如何在nginx / django / python中拒绝对root的访问但允许子目录访问？

Question

My current nginx config looks like this:

server {
    listen       443 ssl http2 default_server;
    listen       [::]:443 ssl http2 default_server;
    server_name  _;
    root         /usr/share/nginx/html;

    ssl_certificate "PEM";
    ssl_certificate_key "PEM";
    # It is *strongly* recommended to generate unique DH parameters
    # Generate them with: openssl dhparam -out /etc/pki/nginx/dhparams.pem 2048
    #ssl_dhparam "/etc/pki/nginx/dhparams.pem";
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP;
    ssl_prefer_server_ciphers on;

    # Load configuration files for the default server block.
    include /etc/nginx/default.d/*.conf;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass http://127.0.0.1:80;
    }

    error_page 404 /404.html;
        location = /40x.html {
    }

    error_page 500 502 503 504 /50x.html;
        location = /50x.html {
    }
}

# configuration of the server
server {
    # the port your site will be served on
    listen      80;
    # the domain name it will serve for
    server_name SERVER;
    charset     utf-8;

    # max upload size
    client_max_body_size 75M;   # adjust to taste

    # Finally, send all non-media requests to the Django server.
    location / {
        uwsgi_pass  django;
        include     /etc/nginx/uwsgi_params; 
        rewrite ^(/[^/]+)/frontend/$ $1/ last;
    }
}
]

I want to disallow access to root and allow access to subdirectory /dir1/. However, doing something like this doesn't work, because I get a duplicate location "/" issue (because of the way my https is set up). Any suggestions?

location ^~ /dir1/ {
    allow all;
}

location ^~ / { 
    deny all; 
}

Answer 1

You can try to define location with exact match (such locations takes priority over any other locations):

location = / {
    deny all;
}

Note that this will not protect requests to any files at your root directory. To protect these files too, you can do something like

location ~^/[^/]+$ {
    deny all;
}

but this can interfere with your django routes.

In that case you can rewrite any root-level request your_domain/path to your_domain/path/ with this rewrite rule:

rewrite ^(/[^/]+)$ $1/ last;