Scripts para SaaS

Nginx para Perfex CRM - AaPanel

# Headers de Segurança
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com https://www.gstatic.com https://www.recaptcha.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: https://www.google.com https://www.gstatic.com; frame-src 'self' https://www.google.com https://recaptcha.google.com; connect-src 'self' https: https://www.google.com; frame-ancestors 'self'; form-action 'self';" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;

# Remover headers sensíveis
server_tokens off;
proxy_hide_header X-Powered-By;

# Main Location Block
location / {
    if (!-e $request_filename) {
        rewrite  ^(.*)$  /index.php/$1  last;
        break;
    }
}

# Cache para arquivos estáticos
location ~* \.(jpg|jpeg|png|gif|ico|css|js|pdf|txt|woff|woff2|ttf|eot|svg)$ {
    expires max;
    access_log off;
    add_header Cache-Control "public, no-transform";
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
}

# PHP Handler
location ~ [^/]\.php(/|$) {
    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
    fastcgi_pass unix:/tmp/php-cgi-74.sock;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_index index.php;
    try_files $fastcgi_script_name =404;
    fastcgi_read_timeout 300;
}

# Proteção de diretórios sensíveis
location ~ ^/(application|system|tests)/ {
    deny all;
    return 403;
}

location /backups {
    deny all;
    return 404;
}

# Proteção de arquivos sensíveis
location ~ /\.(ht|git|svn|env|config|composer.json|composer.lock|package.json) {
    deny all;
    access_log off;
    log_not_found off;
}

# Proteção contra execução de PHP em uploads
location ^~ /uploads/ {
    location ~ \.php$ {
        deny all;
    }
}

# Rota de autenticação
location /admin/authentication {
    try_files $uri $uri/ /index.php?$args;
}

ChatWoot para Perfex:

 <?php echo get_chatwoot_script(); ?>

<?php

if (!function_exists('get_chatwoot_script')) {
    function get_chatwoot_script()
    {
        $CI = &get_instance();

        // Obter dados do usuário atual
        $staff_id = get_staff_user_id();
        $staff = $CI->staff_model->get($staff_id);

        // Preparar dados
        $staff_id = $staff->staffid;
        $email = $staff->email;
        $name = $staff->firstname . ' ' . $staff->lastname;
        $phone = $staff->phonenumber ?? '';
        $avatar = staff_profile_image_url($staff->staffid);
        $company = get_option('companyname');

        // Montar o script
        $script = '<script>';
        $script .= 'window.chatwootSettings = {
            "position": "right",
            "type": "standard",
            "launcherTitle": "Fale com suporte",
            "locale": "pt_BR"
        };';

        $script .= '(function(d,t) {
            var BASE_URL = "https://chat.mns.marketing";
            var g = d.createElement(t),s = d.getElementsByTagName(t)[0];
            g.src = BASE_URL + "/packs/js/sdk.js";
            g.defer = true;
            g.async = true;
            s.parentNode.insertBefore(g,s);
            g.onload = function() {
                window.chatwootSDK.run({
                    websiteToken: "vNFsubaJmXUcnJqGL8M6hrRw",
                    baseUrl: BASE_URL
                });
                
                window.addEventListener("chatwoot:ready", function() {
                    window.$chatwoot.setUser("' . $staff_id . '", {
                        email: "' . $email . '",
                        name: "' . $name . '",
                        phone_number: "' . $phone . '",
                        avatar_url: "' . $avatar . '",
                        company_name: "' . $company . '"
                    });
                });
            }
        })(document,"script");';
        $script .= '</script>';

        return $script;
    }
}