Updated nginx prod configuration

Added schedule upload functionality in Filament
Updated .gitignore in public directory

_docker/nginx/prod/conf.d/nginx.conf

@@ -14,12 +14,10 @@ server {
     return 301 https://www.ntspi.ru$request_uri;
 }
 
-
 server {
     listen 443 ssl http2;
     server_name www.ntspi.ru;
 
-    # SSL-конфигурация
     ssl_certificate /etc/letsencrypt/live/www.ntspi.ru/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/www.ntspi.ru/privkey.pem;
     ssl_trusted_certificate /etc/letsencrypt/live/www.ntspi.ru/chain.pem;
@@ -34,7 +32,6 @@ server {
     resolver 8.8.8.8 8.8.4.4 valid=300s;
     resolver_timeout 5s;
 
-    # Ваши текущие настройки
     gzip on;
     gzip_disable "msie6";
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
@@ -49,13 +46,46 @@ server {
 
     root /var/www/public;
 
-    # Security headers
     add_header X-Frame-Options "SAMEORIGIN";
     add_header X-Content-Type-Options "nosniff";
     add_header X-XSS-Protection "1; mode=block";
     add_header Referrer-Policy "strict-origin-when-cross-origin";
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
 
+    location ~ ^/(upload|storage|images|docs|files)/.*\.php$ {
+        deny all;
+        return 404;
+    }
+
+    location ~ ^/storage/app/public/upload/iblock/.*\.php$ {
+        deny all;
+        return 404;
+    }
+
+    location ~ ^/vendor/.*\.php$ {
+        deny all;
+        return 404;
+    }
+
+    location ~ /vikon_core/internal/config\.php$ {
+        deny all;
+        return 404;
+    }
+
+    location ~ ^/vikon_core/internal/ {
+        deny all;
+        return 404;
+    }
+
+    location ~ ^/vikon_core/(?!update/index\.php|update/make_executor\.php).*\.php$ {
+         deny all;
+         return 404;
+    }
+
+    location ~ /\.(?!well-known).* {
+        deny all;
+    }
+
     location / {
         add_header Access-Control-Allow-Origin *;
         try_files $uri /index.php?$args;
@@ -99,16 +129,9 @@ server {
         fastcgi_param HTTPS On;
     }
 
-    location ~ /\.ht {
-        deny all;
-    }
-
-
-
-    # Блок для обновления Let's Encrypt (оставить!)
     location ^~ /.well-known/acme-challenge/ {
         root /var/www/certbot;
         allow all;
         default_type "text/plain";
     }
-}
+}