Nginx vhost config

# HansVanEijsden WordPress Configuration - Redis FastCGI Page Cache Version
server {

    listen   80; ## listen for ipv4; this line is default and implied
    listen   [::]:80; ## listen for ipv6

    server_name www.danseressen.nl danseressen.nl;

        location /.well-known/acme-challenge {
        alias /srv/www/acme-challenges/;
        try_files $uri =404;
        }

    location / {
    return 301 https://$host$request_uri;
    }

}


server {

    listen  443 http2;
    listen  [::]:443 http2;

    server_name www.danseressen.nl danseressen.nl;

    ssl_certificate /etc/letsencrypt/www.danseressen.nl/www.danseressen.nl.crt+chain;
    ssl_certificate_key /etc/letsencrypt/www.danseressen.nl/www.danseressen.nl.key;

    ssl_stapling               on;
    ssl_stapling_verify        on;
    ssl_trusted_certificate /etc/letsencrypt/intermediate.pem;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    add_header Public-Key-Pins 'pin-sha256="uYb387ter4w6YtmxDQZmSBjnCwSxMh1GfjnqvJkaBVk="; pin-sha256="9+Fks5ifH9WWgPrui/9/WonjiV8Y+4+J3TMxPjcPlTI="; pin-sha256="i/p24QLKIfUlHG+gtyO7bz1dIeY7d+9JsoRwrQ79lJo="; max-age=15768000; includeSubdomains';

    access_log   /var/log/nginx/danseressen.access.log main_ext;
    error_log    /var/log/nginx/danseressen.error.log crit;

    root /home/danseressen/www;
    index index.php index.htm index.html;

    add_header X-Frame-Options "SAMEORIGIN";

set $skip_cache 0;

# POST requests and URL with a query string should always go to php
if ($request_method = POST) {
    set $skip_cache 1;
}

if ($query_string != "") {
    set $skip_cache 1;
}

# Don't cache URL containing the following segments
if ($request_uri ~* "(/wp-admin/|/xmlrpc.php|wp-.*.php|index.php|/feed/|sitemap(_index)?.xml|[a-z0-9_-]+-sitemap([0-9]+)?.xml)") {
    set $skip_cache 1;
}

# Don't use the cache for logged in users or recent commenter
if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in") {
    set $skip_cache 1;
}

# Use cached or actual file if they exists, Otherwise pass request to WordPress
location / {
    try_files $uri $uri/ /index.php?$args;
}

    location /redis-fetch {
        internal  ;
        set  $redis_key $args;
        redis_pass  127.0.0.1:6379;
    }

    location /redis-store {
        internal  ;
        set_unescape_uri $key $arg_key ;
        redis2_query  set $key $echo_request_body;
        redis2_query expire $key 14400;
        redis2_pass  127.0.0.1:6379;
    }

location ~ ^/wp-content/cache/minify/(.+\.(css|js))$ {
    try_files $uri /wp-content/plugins/w3-total-cache/pub/minify.php?file=$1;
}

location ~ \.php$ {
    set $key "www.danseressen.nl:$scheme$request_method$host$request_uri";
    try_files $uri =404;

        srcache_fetch_skip $skip_cache;
        srcache_store_skip $skip_cache;

        srcache_response_cache_control off;

        set_escape_uri $escaped_key $key;

        srcache_fetch GET /redis-fetch $key;
        srcache_store PUT /redis-store key=$escaped_key;

        more_set_headers 'X-Cache $srcache_fetch_status';
        more_set_headers 'X-Cache-2 $srcache_store_status';

    include fastcgi_params;
    fastcgi_pass unix:/var/run/danseressen-php.sock;

}


##
# WordPress Common Settings
##

# Limit access to avoid brute force attack
location = /wp-login.php {
    limit_req zone=one burst=1 nodelay;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/danseressen-php.sock;
}

# Disable wp-config.txt
location = /wp-config.txt {
    deny  all;
#   access_log off;
#   log_not_found off;
}

# Disallow php in upload folder
location /wp-content/uploads/ {
    location ~ \.php$ {
        #Prevent Direct Access Of PHP Files From Web Browsers
        deny all;
    }
}

# Yoast sitemap
location ~ ([^/]*)sitemap(.*)\.x(m|s)l$ {
    rewrite ^/sitemap\.xml$ /sitemap_index.xml permanent;
  rewrite ^/([a-z]+)?-?sitemap\.xsl$ /index.php?xsl=$1 last;
    rewrite ^/sitemap_index\.xml$ /index.php?sitemap=1 last;
    rewrite ^/([^/]+?)-sitemap([0-9]+)?\.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;

  # Following lines are options. Needed for WordPress seo addons
  rewrite ^/news_sitemap\.xml$ /index.php?sitemap=wpseo_news last;
    rewrite ^/locations\.kml$ /index.php?sitemap=wpseo_local_kml last;
    rewrite ^/geo_sitemap\.xml$ /index.php?sitemap=wpseo_local last;
    rewrite ^/video-sitemap\.xsl$ /index.php?xsl=video last;

#   access_log off;
}


##
# Locations - Common Configuration
##

# Basic locations files
location = /favicon.ico {
#   access_log off;
#   log_not_found off;
    expires max;
}

location = /robots.txt {
#   access_log off;
#   log_not_found off;
}

# Cache static files
location ~* \.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf|swf|webp)$ {
#   access_log off;
#   log_not_found off;
    expires max;
    add_header Access-Control-Allow-Origin *;
    add_header Cache-Control "public, must-revalidate, proxy-revalidate";
}


##
# Locations - Security Settings
##

# Deny hidden files
location ~ /\. {
    deny  all;
#   access_log off;
#   log_not_found off;
}

# Deny backup extensions & log files
location ~* ^.+\.(bak|log|old|orig|original|php#|php~|php_bak|save|swo|swp)$ {
    deny  all;
#   access_log off;
#   log_not_found off;
}

}