ssl.conf

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2 ipv6only=on; ## listen for ipv6

        root /var/www/html;
        index index.php index.html index.htm;

        # Make site accessible from http://localhost/
        server_name _;
        ssl_certificate     /etc/nginx/ssl/localhost+1.pem;
        ssl_certificate_key /etc/nginx/ssl/localhost+1-key.pem;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         HIGH:!aNULL:!MD5;

        # redirect non https traffic to http port
        error_page 497 = @fallback;

        location @fallback {
            proxy_pass http://localhost:80;
        }

        # Make site accessible from http://localhost/
        server_name _;

        # Disable sendfile as per https://docs.vagrantup.com/v2/synced-folders/virtualbox.html
        sendfile off;

        # Add stdout logging
        error_log /dev/stdout info;
        access_log /dev/stdout;

        # Add option for x-forward-for (real ip when behind elb)
        #real_ip_header X-Forwarded-For;
        #set_real_ip_from 172.16.0.0/12;

        # block access to sensitive information about git
        location /.git {
           deny all;
           return 403;
        }

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to index.html
                try_files $uri $uri/ =404;
        }

        error_page 404 /404.html;
        location = /404.html {
                root /var/www/errors;
                internal;
        }

        location ^~ /ngd-style.css {
            alias /var/www/errors/style.css;
            access_log off;
        }

        location ^~ /ngd-sad.svg {
            alias /var/www/errors/sad.svg;
            access_log off;
        }

        # pass the PHP scripts to FastCGI server listening on socket
        #
        location ~ \.php$ {
                try_files $uri =404;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_pass unix:/var/run/php-fpm.sock;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                fastcgi_param SCRIPT_NAME $fastcgi_script_name;
                fastcgi_index index.php;
#        fastcgi_param GEOIP2_LONGITUDE $geoip2_data_longitude;
#        fastcgi_param GEOIP2_LATITUDE $geoip2_data_latitude;
#        fastcgi_param GEOIP2_CONTINENT_CODE $geoip2_data_continent_code;
#        fastcgi_param GEOIP2_CONTINENT_NAME $geoip2_data_continent_name;
#        fastcgi_param GEOIP2_COUNTRY_CODE $geoip2_data_country_code;
#        fastcgi_param GEOIP2_COUNTRY_NAME $geoip2_data_country_name;
#        fastcgi_param GEOIP2_STATE_CODE $geoip2_data_state_code;
#        fastcgi_param GEOIP2_STATE_NAME $geoip2_data_state_name;
#        fastcgi_param GEOIP2_CITY_NAME $geoip2_data_city_name;
#        fastcgi_param GEOIP2_POSTAL_CODE $geoip2_data_postal_code;
                include fastcgi_params;
        }

        location ~* \.(jpg|jpeg|gif|png|css|js|ico|webp|tiff|ttf|svg)$ {
                expires           5d;
        }

        # deny access to . files, for security
        #
        location ~ /\. {
                log_not_found off;
                deny all;
        }

        location ^~ /.well-known {
                allow all;
                auth_basic off;
        }

}