Repository: digitalocean/nginxconfig.io
File: src/nginxconfig/generators/conf/website.conf.js (JavaScript)

Code before:
    if (!commonHsts(domains) && domain.https.hsts.computed) {
        serverConfig.push(['# HSTS', '']);
        serverConfig.push(['add_header Strict-Transport-Security',
            `'"max-age=31536000${domain.https.hstsSubdomains.computed ? '; includeSubDomains' : ''}${domain.https.hstsPreload.computed ? '; preload' : ''}" always'`]);
    }

    // Security
    if (global.tools.modularizedStructure.computed) {
        // Modularized
        serverConfig.push(['# security', '']);
        serverConfig.push(['include', 'nginxconfig.io/security.conf']);
    } else {
        // Unified
        serverConfig.push(...securityConf(domains, global));
    }

    // Restrict Methods
    if (Object.keys(domain.restrict).find(k => domain.restrict[k].computed)) {
        const allowedKeys = Object.keys(domain.restrict)
                                .filter(k => !domain.restrict[k].computed)
                                .map(e => e.replace('Method', '').toUpperCase());

        serverConfig.push(['# restrict Methods', '']);
        serverConfig.push(['location /', {
            limit_except: `${allowedKeys.join(' ')} { deny all; }`,
        }]);
    }

    // Access log or error log for domain
    if (domain.logging.accessLog.computed || domain.logging.errorLog.computed) {
        serverConfig.push(['# logging', '']);

        if (domain.logging.accessLog.computed)
            serverConfig.push(['access_log', getAccessLogDomainPath(domain, global)]);

        if (domain.logging.errorLog.computed)
            serverConfig.push(['error_log', getErrorLogDomainPath(domain, global)]);
    }

    // index.php
    if (domain.routing.index.computed === 'index.php') {
        serverConfig.push(['# index.php', '']);
        serverConfig.push(['index', 'index.php']);
    }

    // Fallback index.html or index.php
    if ((domain.routing.fallbackHtml.computed || domain.routing.fallbackPhp.computed)
        && (!domain.reverseProxy.reverseProxy.computed || domain.reverseProxy.path.computed !== '/')) {
        serverConfig.push([`# index.${domain.routing.fallbackHtml.computed ? 'html' : (domain.routing.fallbackPhp.computed ? 'php' : '')} fallback`, '']);
        serverConfig.push(['location /', {
            try_files: `$uri $uri/ /index.${domain.routing.fallbackHtml.computed ? 'html' : (domain.routing.fallbackPhp.computed ? 'php?$query_string' : '')}`,

Review comment (suggestion):
I don't think this should be in a location block? I think it can just be left bare directly in the server block so that it applies to everything? Having it in its own location block will break other location blocks iirc, as nginx only runs the first matching location block?
```suggestion
        serverConfig.push(['limit_except', `${allowedKeys.join(' ')} { deny all; }`]);
```

Code after:
    if (!commonHsts(domains) && domain.https.hsts.computed) {
        serverConfig.push(['# HSTS', '']);
        serverConfig.push(['add_header Strict-Transport-Security',
            `'"max-age=31536000${domain.https.hstsSubdomains.computed ? '; includeSubDomains' : ''}${domain.https.hstsPreload.computed ? '; preload' : ''}" always'`]);
    }

    // Security
    if (global.tools.modularizedStructure.computed) {
        // Modularized
        serverConfig.push(['# security', '']);
        serverConfig.push(['include', 'nginxconfig.io/security.conf']);
    } else {
        // Unified
        serverConfig.push(...securityConf(domains, global));
    }

    // Restrict Methods
    if (Object.keys(domain.restrict).find(k => domain.restrict[k].computed && k !== 'responseCode')) {
        const allowedKeys = Object.keys(domain.restrict)
                                .filter(k => !domain.restrict[k].computed && k !== 'responseCode')
                                .map(e => e.replace('Method', '').toUpperCase());

        serverConfig.push(['# restrict methods', '']);
        serverConfig.push([`if ($request_method !~ ^(${allowedKeys.join('|')})$)`, {
            'return': `'${domain.restrict.responseCode.computed}'`,
        }]);
    }

    // Access log or error log for domain
    if (domain.logging.accessLog.computed || domain.logging.errorLog.computed) {
        serverConfig.push(['# logging', '']);

        if (domain.logging.accessLog.computed)
            serverConfig.push(['access_log', getAccessLogDomainPath(domain, global)]);

        if (domain.logging.errorLog.computed)
            serverConfig.push(['error_log', getErrorLogDomainPath(domain, global)]);
    }

    // index.php
    if (domain.routing.index.computed === 'index.php') {
        serverConfig.push(['# index.php', '']);
        serverConfig.push(['index', 'index.php']);
    }

    // Fallback index.html or index.php
    if ((domain.routing.fallbackHtml.computed || domain.routing.fallbackPhp.computed)
        && (!domain.reverseProxy.reverseProxy.computed || domain.reverseProxy.path.computed !== '/')) {
        serverConfig.push([`# index.${domain.routing.fallbackHtml.computed ? 'html' : (domain.routing.fallbackPhp.computed ? 'php' : '')} fallback`, '']);
        serverConfig.push(['location /', {
            try_files: `$uri $uri/ /index.${domain.routing.fallbackHtml.computed ? 'html' : (domain.routing.fallbackPhp.computed ? 'php?$query_string' : '')}`,