+server {
+ listen 443 ssl;
+ server_name shaarli.mydomain.org;
+ root /var/www/shaarli.mydomain.org;
+
+ # log file locations
+ # combined log format prepends the virtualhost/domain name to log entries
+ access_log /var/log/nginx/access.log combined;
+ error_log /var/log/nginx/error.log;
+
+ # paths to private key and certificates for SSL/TLS
+ ssl_certificate /etc/ssl/shaarli.mydomain.org.crt;
+ ssl_certificate_key /etc/ssl/private/shaarli.mydomain.org.key;
+
+ # Let's Encrypt SSL settings from https://github.com/certbot/certbot/blob/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf
+ ssl_session_cache shared:le_nginx_SSL:10m;
+ ssl_session_timeout 1440m;
+ ssl_session_tickets off;
+ ssl_protocols TLSv1.2 TLSv1.3;
+ ssl_prefer_server_ciphers off;
+ ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+
+ # increase the maximum file upload size if needed: by default nginx limits file upload to 1MB (413 Entity Too Large error)
+ client_max_body_size 100m;
+
+ # relative path to shaarli from the root of the webserver
+ location / {
+ # default index file when no file URI is requested
+ index index.php;
+ try_files $uri /index.php$is_args$args;
+ }
+
+ location ~ (index)\.php$ {
+ try_files $uri =404;
+ # slim API - split URL path into (script_filename, path_info)
+ fastcgi_split_path_info ^(.+\.php)(/.+)$;
+ # pass PHP requests to PHP-FPM
+ fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
+ fastcgi_index index.php;
+ include fastcgi.conf;
+ }
+
+ location ~ \.php$ {
+ # deny access to all other PHP scripts
+ # disable this if you host other PHP applications on the same virtualhost
+ deny all;
+ }
+
+ location ~ /\. {
+ # deny access to dotfiles
+ deny all;
+ }
+
+ location ~ ~$ {
+ # deny access to temp editor files, e.g. "script.php~"
+ deny all;
+ }
+
+ location = /favicon.ico {
+ # serve the Shaarli favicon from its custom location
+ alias /var/www/shaarli/images/favicon.ico;
+ }
+
+ # allow client-side caching of static files
+ location ~* \.(?:ico|css|js|gif|jpe?g|png)$ {
+ expires max;
+ add_header Cache-Control "public, must-revalidate, proxy-revalidate";
+ # HTTP 1.0 compatibility
+ add_header Pragma public;
+ }
+