SSL Config

default

server {
        server_name order.ocard.co d.ocard.co;

        root /var/www/order.ocard.co;
        index index.html index.php;

        listen 443 ssl;
        ssl_certificate /etc/nginx/ssl/ocard.co.chained.crt;
        ssl_certificate_key /etc/nginx/ssl/ocard.co.key;

        # https://ssl-config.mozilla.org/#server=nginx&version=1.14.0&config=intermediate&openssl=1.1.1&guideline=5.4
        ssl_dhparam /etc/nginx/dhparam.pem;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA$

        # HSTS (ngx_http_headers_module is required) (63072000 seconds)
        add_header Strict-Transport-Security "max-age=63072000" always;
        
        # https://gist.github.com/plentz/6737338
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";

        location / {
                try_files $uri $uri/ /index.php;
        }

        location ~* \.php$ {
                fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
                include snippets/fastcgi-php.conf;
         }

        # Deny for accessing .htaccess files for Nginx
        location ~ /\.ht {
            deny all;
        }
}