Wie sichert ihr eure ganze Server?

user www-data;
pid /run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    multi_accept on;
    worker_connections 65535;
}

http {
    charset utf-8;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    server_tokens off;
    log_not_found off;
    types_hash_max_size 2048;
    client_max_body_size 16M;

    # MIME
    include mime.types;
    default_type application/octet-stream;

    # logging
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log warn;

    # SSL
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    # Diffie-Hellman parameter for DHE ciphersuites
    ssl_dhparam /etc/nginx/dhparam.pem;

    # Mozilla Intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    # OCSP Stapling
    #ssl_stapling on;
    #ssl_stapling_verify on;
    #resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    #resolver_timeout 2s;

    # load configs
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name testing.local;
    set $base /var/www/testing.local;
    root $base/public;

    # SSL
    ssl_certificate /etc/nginx/ssl/testing.local.crt;
    ssl_certificate_key /etc/nginx/ssl/testing.local.key;

    # security
    include custom-configs/security.conf;

    # logging
    access_log /var/log/nginx/testing.local.access.log;
    error_log /var/log/nginx/testing.local.error.log warn;

    # index
    index index.php index.html;

    # fallback
    location / {
        try_files $uri $uri/ =404;

        # maintenance check
        if (-f /usr/share/nginx/html/error_pages/maintenance_on.html) {
                 return 503;
                }
    }

    # handle .php
    location ~ \.php$ {
        include custom-configs/php_fastcgi-testing.local.conf;

        # maintenance check
                if (-f /usr/share/nginx/html/error_pages/maintenance_on.html) {
                 return 503;
                }
    }

    # disable .htaccess and other hidden files
    location ~ /\.(?!well-known).* {
                deny all;
                access_log off;
                log_not_found off;
        }

    # error-pages
    error_page 404 /custom_404.html;
        location = /custom_404.html {
                root /usr/share/nginx/html/error_pages;
                internal;
        }

    error_page 401 /custom_401.html;
        location = /custom_401.html {
                root /usr/share/nginx/html/error_pages;
                internal;
        }

    error_page 500 502 504 /custom_50x.html;
        location = /custom_50x.html {
                root /usr/share/nginx/html/error_pages;
                internal;
        }

    error_page 503 /maintenance_on.html;
        location = /maintenance_on.html {
                root /usr/share/nginx/html/error_pages;
                internal;
        }

    # additional config
    include custom-configs/general.conf;
}

# subdomains redirect
#server {
#    listen 443 ssl http2;
#    listen [::]:443 ssl http2;

#    server_name *.testing.local;

    # SSL
#    ssl_certificate /etc/nginx/ssl/testing.local.crt;
#    ssl_certificate_key /etc/nginx/ssl/testing.local.key;

#    return 301 https://testing.local$request_uri;
#}

# HTTP redirect
server {
    listen 80;
    listen [::]:80;

    server_name .testing.local;

    return 301 https://testing.local$request_uri;
}

# security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

# 404
try_files $fastcgi_script_name =404;

# default fastcgi_params
include fastcgi_params;

# fastcgi settings
fastcgi_pass            unix:/var/run/php/php7.4-fpm-testing.sock;
fastcgi_index            index.php;
fastcgi_buffers            8 16k;
fastcgi_buffer_size        32k;

# fastcgi params
fastcgi_param DOCUMENT_ROOT        $realpath_root;
fastcgi_param SCRIPT_FILENAME    $realpath_root$fastcgi_script_name;
fastcgi_param PHP_ADMIN_VALUE    "open_basedir=$base/:/usr/lib/php/:/tmp/";

# favicon.ico
location = /favicon.ico {
    log_not_found off;
    access_log off;
}

# robots.txt
location = /robots.txt {
    log_not_found off;
    access_log off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires 7d;
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires 7d;
    access_log off;
}

# gzip
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

  # fallback
        location / {
                try_files $uri $uri/ @rewrite;

                # maintenance check
                if (-f /usr/share/nginx/html/error_pages/maintenance_on.html) {
                 return 503;
                }
        }

        location @rewrite {
          rewrite ^/(forum/|cms/|wcf/|calendar/|filebase/|blog/|gallery/)?([^.]+)$ /$1index.php?$2 last;
        }