server {
	listen 192.168.1.100:80;
	server_name opencart.example.com;
	return 301 https://$host$request_uri;
	server_tokens off;
	}
	server {
	listen 192.168.1.100:443 default_server ssl http2;
	server_name _ "" default_server;
	return 444;
        access_log /var/log/nginx/default_server.access.log main;
        error_log /var/log/nginx/default_server.error.log warn;
        ssl_certificate /etc/ssl/certs/opencart.example.com.crt;
        ssl_certificate_key /etc/ssl/certs/opencart.example.com.key;
	server_tokens off;
	}
	server {
	listen 192.168.1.100:443 ssl http2;
	server_name opencart.example.com;
	root /var/www/html/opencart;
	index index.html index.htm index.php;
        ssl_certificate /etc/ssl/certs/opencart.example.com.crt;
        ssl_certificate_key /etc/ssl/certs/opencart.example.com.key;
	server_tokens off;
	# intermediate configuration https://ssl-config.mozilla.org/
	ssl_protocols TLSv1.3 TLSv1.2;
	ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256";
	ssl_ecdh_curve X25519:secp521r1:secp384r1:prime256v1;
	ssl_prefer_server_ciphers off;
	add_header Strict-Transport-Security "max-age=63072000; includeSubdomains" always;
	add_header Referrer-Policy "no-referrer";

	access_log /var/log/nginx/opencart.example.com-ssl.access.log;
	error_log /var/log/nginx/opencart.example.com-ssl.error.log;

	location / {
		try_files $uri @opencart;
	}
	location @opencart {
		rewrite ^/(.+)$ /index.php?_route_=$1 last;
	}
	location = /favicon.ico {
		log_not_found off;
		access_log off;
	}
	location = /robots.txt {
		allow all;
		log_not_found off;
		access_log off;
	}
	# https://github.com/trimstray/nginx-admins-handbook/blob/master/doc/RULES.md#beginner-protect-sensitive-resources
	location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess|config.php) {
	return 404;
	deny all;
        access_log /var/log/nginx/restricted-files-access-root.log main;
        access_log /var/log/nginx/restricted-files-error-root.log main;
	}
	location ~* /(catalog|ie_pro|image|system)/.*\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ {
	return 404;
	deny all;
        access_log /var/log/nginx/restricted-files-access-system.log main;
        access_log /var/log/nginx/restricted-files-error-system.log main;
	}
	location ~*  \.(jpg|jpeg|png|gif|css|js|ico)$ {
	expires max;
	log_not_found off;
	}
	location ~ \.php$ {
        try_files $uri =404;
        fastcgi_pass unix:/run/php-fpm/oc.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	include fastcgi_params;	

	error_page 404 /404.html;
	error_page 500 502 503 504 403 /50x.html;

	location = /index.php?route=error/not_found {

	root /usr/share/nginx/html;
	internal;
	}

	location = /custom_50x.html {

	root /usr/share/nginx/html;
	internal;
	}
}

server {
    listen 127.0.0.1:80;
    server_name 127.0.0.1;
    location /nginx_status {
        stub_status on;
        access_log off;
        allow 127.0.0.1;
        deny all;
    }
}

server {
    listen                  192.168.1.100:443 ssl http2;
    listen                  [::]:443 ssl http2;
    server_name             opencart.example.com;
    set                     $base /var/www/html;
    root                    $base/opencart;

    # SSL
    ssl_certificate         /etc/letsencrypt/live/opencart.example.com/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/opencart.example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/opencart.example.com/chain.pem;

    # security
    include                 nginxconfig.io/security.conf;

    # logging
    access_log              /var/log/nginx/opencart.example.com.access.log;
    error_log               /var/log/nginx/opencart.example.com.error.log warn;


    index                   index.php;

    # additional config
    include nginxconfig.io/general.conf;
    include nginxconfig.io/opencart.conf;

    # handle .php
    location ~ \.php$ {
        include nginxconfig.io/php_fastcgi.conf;
    }
}

# HTTP redirect
server {
    listen      192.168.1.100:80;
    listen      [::]:80;
    server_name opencart.example.com;
    include     nginxconfig.io/letsencrypt.conf;

    location / {
        return 301 https://opencart.example.com$request_uri;
    }
}

# security headers
add_header X-Frame-Options           "SAMEORIGIN" always;
add_header X-XSS-Protection          "1; mode=block" always;
add_header X-Content-Type-Options    "nosniff" always;
add_header Referrer-Policy           "no-referrer-when-downgrade" always;
add_header Content-Security-Policy   "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

# 404
try_files                     $fastcgi_script_name =404;

# default fastcgi_params
include                       fastcgi_params;

# fastcgi settings
fastcgi_pass                  unix:/run/php-fpm/oc.sock;
fastcgi_index                 index.php;
fastcgi_buffers               8 16k;
fastcgi_buffer_size           32k;

# fastcgi params
fastcgi_param DOCUMENT_ROOT   $realpath_root;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param PHP_ADMIN_VALUE "open_basedir=$base/:/usr/lib/php/:/tmp/";

#Source https://github.com/digitalocean/nginxconfig.io/issues/109
location = /sitemap.xml {
    rewrite ^(.*)$ /index.php?route=feed/google_sitemap break; 
}
location = /googlebase.xml {
    rewrite ^(.*)$ /index.php?route=feed/google_base break; 
}
location / {
	try_files $uri @opencart;
}
location @opencart {
rewrite ^/(.+)$ /index.php?_route_=$1 last;
}
location ~* \.(engine|inc|info|ini|install|log|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_ {
    deny all;
}
location = /apple-touch-icon.png {
  log_not_found off;
  access_log off;
}
location = /apple-touch-icon-precomposed.png {
  log_not_found off;
  access_log off;
}
location ~ ~$ {
    access_log off;
    log_not_found off;
    deny all;
}
location ~* /(?:cache|logs|image|download)/.*\.php$ {
    deny all;
}
location ~* \.(eot|otf|ttf|woff)$ {
    add_header Access-Control-Allow-Origin *;
}
location ~ /\.ht {
    deny all;
}
location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess|config.php) {
    return 404;
    deny all;
 }

location ~* /(catalog|ie_pro|image|system)/.*\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ {
    return 404;
    deny all;
}
error_page 404 /404.html;
error_page 500 502 503 504 403 /50x.html;
location = /index.php?route=error/not_found {
root /usr/share/nginx/html;
internal;
}

# ACME-challenge
location ^~ /.well-known/acme-challenge/ {
    root /var/www/_letsencrypt;
}

# favicon.ico
location = /favicon.ico {
    log_not_found off;
    access_log    off;
}

# robots.txt
location = /robots.txt {
    log_not_found off;
    access_log    off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires    7d;
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires    7d;
    access_log off;
}

# gzip
gzip              on;
gzip_vary         on;
gzip_proxied      any;
gzip_comp_level   6;
gzip_types        text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

# Generated by nginxconfig.io
user                 nginx;
pid                  /var/run/nginx.pid;
worker_processes     auto;
worker_rlimit_nofile 65535;

events {
    multi_accept       on;
    worker_connections 65535;
}

http {
    charset              utf-8;
    sendfile             on;
    tcp_nopush           on;
    tcp_nodelay          on;
    types_hash_max_size  2048;
    client_max_body_size 16M;

    # MIME
    include              mime.types;
    default_type         application/octet-stream;

    #https://amplify.nginx.com/docs/guide-metrics-and-metadata.html#additional-nginx-metrics
    log_format  main_ext '$remote_addr - $remote_user [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer" '
                         '"$http_user_agent" "$http_x_forwarded_for" '
                         '"$host" sn="$server_name" '
                         'rt=$request_time '
                         'ua="$upstream_addr" us="$upstream_status" '
                         'ut="$upstream_response_time" ul="$upstream_response_length" '
                         'cs=$upstream_cache_status' ;
    # Logging
    access_log           /var/log/nginx/access.log main_ext;
    error_log            /var/log/nginx/error.log warn;

    # Limits
    limit_req_log_level  warn;
    limit_req_zone       $binary_remote_addr zone=login:10m rate=10r/m;

    # SSL
    ssl_session_timeout  1d;
    ssl_session_cache    shared:SSL:10m;
    ssl_session_tickets  off;

    # Diffie-Hellman parameter for DHE ciphersuites
    ssl_dhparam          /etc/nginx/dhparam.pem;

    # Mozilla Intermediate configuration
    ssl_protocols        TLSv1.2 TLSv1.3;
    ssl_ciphers          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    # OCSP Stapling
    ssl_stapling         on;
    ssl_stapling_verify  on;
    resolver             1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout     2s;

    # Load configs
    include              /etc/nginx/conf.d/*.conf;
}