nginx-craft.conf

### Nginx configuration for Craft CMS.
server {
  include /etc/nginx/conf.d/craft/server_prepend*.conf;

  listen ${NGINX_LISTEN:-8080} default_server;

  include /etc/nginx/helpers/*.conf;

  root /app/${WEBROOT:-};
  index  index.php;

  ## rewriting /index.php to / because
  ## autocomplete URLs are forced to go to index.php
  rewrite ^/index.php / last;

  ## The 'default' location.
  location / {
    include /etc/nginx/conf.d/craft/location_prepend*.conf;

    ## Do not allow access to .txt and .md unless inside sites/*/files/
    location ~* ^(?!.+sites\/.+\/files\/).+\.(txt|md)$ {
      deny all;
      access_log off;
      log_not_found off;
    }

    ## Replicate the Apache <FilesMatch> directive of Drupal standard but for Craft CMS
    ## .htaccess. Disable access to any code files. Return a 404 to curtail
    ## information disclosure.
    location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|.*sql\.gz|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^\/(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|web\.config)$|composer\.(json|lock)$|^\/#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {
      deny all;
      access_log off;
      log_not_found off;
      return 404;
    }

    ## Expiring per default for four weeks and one second, unsure if 
    expires ${NGINX_DEFAULT_EXPIRES:-2628001s};

    ## Disallow access to any dot files, but send the request to Craft
    location ~* /\. {
      try_files /dev/null @craft;
    }

    ### Directives for installing craft.
    location ~* ^(/install.php|/core/install.php) {
      try_files /dev/null @php;
    }

    ## Direct Access to .php files is not allowed and is sent to Craft instead
    location ~* ^.+\.php$ {
      try_files /dev/null @craft;
    }

    ## Try to find a file with given URL, if not pass to Craft
    try_files $uri @craft;

    include /etc/nginx/conf.d/craft/location_append*.conf;
  }

  ## Main Craft Location
  location @craft {
    include /etc/nginx/conf.d/craft/location_craft_prepend*.conf;

    include        /etc/nginx/fastcgi.conf;
    fastcgi_param  SCRIPT_NAME        /index.php;
    fastcgi_param  SCRIPT_FILENAME    $realpath_root/index.php;
    fastcgi_pass   ${NGINX_FASTCGI_PASS:-php}:9000;

    include /etc/nginx/conf.d/craft/location_craft_append*.conf;
  }

  ## PHP Location.
  ## Warning: This allows to execute any PHP files, use with care!
  location @php {
    include /etc/nginx/conf.d/craft/location_php_prepend*.conf;

    include        /etc/nginx/fastcgi.conf;
    fastcgi_pass   ${NGINX_FASTCGI_PASS:-php}:9000;

    include /etc/nginx/conf.d/craft/location_php_append*.conf;
  }

  ## Trying to access private files directly returns a 404.
  location /sites/default/files/private/ {
    internal;
  }

  ## Disallow access to patches directory.
  location ^~ /patches/ {
    deny all;
    access_log off;
    log_not_found off;
  }

  ## Disallow access to backup directory.
  location ^~ /backup/ {
    deny all;
    access_log off;
    log_not_found off;
  }

  ## Disallow access to vagrant directory.
  location ^~ /vagrant/ {
    deny all;
    access_log off;
    log_not_found off;
  }

  ## Disallow access to vendor directory.
  location ^~ /core/vendor/ {
    deny all;
    access_log off;
    log_not_found off;
  }

  ## Disallow access to vendor directory.
  location ^~ /vendor/ {
    deny all;
    access_log off;
    log_not_found off;
  }

  ## Support for the robotstxt module
  location = /robots.txt {
    access_log off;
    try_files $uri @craft;
  }

  ## Add support for the humanstxt module
  location = /humans.txt {
    access_log off;
    try_files $uri @craft;
  }

  ## Return an in memory 1x1 transparent GIF.	
  location @empty {	
    expires 30d;	
    empty_gif;	
  }

  include /etc/nginx/conf.d/craft/favicon.conf;
  include /etc/nginx/conf.d/craft/server_append*.conf;
}