bring on more tildes hopefully

examples/nginx/member-php.inc

@@ -0,0 +1,31 @@
+# In the server block: AFTER dotfile denial, BEFORE generic script denial.
+# Enable only after installing and testing the matching member FPM pool.
+location ~ ^/(?:~|u/)member/(?<member_php_script>.+\.php)$ {
+    # try_files changes $uri; retain the original public script URL for PHP.
+    set $member_php_uri $uri;
+    root /home/member/public_html;
+    disable_symlinks on;
+    try_files /$member_php_script =404;
+    fastcgi_param QUERY_STRING $query_string;
+    fastcgi_param REQUEST_METHOD $request_method;
+    fastcgi_param CONTENT_TYPE $content_type;
+    fastcgi_param CONTENT_LENGTH $content_length;
+    fastcgi_param SCRIPT_FILENAME /home/member/public_html/$member_php_script;
+    fastcgi_param SCRIPT_NAME $member_php_uri;
+    fastcgi_param REQUEST_URI $request_uri;
+    fastcgi_param DOCUMENT_URI $member_php_uri;
+    fastcgi_param DOCUMENT_ROOT /home/member/public_html;
+    fastcgi_param SERVER_PROTOCOL $server_protocol;
+    fastcgi_param REQUEST_SCHEME $scheme;
+    fastcgi_param HTTPS $https if_not_empty;
+    fastcgi_param GATEWAY_INTERFACE CGI/1.1;
+    fastcgi_param SERVER_SOFTWARE nginx;
+    fastcgi_param REMOTE_ADDR $remote_addr;
+    fastcgi_param REMOTE_PORT $remote_port;
+    fastcgi_param REMOTE_USER $remote_user;
+    fastcgi_param SERVER_ADDR $server_addr;
+    fastcgi_param SERVER_PORT $server_port;
+    fastcgi_param SERVER_NAME $server_name;
+    fastcgi_param HTTP_PROXY "";
+    fastcgi_pass unix:/run/php-fpm/tilde-member.sock;
+}

examples/nginx/tilde-static.conf

@@ -0,0 +1,39 @@
+# HTTP bootstrap for a new host. Replace the domain, then add TLS.
+# This file belongs inside nginx's http context, e.g. /etc/nginx/conf.d/.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name tilde.example.net;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/letsencrypt;
+        default_type text/plain;
+        try_files $uri =404;
+    }
+
+    # These precede the userdir regex so private files are denied there too.
+    location ~ (^|/)\. {
+        return 404;
+    }
+
+    # A static-only host must not download executable script source as text.
+    location ~* \.(?:php[0-9]*|phtml|phar|cgi|pl|py|sh|lua)(?:/|$) {
+        return 404;
+    }
+
+    location ~ "^/(?:~|u/)(?<tilde_user>[a-z_][a-z0-9_-]{0,31})(?<tilde_path>/.*)?$" {
+        alias /home/$tilde_user/public_html$tilde_path;
+        index index.html index.htm;
+        autoindex off;
+        disable_symlinks on;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}