nginx.conf

# Upstream to abstract backend connection(s) for php
upstream php74 {
	server 127.0.0.1:9000;
}

server {
	listen 80;
	server_name asanpay.com www.asanpay.com;
	return 301 https://asanpay.com$request_uri;
}

server {
    listen 443 http2 ssl;
    listen [::]:443 http2 ssl;

    server_name asanpay.com www.asanpay.com;

    ssl_certificate /etc/ssl/certs/asanpay-selfsigned.crt;
    ssl_certificate_key /etc/ssl/private/asanpay-selfsigned.key;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;


    ########################################################################
    # from https://cipherli.st/                                            #
    # and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html #
    ########################################################################

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Disable preloading HSTS for now.  You can use the commented out header line that includes
    # the "preload" directive if you understand the implications.
    #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
    add_header X-Frame-Options DENY;
    #add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";
    add_header X-XSS-Protection "1; mode=block";

    disable_symlinks off;

    ##################################
    # END https://cipherli.st/ BLOCK #
    ##################################


    root /var/www/asanpay.com/public;

    index index.html index.htm index.php;

    charset utf-8;

    location / {
	    autoindex on;
	    try_files $uri $uri/ /index.php?$query_string;
    }

    location = /blog {
	    return 301 /blog/;
    }

    location  /blog/ {
	    fastcgi_read_timeout 120;
	    proxy_redirect off;
	    port_in_redirect off;

        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header Referer $http_referer;
        proxy_set_header Cookie $http_cookie;
        proxy_set_header Accept-Encoding '';

        client_max_body_size 100M;
        client_body_buffer_size 1m;
        proxy_intercept_errors on;
        proxy_buffering on;
        proxy_buffer_size 128k;
        proxy_buffers 256 16k;
        proxy_busy_buffers_size 256k;
        proxy_temp_file_write_size 256k;
        proxy_max_temp_file_size 0;
        proxy_read_timeout 300;
        proxy_send_timeout   300;
        proxy_connect_timeout 159s;
        proxy_pass_header Set-Cookie;
        proxy_hide_header  Vary;
        proxy_ignore_headers Cache-Control Expires;

	    proxy_pass http://localhost:8000/;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    error_page 404 /index.php;

    location ~ \.php$ {
	    fastcgi_pass php74;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}