# Nginx Configuration for Vikon Module Security
# 
# These rules are ALREADY APPLIED in:
# - _docker/nginx/local/conf.d/nginx.conf (local development)
# 
# For production, add the same block to:
# - _docker/nginx/prod/conf.d/nginx.conf
# - _docker/nginx/test/conf.d/nginx.conf

# ============================================================================
# RULE: Block executable files in module directories
# ============================================================================
# 
# IMPORTANT: This block MUST be placed BEFORE `location ~ \.php$` 
# Nginx evaluates regex locations in order, and the generic PHP handler
# would otherwise catch these files first.
#
# Add this to your server {} block:

    # Block PHP and other server-side scripts in sveden/abitur
    location ~ ^/(sveden|abitur)/.*\.(php|php3|php4|php5|php7|php8|phps|phtml|pl|py|pyc|cgi|sh|bash|bat|cmd|exe|com|ps1|psm1|rb|asp|aspx|jsp|cfm)$ {
        deny all;
        return 403;
        access_log /var/log/nginx/blocked_module_scripts.log;
    }

# ============================================================================
# TESTING
# ============================================================================
#
# After adding the rule:
# 1. Restart Docker: docker compose restart nginx
# 2. Test blocked: curl -I http://localhost/sveden/test.php (should return 403)
# 3. Test allowed: curl -I http://localhost/sveden/index.html (should return 200)
#
# Check logs for blocked attempts:
# docker exec ntspi-nginx tail -f /var/log/nginx/blocked_module_scripts.log