flower21

server {
    listen 80;
    server_name flower.local;
    return 301 https://flower.local$request_uri;
}

server {
    listen 443 ssl;
    server_name flower.local;
    root /var/www/flower.local;
    index index.php;
        ###
        ssl_certificate /etc/nginx/certs/flower.local/fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/flower.local/key.pem;
        ssl_session_timeout 1d;
        ssl_session_cache shared:MozSSL:10m;
        ssl_session_tickets off;

        ssl_dhparam /etc/nginx/certs/dhparam/ffdhe2048.txt;

        ssl_stapling on;
		ssl_stapling_verify on;

        ssl_trusted_certificate /etc/nginx/certs/flower.local/ca.pem;
        ###
    add_header X-Content-Type-Options nosniff;
#   add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

    error_log /var/log/nginx/flower.local.error.log;
    access_log /var/log/nginx/flower.local.access.log;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location = /favicon.ico {
        access_log off;
    }
    location = /robots.txt {
        access_log off;
    }

    location ~* /(images|cache|media|logs|tmp)/.*\.(php|pl|py|jsp|asp|sh|cgi)$ {
        return 403;
        error_page 403 /403_error.html;
    }
	    location ~* \.(jpg|jpeg|gif|png|bmp|ico|js|html|htm|css|swf|flv|txt|rtf|odt|ods|doc|xls|ppt|pdf)$ {
        expires 1d;
    }

            location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        #fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include snippets/fastcgi-php.conf;
        }

    location ~ /\.svn {
        deny all;
    }

    location ~ /\.git {
        deny all;
    }

    location ~ /\.hg {
        deny all;
    }

}