changes

docs/nginx-vikon-security.conf

@@ -0,0 +1,37 @@
+# Nginx Configuration for Vikon Module Security
+# 
+# These rules are ALREADY APPLIED in:
+# - _docker/nginx/local/conf.d/nginx.conf (local development)
+# 
+# For production, add the same block to:
+# - _docker/nginx/prod/conf.d/nginx.conf
+# - _docker/nginx/test/conf.d/nginx.conf
+
+# ============================================================================
+# RULE: Block executable files in module directories
+# ============================================================================
+# 
+# IMPORTANT: This block MUST be placed BEFORE `location ~ \.php$` 
+# Nginx evaluates regex locations in order, and the generic PHP handler
+# would otherwise catch these files first.
+#
+# Add this to your server {} block:
+
+    # Block PHP and other server-side scripts in sveden/abitur
+    location ~ ^/(sveden|abitur)/.*\.(php|php3|php4|php5|php7|php8|phps|phtml|pl|py|pyc|cgi|sh|bash|bat|cmd|exe|com|ps1|psm1|rb|asp|aspx|jsp|cfm)$ {
+        deny all;
+        return 403;
+        access_log /var/log/nginx/blocked_module_scripts.log;
+    }
+
+# ============================================================================
+# TESTING
+# ============================================================================
+#
+# After adding the rule:
+# 1. Restart Docker: docker compose restart nginx
+# 2. Test blocked: curl -I http://localhost/sveden/test.php (should return 403)
+# 3. Test allowed: curl -I http://localhost/sveden/index.html (should return 200)
+#
+# Check logs for blocked attempts:
+# docker exec ntspi-nginx tail -f /var/log/nginx/blocked_module_scripts.log