 ## The default timeout, i.e., the time to way before forwarding the
 ## second request upstream if no reply as arrived in the meantime is 5s.
-# fastcgi_cache_lock_timeout 8000; # in miliseconds.
+#fastcgi_cache_lock_timeout 8000; # in miliseconds.

koi-win

@@ -1,4 +1,3 @@
-
 charset_map  koi8-r  windows-1251 {
 
     80  88 ; # euro