upstream php {
   server unix:/var/run/php5-fpm.sock;
}

server {
        listen 443;
        ssl on;
        server_name .wp.sanbi.ac.za *.wp.sanbi.ac.za blog.sanbi.ac.za *.blog.sanbi.ac.za;

        ssl_certificate /etc/ssl/certs/sanbi.pem;
        ssl_certificate_key /etc/ssl/private/sanbi.key;

        root /usr/lib/wordpress;
        index index.php index.html index.htm;

        location /sanbi-login.html {
            auth_pam  "SANBI authentication";
            auth_pam_service_name "nginx";
        }
        # Process only the requests to wp-login and wp-admin
        location ~ /wp-(admin|login|includes|content) {

          try_files $uri $uri/ \1/index.php?args;

          location ~ \.php$ {
             try_files $uri =404;
             include fastcgi_params;
             fastcgi_param REMOTE_USER $remote_user;
             fastcgi_index index.php;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
             fastcgi_pass  php;
             fastcgi_intercept_errors on;
          }
        }
        # Redirect everything else to port 80
        location / {
          return 301 http://$host$request_uri;
        }
        access_log /var/log/nginx/ssl-access.log;
        error_log /var/log/nginx/ssl-error.log;
}

server {
    #listen   80; ## listen for ipv4; this line is default and implied
    #listen   [::]:80 default ipv6only=on; ## listen for ipv6

        server_name wp.sanbi.ac.za *.wp.sanbi.ac.za blog.sanbi.ac.za *.blog.sanbi.ac.za;
    root /usr/lib/wordpress;

        index index.php;

        location ~ /wp-(?:admin|login) {
                return 301 https://$host$request_uri;
        }

        location = /favicon.ico {
                log_not_found off;
                access_log off;
        }

        location = /robots.txt {
                allow all;
                log_not_found off;
                access_log off;
        }

        location / {
                # This is cool because no php is touched for static content.
                # include the "?$args" part so non-default permalinks doesn't break when using query string
                try_files $uri $uri/ /index.php?$args;
        }

        location ~ \.php$ {
                #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
                location ~ /wp-(admin|login) {
                  return 301 https://$host$request_uri;
                }
                try_files $uri =404;
                include fastcgi_params;
                fastcgi_intercept_errors on;
                fastcgi_pass php;
        }

    location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
        access_log off; log_not_found off; expires max;
    }

    location ~ /\. { deny  all; access_log off; log_not_found off; }

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;
}