nginx ssl stub

letsencrypt.conf

location ^~ /.well-known/acme-challenge {
	alias /var/lib/letsencrypt/.well-known/acme-challenge;
	default_type "text/plain";
	try_files $uri =404;
}

php.conf

location ~ ^(.+\.php)(.*)$ {
	try_files $fastcgi_script_name =404;
	fastcgi_split_path_info  ^(.+\.php)(.*)$;
	fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
	fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
	fastcgi_param  PATH_INFO        $fastcgi_path_info;
	include        /etc/nginx/fastcgi_params;
}

ssl.conf

ssl_session_timeout 		5m;
ssl_session_cache shared:SSL:20m;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 			'AES128+EECDH:AES128+EDH';
ssl_prefer_server_ciphers 	on;

add_header X-Frame-Options "DENY";
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

stub.config

server {
	listen 80;
	listen [::]:80;
	server_name example.com;

	return 301      https://$server_name$request_uri;
}

server {
	listen   443;
	listen [::]:443;

	server_name example.com;
	root /srv/http;

	index index.php index.html index.htm;

	ssl     			on;
	ssl_certificate 		/etc/letsencrypt/live/example.com/fullchain.pem;
	ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
	ssl_trusted_certificate		/etc/letsencrypt/live/example.com/chain.pem;
	
	include /etc/nginx/ssl.conf;
	include /etc/nginx/letsencrypt.conf;
	include /etc/nginx/php.conf;

	location / {
		# First attempt to serve request as file, then
		# as directory, then fall back to displaying a 404.
		try_files $uri $uri/ /index.html;
	}
}