Nginx config file examples

gistfile1.nginxconf

fastcgi_param	QUERY_STRING		$query_string;
fastcgi_param	REQUEST_METHOD		$request_method;
fastcgi_param	CONTENT_TYPE		$content_type;
fastcgi_param	CONTENT_LENGTH		$content_length;

fastcgi_param	SCRIPT_FILENAME		$request_filename;
fastcgi_param	SCRIPT_NAME		$fastcgi_script_name;
fastcgi_param	REQUEST_URI		$request_uri;
fastcgi_param	DOCUMENT_URI		$document_uri;
fastcgi_param	DOCUMENT_ROOT		$document_root;
fastcgi_param	SERVER_PROTOCOL		$server_protocol;

fastcgi_param	GATEWAY_INTERFACE	CGI/1.1;
fastcgi_param	SERVER_SOFTWARE		nginx/$nginx_version;

fastcgi_param	REMOTE_ADDR		$remote_addr;
fastcgi_param	REMOTE_PORT		$remote_port;
fastcgi_param	SERVER_ADDR		$server_addr;
fastcgi_param	SERVER_PORT		$server_port;
fastcgi_param	SERVER_NAME		$server_name;

fastcgi_param	HTTPS			$https;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param	REDIRECT_STATUS		200;

gistfile2.nginxconf

# sites-available/blog.chrismeller.com
server {
	listen [::]:80;
	server_name blog.chrismeller.com;

	root /media/www/public_html/blog.chrismeller.com/public;

	access_log /media/www/public_html/blog.chrismeller.com/logs/access.log;
	error_log /media/www/public_html/blog.chrismeller.com/logs/error.log;

	include fastcgi_params;

	location / {

		# force ssl for login and admin pages
		rewrite ^/(admin|auth)(.*) https://$host$request_uri?;

		try_files $uri $uri/ /index.php$is_args$args;
	}

	location ~ \.php$ {
		fastcgi_pass php;
	}
}

gistfile3.nginxconf

# conf.d/php-fpm.conf
upstream php {
	server unix:/var/run/php5-fpm.socket;
}

# make sure index.php is first in all our vhosts
index index.php index.html index.htm;

gistfile4.nginxconf

# conf.d/ssl.conf

# enable ssl session resumption
ssl_session_cache shared:SSL:10m;

ssl_session_timeout 3m;

# FIPS 140-2 compliance, TLS1+ only - removes the default SSLv3
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

# this is a very concise definition of ciphers that don't allow anonymous DH or MD5 - the big weaknesses
#	per: https://calomel.org/nginx.html
#ssl_ciphers HIGH:!ADH!MD5:@STRENGTH;

# this is a very short list of very secure ciphers that may be incompatible with older browsers
#	per: https://calomel.org/nginx.html 
#ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:AES128-SHA;

# this excludes insecure ciphers and sorts the others by strength
# it is BEAST-resistant, prioritizing RC4
#	per: http://groups.drupal.org/node/179344
#ssl_ciphers !aNULL:!LOW:!MD5:!EXP:RC4:CAMELLIA:AES128:3DES:SEED:AES256@STRENGTH;

# this is a combination of everything above and openssl docs - very secure, FIPS-compliant, ordered by strength
ssl_ciphers !aNULL:!eNULL:FIPS@STRENGTH;

# don't let the client decide what ciphers to use
ssl_prefer_server_ciphers on;