#### ssl
server_tokens off;
# 
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1;mode=block";
add_header Content-Security-Policy "default-src *; style-src static.addtoany.com self 'unsafe-inline' 'unsafe-eval'; script-src static.addtoany.com self 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline'; script-src-elem 'static.addtoany.com' 'self' 'unsafe-inline' 'unsafe-eval';";
#add_header Content-Security-Policy "default-src *; style-src static.addtoany.com self unsafe-inline unsafe-eval; script-src static.addtoany.com self unsafe-inline unsafe-eval; img-src self unsafe-inline; script-src-elem static.addtoany.com self unsafe-inline unsafe-eval;";

# ssl config

ssl_certificate                 /etc/nginx/ssl/ssl.crt;
ssl_certificate_key             /etc/nginx/ssl/ssl.key;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;

#perfect Forward Security
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security max-age=2592000;

ssl_ciphers  ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;

fastcgi_max_temp_file_size 0;
fastcgi_buffers 16 16k;
fastcgi_buffer_size 32k;

fastcgi_read_timeout 600;
fastcgi_send_timeout 600;
map_hash_max_size 64;
map_hash_bucket_size 64;

server {
    listen       80;
    listen       [::]:80;
    listen       443 default_server ssl;
    listen       [::]:443 default_server ssl;
    if ($scheme = http){
        return 301 https://$server_name$request_uri;
    }

    #server_name  my-site-ltd;
    root /path/to/drupal/site;

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # Very rarely should these ever be accessed outside of your lan
    location ~* \.(txt|log)$ {
        allow 192.168.0.0/16;
        deny all;
    }

    location ~ \..*/.*\.php$ {
        return 403;
    }

    location ~ ^/sites/.*/private/ {
        return 403;
    }

    # Block access to scripts in site files directory
    location ~ ^/sites/[^/]+/files/.*\.php$ {
        deny all;
    }

    # Allow "Well-Known URIs" as per RFC 5785
    location ~* ^/.well-known/ {
        allow all;
    }

    # Block access to "hidden" files and directories whose names begin with a
    # period. This includes directories used by version control systems such
    # as Subversion or Git to store control files.
#    location ~ (^|/)\. {
#        return 403;
#    }

    location / {
        try_files $uri /index.php?$query_string; # For Drupal >= 7
    }
    rewrite ^/core/authorize.php/core/authorize.php(.*)$ /core/authorize.php$1;
    location @rewrite {
        #rewrite ^/(.*)$ /index.php?q=$1; # For Drupal <= 6
        rewrite ^ /index.php; # For Drupal >= 7
    }

    # Don't allow direct access to PHP files in the vendor directory.
    location ~ /vendor/.*\.php$ {
        deny all;
        return 404;
    }

    # Protect files and directories from prying eyes.
    location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {
        deny all;
        return 404;
    }

    # In Drupal 8, we must also match new paths where the '.php' appears in
    # the middle, such as update.php/selection. The rule we use is strict,
    # and only allows this pattern with the update.php front controller.
    # This allows legacy path aliases in the form of
    # blog/index.php/legacy-path to continue to route to Drupal nodes. If
    # you do not have any paths like that, then you might prefer to use a
    # laxer rule, such as:
    #   location ~ \.php(/|$) {
    # The laxer rule will continue to work if Drupal uses this new URL
    # pattern with front controllers other than update.php in a future
    # release.
    location ~ '\.php$|^/update.php' {
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        # Ensure the php file exists. Mitigates CVE-2019-11043
        try_files $fastcgi_script_name =404;
        # Security note: If you're running a version of PHP older than the
        # latest 5.3, you should have "cgi.fix_pathinfo = 0;" in php.ini.
        # See http://serverfault.com/q/627903/94922 for details.
        include fastcgi_params;
        # Block httpoxy attacks. See https://httpoxy.org/.
        fastcgi_param HTTP_PROXY "";
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_intercept_errors on;
        # PHP 5 socket location.
        #fastcgi_pass unix:/var/run/php5-fpm.sock;
        # PHP 7 socket location.
        fastcgi_pass  127.0.0.1:9000;
#        fastcgi_pass unix:/var/run/php-fpm/www.sock;
    }

#    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
#        try_files $uri @rewrite;
#        expires max;
#        log_not_found off;
#    }

    # Fighting with Styles? This little gem is amazing.
    # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
#    location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7
#        try_files $uri @rewrite;
#    }

    # Handle private files through Drupal. Private file's path can come
    # with a language prefix.
    location ~ ^(/[a-z\-]+)?/system/files/ { # For Drupal >= 7
        try_files $uri /index.php?$query_string;
    }
}