Service adjustments

README.md

@@ -13,6 +13,10 @@
 
 ## Easy install
 
+## CAREFUL
+
+Raweb-nginx uses custom .service that limits system visibility for security reasons, basically you need to store your data on /hostdata, or /srv, if you use custom folders then you have to edit the service, for more details check : https://github.com/theraw/The-World-Is-Yours/blob/master/static/Trixie/nginx.service
+
 ### Debian 13 (trixie)
 ```bash
 sudo install -d /etc/apt/keyrings

static/Raccoon/nginx.service

@@ -31,12 +31,6 @@ BindReadOnlyPaths=/bin
 BindReadOnlyPaths=/sbin
 BindReadOnlyPaths=/etc
 
-# Read-only: vhost docroots + app projects. Add a new line here when you
-# add a vhost whose root isn't under one of these parents.
-BindReadOnlyPaths=/raweb
-BindReadOnlyPaths=/srv
-BindReadOnlyPaths=/hostdata
-
 # Read-write: nginx runtime state.
 #   /run               nginx.pid, nginx.lock, /run/nginx/temp/*, PHP-FPM sock
 #   /var/log/nginx     access.log, error.log
@@ -44,6 +38,10 @@ BindReadOnlyPaths=/hostdata
 BindPaths=/run
 BindPaths=/var/log/nginx
 BindPaths=/nginx
+BindPaths=/var/cache/nginx
+BindPaths=/srv
+BindPaths=/hostdata
+BindPaths=/raweb
 
 NoNewPrivileges=true
 ProtectKernelTunables=true

static/Trixie/nginx.service

@@ -31,12 +31,6 @@ BindReadOnlyPaths=/bin
 BindReadOnlyPaths=/sbin
 BindReadOnlyPaths=/etc
 
-# Read-only: vhost docroots + app projects. Add a new line here when you
-# add a vhost whose root isn't under one of these parents.
-BindReadOnlyPaths=/raweb
-BindReadOnlyPaths=/srv
-BindReadOnlyPaths=/hostdata
-
 # Read-write: nginx runtime state.
 #   /run               nginx.pid, nginx.lock, /run/nginx/temp/*, PHP-FPM sock
 #   /var/log/nginx     access.log, error.log
@@ -44,6 +38,10 @@ BindReadOnlyPaths=/hostdata
 BindPaths=/run
 BindPaths=/var/log/nginx
 BindPaths=/nginx
+BindPaths=/var/cache/nginx
+BindPaths=/srv
+BindPaths=/hostdata
+BindPaths=/raweb
 
 NoNewPrivileges=true
 ProtectKernelTunables=true

static/nginx/nginx.conf

@@ -21,7 +21,12 @@ http {
     # =================== END L7 =========================== #
 
     # ===================== LOGS =========================== #
-    log_format main 'DATE: $time_local FROM: $remote_addr  | STATUS: $status | TO: $request | CACHE: $upstream_cache_status | A: $http_user_agent';
+    map $upstream_cache_status $log_cache_status {
+        ""      "STATIC";
+        default $upstream_cache_status;
+    }
+    more_set_headers "X-Cache-Status: $log_cache_status";
+    log_format main 'DATE: $time_local FROM: $remote_addr  | STATUS: $status | TO: $request | CACHE: $log_cache_status | A: $http_user_agent';
     # =================== END LOGS ========================= #
 
     # ==================== GENERAL ========================= #