[root@ ~]# nginx -T
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user nginx; worker_processes auto;
#error_log /var/log/nginx/error.log;
error_log syslog:server=syslog.domain.org:12302 debug; pid /run/nginx.pid; include
/usr/share/nginx/modules/*.conf; events {
    worker_connections 1024;
}
http {
    log_format main '$remote_addr - $remote_user [$time_local]
"$request" '
                                                '$status
$body_bytes_sent "$http_referer" '
                                                '"$http_user_agent"
"$http_x_forwarded_for"';
        log_format graylog2_format '$remote_addr - $remote_user
[$time_local] "$request" $status $body_bytes_sent "$http_referer"
"$http_user_agent" "$http_x_forwarded_for"
<msec=$msec|connection=$connection|connection_requests=$connection_requests|millis=$request_time>';
        access_log syslog:server=syslog.domain.org:12301 graylog2_format;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers
"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";
    #ssl_ecdh_curve secp384r1;
        ssl_dhparam /etc/nginx/dhparam.pem;
    ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 60m;
    ssl_session_tickets off;
    charset utf-8;
    server_tokens off;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
        keepalive_timeout 15;
    send_timeout 10;
    client_body_timeout 12;
    client_header_timeout 12;
    types_hash_max_size 2048;

        gzip on;
        #gzip_static on;
    gzip_comp_level 4;
    gzip_min_length 1400;
    gzip_vary on;
    gzip_proxied expired no-cache no-store private auth;
    gzip_types text/plain text/css application/json
application/javascript application/x-javascript text/xml application/xml
application/xml+rss text/javascript;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    include /etc/nginx/conf.d/*.conf;
    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        root /usr/share/nginx/html;
                log_not_found off;
        include /etc/nginx/default.d/*.conf;
        location / {
        }
        error_page 404 /404.html;
            location = /40x.html {
        }
        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }
}

# configuration file /etc/nginx/mime.types:

types {
    text/html                                        html htm shtml;
    text/css                                         css;
    text/xml                                         xml;
    image/gif                                        gif;
    image/jpeg                                       jpeg jpg;
    application/javascript                           js;
    application/atom+xml                             atom;
    application/rss+xml                              rss;

    text/mathml                                      mml;
    text/plain                                       txt;
    text/vnd.sun.j2me.app-descriptor                 jad;
    text/vnd.wap.wml                                 wml;
    text/x-component                                 htc;

    image/png                                        png;
    image/svg+xml                                    svg svgz;
    image/tiff                                       tif tiff;
    image/vnd.wap.wbmp                               wbmp;
    image/webp                                       webp;
    image/x-icon                                     ico;
    image/x-jng                                      jng;
    image/x-ms-bmp                                   bmp;

    application/font-woff                            woff;
    application/java-archive                         jar war ear;
    application/json                                 json;
    application/mac-binhex40                         hqx;
    application/msword                               doc;
    application/pdf                                  pdf;
    application/postscript                           ps eps ai;
    application/rtf                                  rtf;
    application/vnd.apple.mpegurl                    m3u8;
    application/vnd.google-earth.kml+xml             kml;
    application/vnd.google-earth.kmz                 kmz;
    application/vnd.ms-excel                         xls;
    application/vnd.ms-fontobject                    eot;
    application/vnd.ms-powerpoint                    ppt;
    application/vnd.oasis.opendocument.graphics      odg;
    application/vnd.oasis.opendocument.presentation  odp;
    application/vnd.oasis.opendocument.spreadsheet   ods;
    application/vnd.oasis.opendocument.text          odt;
    application/vnd.openxmlformats-officedocument.presentationml.presentation
                                                     pptx;
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
                                                     xlsx;
    application/vnd.openxmlformats-officedocument.wordprocessingml.document
                                                     docx;
    application/vnd.wap.wmlc                         wmlc;
    application/x-7z-compressed                      7z;
    application/x-cocoa                              cco;
    application/x-java-archive-diff                  jardiff;
    application/x-java-jnlp-file                     jnlp;
    application/x-makeself                           run;
    application/x-perl                               pl pm;
    application/x-pilot                              prc pdb;
    application/x-rar-compressed                     rar;
    application/x-redhat-package-manager             rpm;
    application/x-sea                                sea;
    application/x-shockwave-flash                    swf;
    application/x-stuffit                            sit;
    application/x-tcl                                tcl tk;
    application/x-x509-ca-cert                       der pem crt;
    application/x-xpinstall                          xpi;
    application/xhtml+xml                            xhtml;
    application/xspf+xml                             xspf;
    application/zip                                  zip;

    application/octet-stream                         bin exe dll;
    application/octet-stream                         deb;
    application/octet-stream                         dmg;
    application/octet-stream                         iso img;
    application/octet-stream                         msi msp msm;

    audio/midi                                       mid midi kar;
    audio/mpeg                                       mp3;
    audio/ogg                                        ogg;
    audio/x-m4a                                      m4a;
    audio/x-realaudio                                ra;

    video/3gpp                                       3gpp 3gp;
    video/mp2t                                       ts;
    video/mp4                                        mp4;
    video/mpeg                                       mpeg mpg;
    video/quicktime                                  mov;
    video/webm                                       webm;
    video/x-flv                                      flv;
    video/x-m4v                                      m4v;
    video/x-mng                                      mng;
    video/x-ms-asf                                   asx asf;
    video/x-ms-wmv                                   wmv;
    video/x-msvideo                                  avi;
}

# configuration file /etc/nginx/conf.d/default.conf:
server {
    listen       80;
    server_name  localhost;

    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}


# configuration file /etc/nginx/conf.d/cluster.conf:
upstream cluster {
        server localhost:8443;
        server s2.domain.com:8443 backup;
        server s3.domain.com:8443 backup;
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
    server_name domain.com domain.net;
        ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;
        index index.php;

        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";

        location /favicon.ico {
                access_log off;
        log_not_found off;
    }

    location / {
                proxy_pass                                              https://cluster;
                proxy_redirect                                  off;
                proxy_pass_request_headers      on;
                proxy_next_upstream                     error timeout invalid_header http_500 http_502 http_503 http_504;
        proxy_connect_timeout                   2;
                proxy_http_version                              1.1;
                proxy_set_header                                Connection     "";
                proxy_set_header                                Host            $host;
                proxy_set_header                                X-Real-IP       $remote_addr;
                proxy_set_header                                X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

upstream php-fpm {
        server unix:/var/run/php-fpm.sock;
}

server {
    listen 8443 ssl http2;
listen [::]:8443 ssl http2;
    server_name domain.com;
    root /var/www/website;
    ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;
        index index.php;

        location /.git/ {
                allow 192.168.1.0/24;
                allow 192.168.2.0/24;
                allow 192.168.3.0/24;
                deny all;
        }

        location ~* /\.well-known/.*$ {
                root /var/www/website;
        }

        location ~* /.*/img/.*\.(gif|png|jpg)$ {
                access_log off;
                rewrite ^/.*/img/(.*)$ /img/$1 break;
                expires max;
                add_header Pragma public;
                add_header Cache-Control "public";
    }

        location ~* /.*/static/.*$ {
                access_log off;
                rewrite ^/.*/static/(.*)$ /static/$1 break;
                expires max;
                add_header Pragma public;
                add_header Cache-Control "public";
        }

    location ~* /.*/.*\.php$ {
                rewrite ^/(.*)/(.*\.php)$ /controller.php?account=$1&page=$2 break;

                try_files $uri =404;
                fastcgi_pass php-fpm;
                fastcgi_index index.php;
                fastcgi_intercept_errors on;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
    }

        location ~* /.*/$ {
                rewrite ^/(.*)/$ /controller.php?account=$1&page=index.php break;

                try_files $uri =404;
                fastcgi_pass php-fpm;
                fastcgi_index index.php;
                fastcgi_intercept_errors on;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
        }

        location ~* /.*/.*$ {
                rewrite ^/(.*)/(.*)/(.*)$ /tool/$2/$3 break;
                rewrite ^/(.*)/(.*)$ /tool/$2 break;
        }

        location ~* .*\.php$ {
        try_files $uri =404;
        fastcgi_pass php-fpm;
        fastcgi_index index.php;
                fastcgi_intercept_errors on;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

        location ~* ^\/.*[^/]$ {
                return 301 https://$host$request_uri/;
        }

        location / {
                return 301 https://domain.net;
        }
}

server {
    listen 8443 ssl http2;
listen [::]:8443 ssl http2;
    server_name domain.net;
    root /var/www/website;
        ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;
        index index.php;

        location /style.css {
                rewrite /style.css /tool/style.css;
        }

        location ~* .*\.php$ {
        try_files $uri =404;
        fastcgi_pass php-fpm;
        fastcgi_index index.php;
                fastcgi_intercept_errors on;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

server {
        listen 80;
        listen [::]:80;
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name     www.domain.com;
        ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;

        return 301 https://domain.com$request_uri;
}

server {
        listen 80;
        listen [::]:80;
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name     www.domain.net;
        ssl_certificate /etc/letsencrypt/live/domain.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com-0001/privkey.pem;

        return 301 https://domain.net$request_uri;
}

server {
        listen 80;
        listen [::]:80;
        server_name     domain.com domain.net;

        return 301 https://$host$request_uri;
}

# configuration file /etc/nginx/fastcgi_params:

fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  REQUEST_SCHEME     $scheme;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

