grav.whitestrake.net {
    root /srv/grav
    fastcgi / php-fpm:9000 php

    status 403 /forbidden

    # Begin - Security
    # deny all direct access for these folders
    rewrite {
        if {path} match /(.git|cache|bin|logs|backups|tests)/.*$
        to /forbidden
    }
    # deny running scripts inside core system folders
    rewrite {
        if {path} match /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$
        to /forbidden
    }
    # deny running scripts inside user folder
    rewrite {
        if {path} match /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$
        to /forbidden
    }
    # deny access to specific files in the root folder
    rewrite {
        if {path} match /(LICENSE.txt|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess)
        to /forbidden
    }
    ## End - Security

    # global rewrite should come last.
    rewrite / {
        to {path} {path}/ /index.php?_url={uri}
    }
}