Piwik with SSL NGINX Config

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name analytics.mertcangokgoz.com;
    set $base /var/www/mertcangokgoz.com;
      root $base/piwik;

    # SSL
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # modern configuration
    ssl_protocols TLSv1.2;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;
    ssl_prefer_server_ciphers on;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout 2s;

    ssl_certificate /etc/letsencrypt/live/sitem.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sitem.com/privkey.pem;

    add_header Strict-Transport-Security max-age=15768000;
    client_max_body_size 50M;

    index index.html index.htm index.php;

    charset utf-8;
    index index.php;
    location / {
      try_files $uri $uri/ /index.php?$args;
    }

    location ~ /\.(?!well-known) {
      deny all;
    }

    # assets, media
    location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
      expires 7d;
      access_log off;
    }

    # svg, fonts
    location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
      add_header Access-Control-Allow-Origin "*";
      expires 7d;
      access_log off;
    }

    location ~ /\.ht {
      deny  all;
    }

    location ~ \.php$ {
      fastcgi_index index.php;
      fastcgi_keep_conn on;
      include /etc/nginx/fastcgi_params;
      #fastcgi_pass 127.0.0.1:9000;
      fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
}