nginx config

common.conf

# favicon.ico
location = /favicon.ico {
        log_not_found off;
        access_log off;
}

# robots.txt
location = /robots.txt {
        log_not_found off;
        access_log off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
        expires 7d;
        access_log off;
}

nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        charset utf-8;
        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:10m;
        ssl_session_tickets off;

        # intermediate configuration
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers off;

        ssl_dhparam /etc/nginx/dhparam.pem;

        # OCSP Stapling
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 1.1.1.1 1.0.0.1 208.67.222.222 208.67.220.220 valid=60s;
        resolver_timeout 2s;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        gzip_vary on;
        gzip_proxied any;
        gzip_comp_level 6;
        gzip_buffers 16 8k;
        gzip_http_version 1.1;
        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
        gzip_min_length 1024;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}

php-fpm.conf

location ~ [^/]\.php(/|$) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        if (!-f $document_root$fastcgi_script_name) {
              return 404;
        }

        # Mitigate https://httpoxy.org/ vulnerabilities
        fastcgi_param HTTP_PROXY "";

        fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
        fastcgi_index index.php;

        # include the fastcgi_param setting
        include fastcgi_params;

        fastcgi_param   SCRIPT_FILENAME         $document_root$fastcgi_script_name;
}

security.conf

# security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
#add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
add_header Strict-Transport-Security "max-age=31536000" always;

# . files
location ~ /\.(?!well-known) {
        deny all;
}

www.example.com.conf

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        server_name www.example.com;
        root /var/www/www.example.com/public;

        ssl_certificate /etc/ssl/certs/www.example.com.pem;
        ssl_certificate_key /etc/ssl/private/www.fexample.com.key;

        include snippets/security.conf;

        access_log /var/log/nginx/example.com.access.log;
        error_log /var/log/nginx/example.com.error.log warn;

        include snippets/common.conf;
        include snippets/php-fpm.conf;

        index index.html index.htm index.php;

        location / {
                try_files $uri $uri/ /index.php?$query_string;
        }

        error_page 404 /index.php;
}

# non-www, subdomains redirect
server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        server_name example.com;

        # SSL
        ssl_certificate /etc/ssl/certs/www.example.com.pem;
        ssl_certificate_key /etc/ssl/private/www.example.com.key;

        return 301 https://www.example.com$request_uri;
}

# HTTP redirect
server {
        listen 80;
        listen [::]:80;

        server_name www.example.com example.com;

        return 301 https://www.example.com$request_uri;
}