# Wordpress site 443
# Domain: example.com
# Login point: zzz
# Login secret: xxx
# Cert: /etc/letsencrypt/live/example.com
# LogTag: tag=example_com (only allows alphanumeric characters and underscore)


// wordpress MU PLUGIN

add_action('wp_logout','auto_redirect_after_logout');
function auto_redirect_after_logout(){
         $current_link = home_url().'/zzz';   
         wp_redirect( $current_link);
      exit();
}

#fastcgi_cache_path /var/cache/nginx/example.com levels=1:2 keys_zone=example.com:10m inactive=2h use_temp_path=off;

server {

      listen 443;
      listen [::]:443;
      listen 443 quic;
      listen [::]:443 quic;

      server_name             example.com;

      ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
      ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
      ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

      access_log syslog:server=unix:/dev/log,tag=nginx_error,nohostname main if=$error_log;
      access_log syslog:server=unix:/dev/log,tag=nginx_access,nohostname main if=$access_log;

      include /etc/nginx/bots.d/blockbots.conf;

      if ($da_block) { return 444;}

      root    /www/html/example.com/public;

      #more_set_headers  'X-Robots-Tag: $robots';
      more_set_headers  'X-Robots-Tag: noindex, nofollow, nosnippet, noarchive';

      include /www/nconf/common;

      include /www/nconf/wordpress;

      location = /zzz {
            rewrite ^ https://example.com/wp-login.php?p=xxx last;
      }


      location / {

            limit_except GET HEAD POST { deny all; }

            if ($args ~ "^author=\d") { return 403;}

            include /www/nconf/headers_cors;
            include /www/nconf/headers;

            #add_header X-Cache $upstream_cache_status;

            add_header Content-Security-Policy  "default-src 'self' https: data: 'unsafe-inline'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval';" always;

            location ~ ^[^.]*$ {

                  fastcgi_param SCRIPT_FILENAME $document_root/index.php;
                  limit_req zone=search nodelay;
                  include  /www/nconf/fcgi;

                  #fastcgi_cache     example.com;
                  #include  /www/nconf/fcache;
                  #fastcgi_cache_valid 404      10m;
                  #fastcgi_cache_valid 200 301 302 3h;
                  #fastcgi_cache_valid any      60m;

            }


            location ~ ^/wp-login\.php {

                  set $b "B";

                  if ($args !~ "p=xxx") {
                        set $b "D";
                  }

                  set $y "Y";

                  if ($http_referer !~ "p=xxx") {
                        set $y "U";
                  }

                  include  /www/nconf/wp_login;

            }


            #location ~ ^/wp-(?:comments-post|links-opml|login|mail|signup|trackback)\.php$

            location ^~ /wp-json/ {

                  #access_log off;
                  #if ($http_referer !~ ^https?://example.com) {
                  #      access_log syslog:server=unix:/dev/log,tag=nginx_access,nohostname main;
                  #}
                  #limit_except GET HEAD POST OPTIONS { deny all; }
                  return 444;
                  #fastcgi_param SCRIPT_FILENAME $document_root/index.php;
                  #include  /www/nconf/fcgi;
            }

            location ~ \.php$ {
                  return 444;
                  #fastcgi_param SCRIPT_FILENAME $request_filename;
                  #include  /www/nconf/fcgi;
            }

      }


}

# Remove if subdomain

server {
      listen 443;
      listen [::]:443;
      listen 443 quic;
      listen [::]:443 quic;
      server_name www.example.com;
      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
      ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
      ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
      ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
      return 308 https://example.com$request_uri;

}

server {
      listen 80;
      listen [::]:80;
      server_name example.com www.example.com;
      return 301 https://example.com$request_uri;
}