• nginx ¹⁾
• PHP + PHP-CGI ²⁾
• Realm of Espionage

• Windows 10 (21H2)

• https://nginx.org/en/download.html
• Last tested: nginx-1.29.3.zip

• Extract to root system drive for C:\nginx-1.29.3\nginx.exe

"explorer.exe" "%SystemDrive%"

CD "%SystemDrive%\nginx-"*"\" && "nginx.exe" -v

CD "%SystemDrive%\nginx-"*"\" && "nginx.exe" -t

MKDIR "%SystemDrive%\www\nginx\conf"

COPY /Y "%SystemDrive%\nginx-1.29.3\conf\fastcgi_params" "%SystemDrive%\www\nginx\conf"

COPY /Y "%SystemDrive%\nginx-1.29.3\conf\mime.types" "%SystemDrive%\www\nginx\conf"

DIR "%SystemDrive%\nginx-1.29.3\nginx.exe"

"netsh.exe" advfirewall firewall add rule name="nginx" dir="in" action="allow" profile="any" program="%SystemDrive%\nginx-1.29.3\nginx.exe" protocol="tcp" localport="80,443"

"netsh.exe" advfirewall firewall delete rule name="nginx"

• https://windows.php.net/download/
• https://windows.php.net/qa/
• x64 Non Thread Safe
• Last tested: php-8.5.0-nts-Win32-vs17-x64.zip

• Extract to root system drive for C:\php-*\php-cgi.exe
• Add to user Path

"explorer.exe" "%SystemDrive%"

"SystemPropertiesAdvanced.exe"

C:\php-8.5.0-nts-Win32-vs17-x64

MKDIR "%SystemDrive%\www\php"

MKDIR "%SystemDrive%\www\nginx\conf.d"

MKDIR "%SystemDrive%\www\nginx\default.d"

MKDIR "%SystemDrive%\www\nginx\vhosts.d"

• This automatically redirects non-HTTPS site links to HTTPS

"notepad.exe" "%SystemDrive%\www\nginx\conf.d\http-redirect.conf"

server {

 listen "80" "default_server";
 listen "[::]:80" "default_server";

 return "301" "https://$host$request_uri";

}

# End

• This prevents unconfigured subdomains from loading assets from other sites ³⁾

"notepad.exe" "%SystemDrive%\www\nginx\conf.d\non-existent.conf"

server {

 listen "443" "ssl" "default_server";
 http2 "on";
 server_name "_";

 return "404";

}

# End

• Add to individual site configs as an include

"notepad.exe" "%SystemDrive%\www\nginx\default.d\headers.conf"

add_header "Strict-Transport-Security" "max-age=63072000; includeSubdomains; preload" "always";
add_header "X-Content-Type-Options" "nosniff" "always";
add_header "X-Frame-Options" "sameorigin" "always";
add_header "X-XSS-Protection" "1; mode=block" "always";
add_header "Cache-Control" "no-store, no-transform, public" "always";
add_header "Referrer-Policy" "same-origin" "always";
add_header "Expect-CT" "max-age=0" "always";
add_header "Permissions-Policy" "geolocation=(), microphone=(), payment=(), usb=(), vr=(), magnetometer=(), midi=(), camera=(), ambient-light-sensor=(), accelerometer=()" "always";

# End

"notepad.exe" "%SystemDrive%\www\nginx\nginx.conf"

worker_processes "1";

events {

 worker_connections "1024";

}

http {

 access_log "off";

 include "C:/www/nginx/conf.d/*.conf";
 include "C:/www/nginx/vhosts.d/*.conf";
 include "C:/www/nginx/conf/mime.types";
 default_type "application/octet-stream";

 sendfile "on";
 tcp_nopush "on";
 tcp_nodelay "on";
 keepalive_timeout "65";
 types_hash_max_size "4096";
 server_names_hash_bucket_size "64";

 gzip "on";
 gzip_vary "on";
 gzip_proxied "any";
 gzip_comp_level "9";
 gzip_types "*";
 gzip_static "always";
 gunzip "on";

}

# End

• The empty CSP allows all and can be useful for new site bring-ups, and should be placed in site-specific configs underneath the include line(s)

add_header Content-Security-Policy "default-src 'self'" always;

add_header Content-Security-Policy "" always;

• See Let's Encrypt/Certbot for further set-up

"notepad.exe" "%SystemDrive%\www\nginx\conf.d\ssl.conf"

ssl_certificate "C:/Certbot/live/realmofespionage.xyz/fullchain.pem";
ssl_trusted_certificate "C:/Certbot/live/realmofespionage.xyz/fullchain.pem";
ssl_certificate_key "C:/Certbot/live/realmofespionage.xyz/privkey.pem";

ssl_session_timeout "10m";
ssl_session_cache "shared:SSL:10m";
ssl_session_tickets "off";
ssl_buffer_size "4k";

ssl_protocols "TLSv1.2" "TLSv1.3";
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM";
ssl_prefer_server_ciphers "on";
ssl_ecdh_curve "secp384r1";

# End

MKDIR "%SystemDrive%\www\scripts\nginx"

"explorer.exe" "%SystemDrive%\www\scripts\nginx"

"notepad.exe" "%SystemDrive%\www\scripts\nginx\Start.bat"

@echo off

CD "%SystemDrive%\nginx-"*"\"

"nginx.exe" -c "%SystemDrive%\www\nginx\nginx.conf"

:: End

"%SystemDrive%\www\scripts\nginx\Start.bat"

"notepad.exe" "%SystemDrive%\www\scripts\nginx\Stop.bat"

@echo off

CD "%SystemDrive%\nginx-"*"\"

"nginx.exe" -s "quit"

:: End

"%SystemDrive%\www\scripts\nginx\Stop.bat"

"notepad.exe" "%SystemDrive%\www\scripts\nginx\Reload.bat"

@echo off

CD "%SystemDrive%\nginx-"*"\"

"nginx.exe" -s "reload"
"nginx.exe" -s "reopen"

:: End

"%SystemDrive%\www\scripts\nginx\Reload.bat"

"explorer.exe" "%AppData%\Microsoft\Windows\Start Menu\Programs\StartUp"

"%SystemDrive%\www\scripts\nginx\Start.bat"

nginx

• https://nginx.org/en/docs/windows.html
• https://gist.github.com/odan/b5f7de8dfbdbf76bef089776c868fea1
• https://certbot.eff.org/instructions?ws=other&os=pip
• https://community.letsencrypt.org/t/using-certbot-in-windows-the-pragmatic-way/173929
• https://www.php.net/manual/en/image.installation.php
• Qualys SSL Test