Laravel по-русски

# [url]http://example.com[/url], [url]http://www.example.com[/url] --> [url]https://example.com[/url]
server {
    listen      80;
    listen [::]:80;
    
    # Server domains
    server_name example.com [url=http://www.example.com]www.example.com[/url];
    
    return 301 [url]https://example.com[/url]$request_uri;

    # Needed for firt sertificat init
    # location ^~ /.well-known {
    #     allow all;
    #     root  /data/letsencrypt/;
    # }
}

# [url]https://www.example.com[/url] --> [url]https://example.com[/url]
server {
    listen      443     ssl http2;
    listen [::]:443     ssl http2;
    
    # Server domains
    server_name         [url=http://www.example.com]www.example.com[/url];

    # SSL certificates
    ssl_session_timeout 1d;
    ssl_session_cache   shared:SSL:50m;
    ssl_session_tickets off;

    # modern configuration
    ssl_protocols       TLSv1.2;
    ssl_ciphers         ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;
    ssl_prefer_server_ciphers on;

    # OCSP Stapling
    ssl_stapling        on;
    ssl_stapling_verify on;
    resolver            1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout    2s;

    # SSL certificates
    ssl_certificate           /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate   /etc/letsencrypt/live/example.com/chain.pem;

    # Security Headers
    add_header X-Frame-Options           "SAMEORIGIN" always;
    add_header X-XSS-Protection          "1; mode=block" always;
    add_header X-Content-Type-Options    "nosniff" always;
    add_header Referrer-Policy           "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy   "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;


    return 301 [url]https://example.com[/url]$request_uri;
}


# [url]https://example.com[/url]
server {
    listen      443     ssl http2;
    listen [::]:443     ssl http2;
    
    # Server domains
    server_name         example.com;
    
    # SSL certificates
    ssl_session_timeout 1d;
    ssl_session_cache   shared:SSL:50m;
    ssl_session_tickets off;

    # modern configuration
    ssl_protocols       TLSv1.2;
    ssl_ciphers         ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;
    ssl_prefer_server_ciphers on;

    # OCSP Stapling
    ssl_stapling        on;
    ssl_stapling_verify on;
    resolver            1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout    2s;

    # SSL certificates
    ssl_certificate           /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate   /etc/letsencrypt/live/example.com/chain.pem;

    # Security Headers
    add_header X-Frame-Options           "SAMEORIGIN" always;
    add_header X-XSS-Protection          "1; mode=block" always;
    add_header X-Content-Type-Options    "nosniff" always;
    add_header Referrer-Policy           "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy   "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;


    # Root folder
    root  /app/public;
    
    # index.php
    index index.php;

    location = /favicon.ico { log_not_found off; access_log off; }
    location = /robots.txt  { log_not_found off; access_log off; }

    # SEO | Add back slash SEO
    if ($request_method = "GET") {
        rewrite ^([^.]*[^/])$ $1/ permanent;
    }

    # LetsEncrypt folder
    location ^~ /.well-known {
        allow all;
        root  /data/letsencrypt/;
    }

    # Entry point for App, index.php fallback
    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }

    # handle .php
    location ~ \.php$ {
        # default fastcgi_params
        include   fastcgi_params;
        
        # 404
        try_files $uri /index.php =404;
        
        # fastcgi settings
        fastcgi_pass        app:9000;
        fastcgi_index       index.php;
        fastcgi_buffers     16 16k;
        fastcgi_buffer_size 32k;

        # fastcgi params
        fastcgi_param HTTPS on;
        fastcgi_param HTTP_HTTPS on;
        fastcgi_param REQUEST_SCHEME https;
        fastcgi_param SERVER_PORT 443; 
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_read_timeout 600;
    }

    # Assets and media
    location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
        add_header Cache-Control public;
        
        expires 7d;
        access_log off;
    }

    # SVG and fonts
    location ~* \.(?:svgz?|svg|ttf|ttc|otf|eot|woff|woff2?)$ {
        add_header Access-Control-Allow-Origin "*";
        add_header Cache-Control public;

        expires 7d;
        access_log off;
    }
}