From b54d672019c2b363271da42224580c2184b6fb5f Mon Sep 17 00:00:00 2001 From: Eric Nemchik Date: Sun, 8 Feb 2026 09:39:26 -0600 Subject: [PATCH 1/2] Update default.conf.sample to deny dotfile access Signed-off-by: Eric Nemchik --- root/defaults/nginx/site-confs/default.conf.sample | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/root/defaults/nginx/site-confs/default.conf.sample b/root/defaults/nginx/site-confs/default.conf.sample index 610e920..592a294 100644 --- a/root/defaults/nginx/site-confs/default.conf.sample +++ b/root/defaults/nginx/site-confs/default.conf.sample @@ -1,4 +1,4 @@ -## Version 2025/12/26 - Changelog: https://github.com/linuxserver/docker-baseimage-alpine-nginx/commits/3.23/root/defaults/nginx/site-confs/default.conf.sample +## Version 2026/02/08 - Changelog: https://github.com/linuxserver/docker-baseimage-alpine-nginx/commits/3.23/root/defaults/nginx/site-confs/default.conf.sample server { listen 80 default_server; @@ -39,8 +39,16 @@ server { include /etc/nginx/fastcgi_params; } - # deny access to .htaccess/.htpasswd files - location ~ /\.ht { + # deny access to all dotfiles + location ~ /\. { deny all; + log_not_found off; + access_log off; + return 404; + } + + # Allow access to the ".well-known" directory + location ^~ /.well-known { + allow all; } } From d2c6bba7c45ee465a667395d07f95f8859d595d0 Mon Sep 17 00:00:00 2001 From: Eric Nemchik Date: Tue, 5 May 2026 16:29:05 -0500 Subject: [PATCH 2/2] Move dotfile denial up Signed-off-by: Eric Nemchik --- .../nginx/site-confs/default.conf.sample | 31 ++++++++++--------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/root/defaults/nginx/site-confs/default.conf.sample b/root/defaults/nginx/site-confs/default.conf.sample index 592a294..1bc5da3 100644 --- a/root/defaults/nginx/site-confs/default.conf.sample +++ b/root/defaults/nginx/site-confs/default.conf.sample @@ -1,4 +1,4 @@ -## Version 2026/02/08 - Changelog: https://github.com/linuxserver/docker-baseimage-alpine-nginx/commits/3.23/root/defaults/nginx/site-confs/default.conf.sample +## Version 2026/05/05 - Changelog: https://github.com/linuxserver/docker-baseimage-alpine-nginx/commits/3.23/root/defaults/nginx/site-confs/default.conf.sample server { listen 80 default_server; @@ -19,6 +19,18 @@ server { root $root; index index.html index.htm index.php; + # Allow access to the ".well-known" directory + location ^~ /.well-known { + allow all; + } + + # deny access to all dotfiles + location ~ /\. { + access_log off; + log_not_found off; + return 404; + } + location / { # enable for basic auth #auth_basic "Restricted"; @@ -33,22 +45,11 @@ server { #auth_basic_user_file /config/nginx/.htpasswd; fastcgi_split_path_info ^(.+\.php)(.*)$; - if (!-f $document_root$fastcgi_script_name) { return 404; } + if (!-f $document_root$fastcgi_script_name) { + return 404; + } fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } - - # deny access to all dotfiles - location ~ /\. { - deny all; - log_not_found off; - access_log off; - return 404; - } - - # Allow access to the ".well-known" directory - location ^~ /.well-known { - allow all; - } }