examples: docker-compose: Update nginx configs (#912)

* examples: docker-compose: insecure: postgres: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: insecure: mariadb-cron-redis: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: insecure: mariadb: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: with-nginx-proxy: mariadb: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: with-nginx-proxy: mariadb-cron-redis: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: with-nginx-proxy: postgres: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

* examples: docker-compose: with-nginx-proxy-self-signed-ssl: mariadb: Update nginx.conf

This commit applies the latest nginx configuration from the official
documentation. Therefore it also helps to fix CVE-2019-11043.

References:

- https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm
- https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html

Signed-off-by: Alexander Schroth <alexander.schroth@fau.de>

7 files changed, 315 insertions, 231 deletions

diff --git a/.examples/docker-compose/insecure/mariadb-cron-redis/fpm/web/nginx.conf b/.examples/docker-compose/insecure/mariadb-cron-redis/fpm/web/nginx.conf
index b5cffcb5..d44c059e 100644
--- a/.examples/docker-compose/insecure/mariadb-cron-redis/fpm/web/nginx.conf
+++ b/.examples/docker-compose/insecure/mariadb-cron-redis/fpm/web/nginx.conf
@@ -36,21 +36,25 @@ http {
         # Add headers to serve security related headers
         # Before enabling Strict-Transport-Security headers please read into this
         # topic first.
-        # add_header Strict-Transport-Security "max-age=15768000;
-        # includeSubDomains; preload;";
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
         #
         # WARNING: Only add the preload option once you read about
         # the consequences in https://hstspreload.org/. This option
         # will add the domain to a hardcoded list that is shipped
         # in all major browsers and getting removed from this list
         # could take several months.
-        add_header X-Content-Type-Options nosniff;
-        add_header X-XSS-Protection "1; mode=block";
-        add_header X-Robots-Tag none;
-        add_header X-Download-Options noopen;
-        add_header X-Permitted-Cross-Domain-Policies none;
-        add_header Referrer-Policy no-referrer;
-
+        add_header Referrer-Policy "no-referrer" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Download-Options "noopen" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
+        add_header X-Robots-Tag "none" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
+
+        # Path to the root of your installation
         root /var/www/html;
 
         location = /robots.txt {
@@ -62,14 +66,18 @@ http {
         # The following 2 rules are only needed for the user_webfinger app.
         # Uncomment it if you're planning to use this app.
         #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
-        # last;
+        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+
+        # The following rule is only needed for the Social app.
+        # Uncomment it if you're planning to use this app.
+        #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
 
         location = /.well-known/carddav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
+
         location = /.well-known/caldav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
 
         # set max upload size
@@ -89,68 +97,72 @@ http {
         #pagespeed off;
 
         location / {
-            rewrite ^ /index.php$request_uri;
+            rewrite ^ /index.php;
         }
 
-        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+        location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
             deny all;
         }
-        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+        location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
             deny all;
         }
 
-        location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
-            fastcgi_split_path_info ^(.+\.php)(/.*)$;
+        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
+            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+            set $path_info $fastcgi_path_info;
+            try_files $fastcgi_script_name =404;
             include fastcgi_params;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_INFO $path_info;
             # fastcgi_param HTTPS on;
-            #Avoid sending the security headers twice
+
+            # Avoid sending the security headers twice
             fastcgi_param modHeadersAvailable true;
+
+            # Enable pretty urls
             fastcgi_param front_controller_active true;
             fastcgi_pass php-handler;
             fastcgi_intercept_errors on;
             fastcgi_request_buffering off;
         }
 
-        location ~ ^/(?:updater|ocs-provider)(?:$|/) {
+        location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
             try_files $uri/ =404;
             index index.php;
         }
 
-        # Adding the cache control header for js and css files
+        # Adding the cache control header for js, css and map files
         # Make sure it is BELOW the PHP block
-        location ~ \.(?:css|js|woff2?|svg|gif)$ {
+        location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
             try_files $uri /index.php$request_uri;
             add_header Cache-Control "public, max-age=15778463";
             # Add headers to serve security related headers (It is intended to
             # have those duplicated to the ones above)
             # Before enabling Strict-Transport-Security headers please read into
             # this topic first.
-            # add_header Strict-Transport-Security "max-age=15768000;
-            #  includeSubDomains; preload;";
+            #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
             #
             # WARNING: Only add the preload option once you read about
             # the consequences in https://hstspreload.org/. This option
             # will add the domain to a hardcoded list that is shipped
             # in all major browsers and getting removed from this list
             # could take several months.
-            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
-            add_header X-Robots-Tag none;
-            add_header X-Download-Options noopen;
-            add_header X-Permitted-Cross-Domain-Policies none;
-            add_header Referrer-Policy no-referrer;
+            add_header Referrer-Policy "no-referrer" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-Download-Options "noopen" always;
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-Permitted-Cross-Domain-Policies "none" always;
+            add_header X-Robots-Tag "none" always;
+            add_header X-XSS-Protection "1; mode=block" always;
 
             # Optional: Don't log access to assets
             access_log off;
         }
 
-        location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
+        location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
             try_files $uri /index.php$request_uri;
             # Optional: Don't log access to other assets
             access_log off;
         }
     }
-
 }
diff --git a/.examples/docker-compose/insecure/mariadb/fpm/web/nginx.conf b/.examples/docker-compose/insecure/mariadb/fpm/web/nginx.conf
index b5cffcb5..d44c059e 100644
--- a/.examples/docker-compose/insecure/mariadb/fpm/web/nginx.conf
+++ b/.examples/docker-compose/insecure/mariadb/fpm/web/nginx.conf
@@ -36,21 +36,25 @@ http {
         # Add headers to serve security related headers
         # Before enabling Strict-Transport-Security headers please read into this
         # topic first.
-        # add_header Strict-Transport-Security "max-age=15768000;
-        # includeSubDomains; preload;";
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
         #
         # WARNING: Only add the preload option once you read about
         # the consequences in https://hstspreload.org/. This option
         # will add the domain to a hardcoded list that is shipped
         # in all major browsers and getting removed from this list
         # could take several months.
-        add_header X-Content-Type-Options nosniff;
-        add_header X-XSS-Protection "1; mode=block";
-        add_header X-Robots-Tag none;
-        add_header X-Download-Options noopen;
-        add_header X-Permitted-Cross-Domain-Policies none;
-        add_header Referrer-Policy no-referrer;
-
+        add_header Referrer-Policy "no-referrer" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Download-Options "noopen" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
+        add_header X-Robots-Tag "none" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
+
+        # Path to the root of your installation
         root /var/www/html;
 
         location = /robots.txt {
@@ -62,14 +66,18 @@ http {
         # The following 2 rules are only needed for the user_webfinger app.
         # Uncomment it if you're planning to use this app.
         #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
-        # last;
+        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+
+        # The following rule is only needed for the Social app.
+        # Uncomment it if you're planning to use this app.
+        #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
 
         location = /.well-known/carddav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
+
         location = /.well-known/caldav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
 
         # set max upload size
@@ -89,68 +97,72 @@ http {
         #pagespeed off;
 
         location / {
-            rewrite ^ /index.php$request_uri;
+            rewrite ^ /index.php;
         }
 
-        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+        location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
             deny all;
         }
-        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+        location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
             deny all;
         }
 
-        location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
-            fastcgi_split_path_info ^(.+\.php)(/.*)$;
+        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
+            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+            set $path_info $fastcgi_path_info;
+            try_files $fastcgi_script_name =404;
             include fastcgi_params;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_INFO $path_info;
             # fastcgi_param HTTPS on;
-            #Avoid sending the security headers twice
+
+            # Avoid sending the security headers twice
             fastcgi_param modHeadersAvailable true;
+
+            # Enable pretty urls
             fastcgi_param front_controller_active true;
             fastcgi_pass php-handler;
             fastcgi_intercept_errors on;
             fastcgi_request_buffering off;
         }
 
-        location ~ ^/(?:updater|ocs-provider)(?:$|/) {
+        location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
             try_files $uri/ =404;
             index index.php;
         }
 
-        # Adding the cache control header for js and css files
+        # Adding the cache control header for js, css and map files
         # Make sure it is BELOW the PHP block
-        location ~ \.(?:css|js|woff2?|svg|gif)$ {
+        location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
             try_files $uri /index.php$request_uri;
             add_header Cache-Control "public, max-age=15778463";
             # Add headers to serve security related headers (It is intended to
             # have those duplicated to the ones above)
             # Before enabling Strict-Transport-Security headers please read into
             # this topic first.
-            # add_header Strict-Transport-Security "max-age=15768000;
-            #  includeSubDomains; preload;";
+            #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
             #
             # WARNING: Only add the preload option once you read about
             # the consequences in https://hstspreload.org/. This option
             # will add the domain to a hardcoded list that is shipped
             # in all major browsers and getting removed from this list
             # could take several months.
-            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
-            add_header X-Robots-Tag none;
-            add_header X-Download-Options noopen;
-            add_header X-Permitted-Cross-Domain-Policies none;
-            add_header Referrer-Policy no-referrer;
+            add_header Referrer-Policy "no-referrer" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-Download-Options "noopen" always;
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-Permitted-Cross-Domain-Policies "none" always;
+            add_header X-Robots-Tag "none" always;
+            add_header X-XSS-Protection "1; mode=block" always;
 
             # Optional: Don't log access to assets
             access_log off;
         }
 
-        location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
+        location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
             try_files $uri /index.php$request_uri;
             # Optional: Don't log access to other assets
             access_log off;
         }
     }
-
 }
diff --git a/.examples/docker-compose/insecure/postgres/fpm/web/nginx.conf b/.examples/docker-compose/insecure/postgres/fpm/web/nginx.conf
index b5cffcb5..d44c059e 100644
--- a/.examples/docker-compose/insecure/postgres/fpm/web/nginx.conf
+++ b/.examples/docker-compose/insecure/postgres/fpm/web/nginx.conf
@@ -36,21 +36,25 @@ http {
         # Add headers to serve security related headers
         # Before enabling Strict-Transport-Security headers please read into this
         # topic first.
-        # add_header Strict-Transport-Security "max-age=15768000;
-        # includeSubDomains; preload;";
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
         #
         # WARNING: Only add the preload option once you read about
         # the consequences in https://hstspreload.org/. This option
         # will add the domain to a hardcoded list that is shipped
         # in all major browsers and getting removed from this list
         # could take several months.
-        add_header X-Content-Type-Options nosniff;
-        add_header X-XSS-Protection "1; mode=block";
-        add_header X-Robots-Tag none;
-        add_header X-Download-Options noopen;
-        add_header X-Permitted-Cross-Domain-Policies none;
-        add_header Referrer-Policy no-referrer;
-
+        add_header Referrer-Policy "no-referrer" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Download-Options "noopen" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
+        add_header X-Robots-Tag "none" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
+
+        # Path to the root of your installation
         root /var/www/html;
 
         location = /robots.txt {
@@ -62,14 +66,18 @@ http {
         # The following 2 rules are only needed for the user_webfinger app.
         # Uncomment it if you're planning to use this app.
         #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
-        # last;
+        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+
+        # The following rule is only needed for the Social app.
+        # Uncomment it if you're planning to use this app.
+        #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
 
         location = /.well-known/carddav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
+
         location = /.well-known/caldav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
 
         # set max upload size
@@ -89,68 +97,72 @@ http {
         #pagespeed off;
 
         location / {
-            rewrite ^ /index.php$request_uri;
+            rewrite ^ /index.php;
         }
 
-        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+        location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
             deny all;
         }
-        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+        location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
             deny all;
         }
 
-        location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
-            fastcgi_split_path_info ^(.+\.php)(/.*)$;
+        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
+            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+            set $path_info $fastcgi_path_info;
+            try_files $fastcgi_script_name =404;
             include fastcgi_params;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_INFO $path_info;
             # fastcgi_param HTTPS on;
-            #Avoid sending the security headers twice
+
+            # Avoid sending the security headers twice
             fastcgi_param modHeadersAvailable true;
+
+            # Enable pretty urls
             fastcgi_param front_controller_active true;
             fastcgi_pass php-handler;
             fastcgi_intercept_errors on;
             fastcgi_request_buffering off;
         }
 
-        location ~ ^/(?:updater|ocs-provider)(?:$|/) {
+        location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
             try_files $uri/ =404;
             index index.php;
         }
 
-        # Adding the cache control header for js and css files
+        # Adding the cache control header for js, css and map files
         # Make sure it is BELOW the PHP block
-        location ~ \.(?:css|js|woff2?|svg|gif)$ {
+        location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
             try_files $uri /index.php$request_uri;
             add_header Cache-Control "public, max-age=15778463";
             # Add headers to serve security related headers (It is intended to
             # have those duplicated to the ones above)
             # Before enabling Strict-Transport-Security headers please read into
             # this topic first.
-            # add_header Strict-Transport-Security "max-age=15768000;
-            #  includeSubDomains; preload;";
+            #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
             #
             # WARNING: Only add the preload option once you read about
             # the consequences in https://hstspreload.org/. This option
             # will add the domain to a hardcoded list that is shipped
             # in all major browsers and getting removed from this list
             # could take several months.
-            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
-            add_header X-Robots-Tag none;
-            add_header X-Download-Options noopen;
-            add_header X-Permitted-Cross-Domain-Policies none;
-            add_header Referrer-Policy no-referrer;
+            add_header Referrer-Policy "no-referrer" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-Download-Options "noopen" always;
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-Permitted-Cross-Domain-Policies "none" always;
+            add_header X-Robots-Tag "none" always;
+            add_header X-XSS-Protection "1; mode=block" always;
 
             # Optional: Don't log access to assets
             access_log off;
         }
 
-        location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
+        location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
             try_files $uri /index.php$request_uri;
             # Optional: Don't log access to other assets
             access_log off;
         }
     }
-
 }
diff --git a/.examples/docker-compose/with-nginx-proxy-self-signed-ssl/mariadb/fpm/web/nginx.conf b/.examples/docker-compose/with-nginx-proxy-self-signed-ssl/mariadb/fpm/web/nginx.conf
index 6cb34792..4d301636 100644
--- a/.examples/docker-compose/with-nginx-proxy-self-signed-ssl/mariadb/fpm/web/nginx.conf
+++ b/.examples/docker-compose/with-nginx-proxy-self-signed-ssl/mariadb/fpm/web/nginx.conf
@@ -41,21 +41,25 @@ http {
         # Add headers to serve security related headers
         # Before enabling Strict-Transport-Security headers please read into this
         # topic first.
-        # add_header Strict-Transport-Security "max-age=15768000;
-        # includeSubDomains; preload;";
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
         #
         # WARNING: Only add the preload option once you read about
         # the consequences in https://hstspreload.org/. This option
         # will add the domain to a hardcoded list that is shipped
         # in all major browsers and getting removed from this list
         # could take several months.
-        add_header X-Content-Type-Options nosniff;
-        add_header X-XSS-Protection "1; mode=block";
-        add_header X-Robots-Tag none;
-        add_header X-Download-Options noopen;
-        add_header X-Permitted-Cross-Domain-Policies none;
-        add_header Referrer-Policy no-referrer;
-
+        add_header Referrer-Policy "no-referrer" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Download-Options "noopen" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
+        add_header X-Robots-Tag "none" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
+
+        # Path to the root of your installation
         root /var/www/html;
 
         location = /robots.txt {
@@ -67,14 +71,18 @@ http {
         # The following 2 rules are only needed for the user_webfinger app.
         # Uncomment it if you're planning to use this app.
         #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
-        # last;
+        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+
+        # The following rule is only needed for the Social app.
+        # Uncomment it if you're planning to use this app.
+        #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
 
         location = /.well-known/carddav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
+
         location = /.well-known/caldav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
 
         # set max upload size
@@ -94,68 +102,72 @@ http {
         #pagespeed off;
 
         location / {
-            rewrite ^ /index.php$request_uri;
+            rewrite ^ /index.php;
         }
 
-        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+        location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
             deny all;
         }
-        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+        location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
             deny all;
         }
 
-        location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
-            fastcgi_split_path_info ^(.+\.php)(/.*)$;
+        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
+            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+            set $path_info $fastcgi_path_info;
+            try_files $fastcgi_script_name =404;
             include fastcgi_params;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_INFO $path_info;
             # fastcgi_param HTTPS on;
-            #Avoid sending the security headers twice
+
+            # Avoid sending the security headers twice
             fastcgi_param modHeadersAvailable true;
+
+            # Enable pretty urls
             fastcgi_param front_controller_active true;
             fastcgi_pass php-handler;
             fastcgi_intercept_errors on;
             fastcgi_request_buffering off;
         }
 
-        location ~ ^/(?:updater|ocs-provider)(?:$|/) {
+        location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
             try_files $uri/ =404;
             index index.php;
         }
 
-        # Adding the cache control header for js and css files
+        # Adding the cache control header for js, css and map files
         # Make sure it is BELOW the PHP block
-        location ~ \.(?:css|js|woff2?|svg|gif)$ {
+        location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
             try_files $uri /index.php$request_uri;
             add_header Cache-Control "public, max-age=15778463";
             # Add headers to serve security related headers (It is intended to
             # have those duplicated to the ones above)
             # Before enabling Strict-Transport-Security headers please read into
             # this topic first.
-            # add_header Strict-Transport-Security "max-age=15768000;
-            #  includeSubDomains; preload;";
+            #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
             #
             # WARNING: Only add the preload option once you read about
             # the consequences in https://hstspreload.org/. This option
             # will add the domain to a hardcoded list that is shipped
             # in all major browsers and getting removed from this list
             # could take several months.
-            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
-            add_header X-Robots-Tag none;
-            add_header X-Download-Options noopen;
-            add_header X-Permitted-Cross-Domain-Policies none;
-            add_header Referrer-Policy no-referrer;
+            add_header Referrer-Policy "no-referrer" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-Download-Options "noopen" always;
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-Permitted-Cross-Domain-Policies "none" always;
+            add_header X-Robots-Tag "none" always;
+            add_header X-XSS-Protection "1; mode=block" always;
 
             # Optional: Don't log access to assets
             access_log off;
         }
 
-        location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
+        location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
             try_files $uri /index.php$request_uri;
             # Optional: Don't log access to other assets
             access_log off;
         }
     }
-
 }
diff --git a/.examples/docker-compose/with-nginx-proxy/mariadb-cron-redis/fpm/web/nginx.conf b/.examples/docker-compose/with-nginx-proxy/mariadb-cron-redis/fpm/web/nginx.conf
index 6cb34792..4d301636 100644
--- a/.examples/docker-compose/with-nginx-proxy/mariadb-cron-redis/fpm/web/nginx.conf
+++ b/.examples/docker-compose/with-nginx-proxy/mariadb-cron-redis/fpm/web/nginx.conf
@@ -41,21 +41,25 @@ http {
         # Add headers to serve security related headers
         # Before enabling Strict-Transport-Security headers please read into this
         # topic first.
-        # add_header Strict-Transport-Security "max-age=15768000;
-        # includeSubDomains; preload;";
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
         #
         # WARNING: Only add the preload option once you read about
         # the consequences in https://hstspreload.org/. This option
         # will add the domain to a hardcoded list that is shipped
         # in all major browsers and getting removed from this list
         # could take several months.
-        add_header X-Content-Type-Options nosniff;
-        add_header X-XSS-Protection "1; mode=block";
-        add_header X-Robots-Tag none;
-        add_header X-Download-Options noopen;
-        add_header X-Permitted-Cross-Domain-Policies none;
-        add_header Referrer-Policy no-referrer;
-
+        add_header Referrer-Policy "no-referrer" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Download-Options "noopen" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
+        add_header X-Robots-Tag "none" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
+
+        # Path to the root of your installation
         root /var/www/html;
 
         location = /robots.txt {
@@ -67,14 +71,18 @@ http {
         # The following 2 rules are only needed for the user_webfinger app.
         # Uncomment it if you're planning to use this app.
         #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
-        # last;
+        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+
+        # The following rule is only needed for the Social app.
+        # Uncomment it if you're planning to use this app.
+        #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
 
         location = /.well-known/carddav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
+
         location = /.well-known/caldav {
-            return 301 $scheme://$host/remote.php/dav;
+            return 301 $scheme://$host:$server_port/remote.php/dav;
         }
 
         # set max upload size
@@ -94,68 +102,72 @@ http {
         #pagespeed off;
 
         location / {
-            rewrite ^ /index.php$request_uri;
+            rewrite ^ /index.php;
         }
 
-        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+        location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
             deny all;
         }
-        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+        location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
             deny all;
         }
 
-        location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
-            fastcgi_split_path_info ^(.+\.php)(/.*)$;
+        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
+            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+            set $path_info $fastcgi_path_info;
+            try_files $fastcgi_script_name =404;
             include fastcgi_params;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_INFO $path_info;
             # fastcgi_param HTTPS on;
-            #Avoid sending the security headers twice
+
+            # Avoid sending the security headers twice
             fastcgi_param modHeadersAvailable true;
+
+            # Enable pretty urls
             fastcgi_param front_controller_active true;
             fastcgi_pass php-handler;
             fastcgi_intercept_errors on;
             fastcgi_request_buffering off;
         }
 
-        location ~ ^/(?:updater|ocs-provider)(?:$|/) {
+        location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
             try_files $uri/ =404;
             index index.php;
         }
 
-        # Adding the cache control header for js and css files
+        # Adding the cache control header for js, css and map files
         # Make sure it is BELOW the PHP block
-        location ~ \.(?:css|js|woff2?|svg|gif)$ {
+        location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
             try_files $uri /index.php$request_uri;
             add_header Cache-Control "public, max-age=15778463";
             # Add headers to serve security related headers (It is intended to
             # have those duplicated to the ones above)
             # Before enabling Strict-Transport-Security headers please read into
             # this topic first.
-            # add_header Strict-Transport-Security "max-age=15768000;
-            #  includeSubDomains; preload;";
+            #add_header Strict