Nginx for Magento 2.1.3

etc-nginx-sites-enabled-default

server {
	listen 80 default_server;
	listen [::]:80 default_server;

        set $MAGE_ROOT /var/www/html;

	index index.html index.htm index.nginx-debian.html;

	server_name _;

	root $MAGE_ROOT/pub;
	
	index index.php;
	autoindex off;
	charset UTF-8;
	error_page 404 403 = /errors/404.php;
	
	location ~* ^/setup($|/) {
	    root $MAGE_ROOT;
	    location ~ ^/setup/index.php {
	        fastcgi_pass   fastcgi_backend;
	        fastcgi_index  index.php;
	        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
		fastcgi_read_timeout 600s;
                fastcgi_connect_timeout 600s;
	        include        fastcgi_params;
	    }
	
	    location ~ ^/setup/(?!pub/). {
	        deny all;
	    }
	
	    location ~ ^/setup/pub/ {
	        add_header X-Frame-Options "SAMEORIGIN";
	    }
	}
	
	location ~* ^/update($|/) {
	    root $MAGE_ROOT;
	
	    location ~ ^/update/index.php {
	        fastcgi_split_path_info ^(/update/index.php)(/.+)$;
	        fastcgi_pass   fastcgi_backend;
	        fastcgi_index  index.php;
	        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
	        fastcgi_param  PATH_INFO        $fastcgi_path_info;
	        include        fastcgi_params;
	    }
	
	    # Deny everything but index.php
	    location ~ ^/update/(?!pub/). {
	        deny all;
	    }
	
	    location ~ ^/update/pub/ {
	        add_header X-Frame-Options "SAMEORIGIN";
	    }
	}
	
	location / {
	    try_files $uri $uri/ /index.php?$args;
	}
	
	location /pub/ {
	    location ~ ^/pub/media/(downloadable|customer|import|theme_customization/.*\.xml) {
	        deny all;
	    }
	    alias $MAGE_ROOT/pub/;
	    add_header X-Frame-Options "SAMEORIGIN";
	}
	
	location /static/ {
	    location ~ ^/static/version {
	        rewrite ^/static/(version\d*/)?(.*)$ /static/$2 last;
	    }
	
	    location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
	        add_header Cache-Control "public";
	        add_header X-Frame-Options "SAMEORIGIN";
	        expires +1y;
	
	        if (!-f $request_filename) {
	            rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
	        }
	    }
	    location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
	        add_header Cache-Control "no-store";
	        add_header X-Frame-Options "SAMEORIGIN";
	        expires    off;
	
	        if (!-f $request_filename) {
	           rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
	        }
	    }
	    if (!-f $request_filename) {
	        rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
	    }
	    add_header X-Frame-Options "SAMEORIGIN";
	}
	
	location /media/ {
	    try_files $uri $uri/ /get.php?$args;
	
	    location ~ ^/media/theme_customization/.*\.xml {
	        deny all;
	    }
	
	    location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
	        add_header Cache-Control "public";
	        add_header X-Frame-Options "SAMEORIGIN";
	        expires +1y;
	        try_files $uri $uri/ /get.php?$args;
	    }
	    location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
	        add_header Cache-Control "no-store";
	        add_header X-Frame-Options "SAMEORIGIN";
	        expires    off;
	        try_files $uri $uri/ /get.php?$args;
	    }
	    add_header X-Frame-Options "SAMEORIGIN";
	}
	
	location /media/customer/ {
	    deny all;
	}
	
	location /media/downloadable/ {
	    deny all;
	}
	
	location /media/import/ {
	    deny all;
	}
	
	location ~ (index|get|static|report|404|503)\.php$ {
	    try_files $uri =404;
	    fastcgi_pass   fastcgi_backend;
	    fastcgi_buffers 1024 4k;
	
	    fastcgi_read_timeout 600s;
	    fastcgi_connect_timeout 600s;
	
	    fastcgi_index  index.php;
	    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
	    include        fastcgi_params;
	}
	
	gzip on;
	gzip_disable "msie6";
	
	gzip_comp_level 6;
	gzip_min_length 1100;
	gzip_buffers 16 8k;
	gzip_proxied any;
	gzip_types
	    text/plain
	    text/css
	    text/js
	    text/xml
	    text/javascript
	    application/javascript
	    application/x-javascript
	    application/json
	    application/xml
	    application/xml+rss
	    image/svg+xml;
	gzip_vary on;
	
	location ~* (\.php$|\.htaccess$|\.git) {
	    deny all;
	}
}