matomo-org / matomo-nginx

Nginx configuration for running Matomo
408 stars 121 forks source link

Only permit defined paths #77

Open tumd opened 1 year ago

tumd commented 1 year ago

The current nginx config is permissive by default which makes it unsafe and bad practice.

For example the file console "php"-file is currently publicly accessible. And future new/renamed files or paths will be accessible too that hasn't been included in the nginx config.

This PR revers this and instead denies everything except for the the defined paths. These changes also makes it easy to restrict public access the full matomo site, by still allowing access to the paths needed to gather analytics (matomo.js, matomo.php, piwik.js & piwik.php).

As this is a slightly modified variant of what I have been tested, it may need some proofing.