server {
 listen 80;
 index index.php;
 server_name kilobytes.fr www.kilobytes.fr;
 return 301 https://$server_name$request_uri; #Redirection
 access_log /var/log/nginx/kilobytes.fr.access_log;
 error_log /var/log/nginx/kilobytes.fr.error_log;
}

server {
 listen 443 ssl http2;
 server_name kilobytes.fr wwww.kilobytes.fr;
 root /usr/share/nginx/html;
 ssl_protocols TLSv1.2;
 ssl_certificate /etc/letsencrypt/live/kilobytes.fr/fullchain.pem;
 ssl_certificate_key /etc/letsencrypt/live/kilobytes.fr/privkey.pem;

location / {
try_files $uri $uri/ /index.php?q=$uri&$args;
 }

location ~ \.php$ {
 try_files $uri $uri/ /index.php?q=$uri&$args;
 fastcgi_pass unix:/run/php/php7.0-fpm.sock;
 fastcgi_index index.php;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 include fastcgi_params;
 satisfy any;
 allow all;
}


 ## Diffie-Hellman
 ssl_ecdh_curve secp384r1;

 ## Ciphers
 ssl_ciphers EECDH+AESGCM:EECDH+AES;
 ssl_prefer_server_ciphers on;

 # OCSP Stapling
 ssl_trusted_certificate /etc/letsencrypt/live/kilobytes.fr/chain.pem;
 resolver 80.67.169.12 80.67.169.40 valid=300s;
 resolver_timeout 5s;
 ssl_stapling on;
 ssl_stapling_verify on;

 ## TLS parameters
 ssl_session_cache shared:SSL:10m;
 ssl_session_timeout 5m;
 ssl_session_tickets off;

 ## HSTS
 add_header Strict-Transport-Security "max-age=15552000; includeSubdomains; preload";
}