Nginx

Глобальный контекст

pid /run/nginx.pid;
user nginx;
worker_processes auto;

events {
	worker_connections 1024;
}

Контекст http

access_log off;
include mime.types;
default_type application/octet-stream;
charset utf-8;
autoindex_localtime on;

keepalive_timeout 500;
keepalive_requests 50;

gzip off;
gzip_min_length 10240;
gzip_comp_level 9;
gzip_types text/plain text/css text/javascript;

#error_page 403 /bg0.jpg;
#client_max_body_size 100M;
#proxy_cache_path /home/nginx/cache levels=1:2 keys_zone=all:32m max_size=1g;

Контекст server

По умолчанию

listen 80 default_server;
root /home/nginx/data/html;
index index.html;

location / {
	try_files $uri $uri/ /index.html;
}

Локальный web-сервер

listen 80;
server_name hostname.ru

location / {
	try_files $uri $uri/ =403;
}

location ~* \.(jpg|jpeg|png|gif|tiff)$ {
	try_files $uri =404;
	access_log off;
	add_header Pragma public;
	add_header Cache-Control public;
	add_header Vary Accept-Encoding;
	expires 1M; 1 месяц
#	expires 10m; 10 минут
}

Проксирование в web-ресурс

listen 80;
server_name hostname.ru

location / {
	proxy_pass http://192.168.1.12:80;
	proxy_set_header HOST $host;
	proxy_set_header X-Forwarded-Proto $scheme;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

Проксирование в PHP-FPM

listen 80;
server_name hostname.ru
root /home/nginx/core/domain.ru;

location / {
	try_files $uri $uri/ /index.php?$args;
}

location ~* \.php$ {
	include fastcgi_params;
	include fastcgi.conf;
	fastcgi_pass unix:/opt/socket/php/php74;
	fastcgi_index index.php;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

SSL

При первом выпуске сертификата следует открыть ресурс только на 80 порту.

80

listen 80;
server_name hostname.ru;

#убрат комментирование после получения сертификата
#	location / {
#		return 301 https://hostname.ru$request_uri;
#	}

	location ~* /.well-known/ {
		try_files $uri $uri/ =403;
		root /home/nginx/data/certbot;
	}

443

listen 443 ssl http2;
server_name hostname.ru
ssl_certificate /etc/letsencrypt/live/hostname.ru/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/hostname.ru/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/hostname.ru/chain.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
ssl_prefer_server_ciphers on;

	location ~* /.well-known/ {
		root /home/nginx/data/certbot;
		try_files $uri $uri/ =403;
	}