Assistance technique

Bonjour à tous,

Depuis le temps, j'ai trouvé la solution.

En fait dans le fichier /etc/nginx/site-available/domain.conf voici la configuration si ça peut aider :

server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name formation.domain.fr;
#        server_name _;
 location / {
        return 301 https://$host$request_uri;
    }
}
server {
        #listen 443 ssl http2 default_server;
        #listen [::]:443 ssl http2 default_server;

       listen 443 ssl http2 default_server;
       listen [::]:443 ssl http2 default_server;


        ssl_certificate /etc/nginx/certificate/fullchain2.pem;
        ssl_certificate_key /etc/nginx/certificate/privkey2.pem;
        ssl_session_timeout 1d;
        ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
        ssl_session_tickets off;

   listen 443 ssl http2 default_server;
       listen [::]:443 ssl http2 default_server;


        ssl_certificate /etc/nginx/certificate/fullchain2.pem;
        ssl_certificate_key /etc/nginx/certificate/privkey2.pem;
        ssl_session_timeout 1d;
        ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
        ssl_session_tickets off;

# # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
        ssl_dhparam /etc/nginx/dhparam;

# # intermediate configuration
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-EC$
        ssl_prefer_server_ciphers off;

# # HSTS (ngx_http_headers_module is required) (63072000 seconds)
        # a merttre si ssl # add_header Strict-Transport-Security "max-age=63072000" a$

# # Diffie-Hellman

        ssl_dhparam /etc/nginx/dhparam;

# # intermediate configuration
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-EC$
        ssl_prefer_server_ciphers off;

# # HSTS (ngx_http_headers_module is required) (63072000 seconds)
        # a merttre si ssl # add_header Strict-Transport-Security "max-age=63072000" a$

# # Diffie-Hellman
        ssl_ecdh_curve secp384r1;


# # OCSP stapling
        #ssl_stapling on;
        #ssl_stapling_verify on;

# # verify chain of trust of OCSP response using Root CA and Intermediate certs
        #ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

# # OCSP stapling
        #ssl_stapling on;
        #ssl_stapling_verify on;

# # verify chain of trust of OCSP response using Root CA and Intermediate certs
        #ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

        root /var/www/moodle;

        #index index.html index.htm index.php;
        index index.php index.html index.htm index.nginx-debian.html;
        server_name formation.domaine.fr;
#        server_name _;

# # Privacy and security: opt out Google's FLoC Network
        add_header Permissions-Policy interest-cohort=();

# #     CSP (Content-Security-Policy) Contenu mixte
                add_header Content-Security-Policy "upgrade-insecure-requests; ";

        root /var/www/moodle;

# # OCSP stapling
        #ssl_stapling on;
        #ssl_stapling_verify on;

# # verify chain of trust of OCSP response using Root CA and Intermediate certs
        #ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

        root /var/www/moodle;
        index index.php index.html index.htm index.nginx-debian.html;
        server_name formation.domain.fr;

# # Privacy and security: opt out Google's FLoC Network
        add_header Permissions-Policy interest-cohort=();

# #     CSP (Content-Security-Policy) Contenu mixte
                add_header Content-Security-Policy "upgrade-insecure-requests; ";
        index index.php index.html index.htm index.nginx-debian.html;
        server_name formation.univ-bfc.fr;
#        server_name _;

# # Privacy and security: opt out Google's FLoC Network
        add_header Permissions-Policy interest-cohort=();

# #     CSP (Content-Security-Policy) Contenu mixte
                add_header Content-Security-Policy "upgrade-insecure-requests; ";

       location / {
               try_files $uri $uri/ =404;
       }

# # pass PHP scripts to FastCGI server
        ###location ~ \.php$ {
        ###include snippets/fastcgi-php.conf;
        #

location ~ [^/]\.php(/|$) {
    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
    if (!-f $document_root$fastcgi_script_name) {
        return 404;
     }

# # pass PHP scripts to FastCGI server
        ###location ~ \.php$ {
        ###include snippets/fastcgi-php.conf;
        #

location ~ [^/]\.php(/|$) {
    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
    if (!-f $document_root$fastcgi_script_name) {
        return 404;
    }

include snippets/fastcgi-php.conf;

 # Mitigate https://httpoxy.org/ vulnerabilities
    fastcgi_param HTTP_PROXY "";



# # With php-fpm (or other unix sockets):
        fastcgi_pass unix:/run/php/php7.4-fpm.sock;
        fastcgi_index index.php;
include snippets/fastcgi-php.conf;

 # Mitigate https://httpoxy.org/ vulnerabilities
    fastcgi_param HTTP_PROXY "";



# # With php-fpm (or other unix sockets):
        fastcgi_pass unix:/run/php/php7.4-fpm.sock;
        fastcgi_index index.php;
        ###fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_read_timeout 300;

# # include the fastcgi_param setting
    include fastcgi_params;

# # With php-cgi (or other tcp sockets):
        #fastcgi_pass 127.0.0.1:9000;
        fastcgi_cache nginxcache;
        fastcgi_cache_key $host$request_uri;
        fastcgi_cache_valid any 1h;
        fastcgi_cache_use_stale off;
        fastcgi_read_timeout 300;

# # include the fastcgi_param setting
    include fastcgi_params;

# # With php-cgi (or other tcp sockets):
        #fastcgi_pass 127.0.0.1:9000;
        fastcgi_cache nginxcache;
        fastcgi_cache_key $host$request_uri;
        fastcgi_cache_valid any 1h;
        fastcgi_cache_use_stale off;
        }
        error_page 404 /error/index.php; error_page 403 =404 /error/index.php;
# # Hide all dot files but allow "Well-Known URIs" as per RFC 5785
        location ~ /\.(?!well-known).*
        {
        return 404;
        }

# # This should be after the php fpm rule and very close to the last nginx ruleset.
        location ~ (/vendor/|/node_modules/|composer\.json|/readme|/README|readme\.txt$
        {
        deny all;

        error_page 404 /error/index.php; error_page 403 =404 /error/index.php;
# # Hide all dot files but allow "Well-Known URIs" as per RFC 5785
        location ~ /\.(?!well-known).*
        {
        return 404;
        }

# # This should be after the php fpm rule and very close to the last nginx ruleset.
        location ~ (/vendor/|/node_modules/|composer\.json|/readme|/README|readme\.txt$
        {
        deny all;
        return 404;
        }
}

Merci

Bien cordialement

Alain