server {
  listen       80;

  server_name tylerit.net;

  root /srv/tylerit_net/wordpress;
  index index.php index.html index.htm;

  location ~ ^/(wp-admin|wp-login.php) {
      allow 104.131.2.229;
      deny all;
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
      fastcgi_pass unix:/var/run/php5-fpm.sock;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      include fastcgi_params;
  }

  location / {
      try_files $uri $uri/ /index.php?error=404;
  }

  rewrite /wp-admin$ $scheme://$host$uri/ permanent;

  location ~ \.php$ {
      try_files $uri /index.php?error=404;
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
      fastcgi_pass unix:/var/run/php5-fpm.sock;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      include fastcgi_params;
  }

  location = /favicon.ico {
      log_not_found off;
      access_log off;
  }

  location = /robots.txt {
      allow all;
      log_not_found off;
      access_log off;
  }

  location ~ /\. {
      deny all;
  }

  location ~* /(?:uploads|files)/.*\.php$ {
      deny all;
  }

}

server {

  listen 443 ssl;

  ssl on;
  ssl_certificate_key /etc/ssl/cert/tylerit_net.pem;
  ssl_certificate /etc/ssl/cert/ca-bundle.pem;

  ssl_ciphers 'AES256+EECDH:AES256+EDH:!aNULL';

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_session_cache shared:SSL:10m;

  ssl_stapling on;
  ssl_stapling_verify on;
  resolver 8.8.4.4 8.8.8.8 valid=300s;
  resolver_timeout 10s;

  ssl_prefer_server_ciphers on;
  ssl_dhparam /etc/ssl/certs/dhparam.pem;

  add_header Strict-Transport-Security max-age=63072000;
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;

  server_name tylerit.net;

  root /srv/tylerit_net/wordpress;
  index index.php index.html index.htm;

  location ~ ^/(wp-admin|wp-login.php) {
      allow 104.131.2.229;
      deny all;
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
      fastcgi_pass unix:/var/run/php5-fpm.sock;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      include fastcgi_params;
  }

  location / {
      try_files $uri $uri/ /index.php?error=404;
  }

  rewrite /wp-admin$ $scheme://$host$uri/ permanent;

  location ~ \.php$ {
      try_files $uri /index.php?error=404;
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
      fastcgi_pass unix:/var/run/php5-fpm.sock;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      include fastcgi_params;
  }

  location = /favicon.ico {
      log_not_found off;
      access_log off;
  }

  location = /robots.txt {
      allow all;
      log_not_found off;
      access_log off;
  }

  location ~ /\. {
      deny all;
  }

  location ~* /(?:uploads|files)/.*\.php$ {
      deny all;
  }

}