nginx.conf

server
{
    listen 80; # default_server
    server_name {SERVER_NAME};
    
    # SSL.
    # Uncomment to enable
    # listen 443 ssl;
    # ssl_certificate /path/to/ssl.crt;
    # ssl_certificate_key /path/to/ssl.key;
    # ssl_session_cache shared:{NAMESPACE}:10m;
    # ssl_session_timeout 20m;
    # ssl_ciphers RC4:HIGH:!aNULL:!MD5:!kEDH;
    # ssl_protocols SSLv3 TLSv1;
    # ssl_prefer_server_ciphers on;

    # Domain seo. 
    # Uncomment to set redirect from secondary domains to main
    # if ($host != 'example.com') {
    #     rewrite ^/(.*)$ http://example.com/$1 permanent;
    # }
    
    # don't send the nginx version number in error pages and Server header
    server_tokens off;
    
    error_log /var/log/nginx/{SERVER_NAME}.com.ua.error.log info;
    access_log /var/log/nginx/{SERVER_NAME}.com.ua.access.log;

    root /var/www/{SERVER_NAME}/public;

    location @bootstrap
    {
        rewrite .* /bootstrap.php;
    }

    location /
    {
        try_files $uri @bootstrap;
    }

    location ~ \.php$
    {
        try_files $uri @bootstrap;
        
        fastcgi_pass 127.0.0.1:9000; #unix:/var/run/php5-fpm.sock;

        include /etc/nginx/fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param APPLICATION_ENV development;

        fastcgi_buffer_size 32k;
        fastcgi_buffers 256 16k;
    }
}

Security:
https://gist.github.com/plentz/6737338

True config: https://habrahabr.ru/company/oleg-bunin/blog/313666/