upstream php-handler {
    server unix:/var/run/php/php7.0-fpm.sock;
}

server {
    if ($host = myhumbleplace.com) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    listen [::]:80;
    server_name myhumbleplace.com;

    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name myhumbleplace.com;

    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;
    add_header Referrer-Policy no-referrer;

    fastcgi_hide_header X-Powered-By;

    root /var/www/html;

    index index.php index.html;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    location / {
        try_files $uri $uri/ /sites/bl/index.php$is_args$args =404;
    }

    location /sites {
        alias /var/www/sites;
    }

    location ~ ^/sites/foo {
        alias /var/www/sites/foo;
        try_files $uri $uri/ /index.php$is_args$args =404;
        include fastcgi.conf;
        include fastcgi_params;
        fastcgi_pass php-handler;
    }

    location ~ ^/sites/foo/((delme|config|content|vendor|composer\.(json|lock|phar))(/|$)|(.+/)?\.(?!well-known(/|$))) {
        root /var/www/sites/foo;
        try_files /sites/foo/index.php$is_args$args =404;
    }

    location ~ \.php$ {
        try_files $uri =404;

        include fastcgi.conf;
        fastcgi_pass php-handler;
    }

    ssl_certificate /etc/letsencrypt/live/myhumbleplace.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/myhumbleplace.com/privkey.pem; # managed by Certbot
}