upstream php_www_891rpm_com {
    server unix:/var/run/php-fpm.www_891rpm_com.pid;
    #server 127.0.0.1:9000;
}

server {
    listen [::]:80;
    listen 80;

    # listen on both hosts
    server_name 891rpm.com www.891rpm.com;

    #include letsencrypt/certbot.conf;

    root /var/www/891rpm.com/public;

    location /.well-known/acme-challenge {
        #alias /var/www/891rpm.com/public/.well-known/acme-challenge;
        root /srv/letsencrypt;
    }

    location / {
        return 301 https://891rpm.com$request_uri;
    }

    # and redirect to the https host (declared below)
    # avoiding http://www -> https://www -> https:// chain.
    #return 301 https://$server_name$request_uri;
    #return 301 https://891rpm.com$request_uri;

    location = /favicon.ico$ {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        #allow all;
        log_not_found off;
        access_log off;
        return 200 "Host: https://891rpm.com\n";
    }

    error_log /var/log/nginx/891rpm.com_error.log;
    access_log /var/log/nginx/891rpm.com_access.log;

    #include gzip.conf;
    #include h5bp/advanced.conf;
}

server {
    listen [::]:443 ssl http2;
    listen 443 ssl http2;

    # listen on the wrong host
    server_name www.891rpm.com;

    include h5bp/advanced.conf;

    # SSL
    #ssl_certificate /etc/letsencrypt/live/891rpm.com/fullchain.pem;
    #ssl_certificate_key /etc/letsencrypt/live/891rpm.com/privkey.pem;
    ssl_certificate /etc/letsencrypt/live/891rpm.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/891rpm.com-0001/privkey.pem;

    # OCSP stapling
    #ssl_trusted_certificate /etc/letsencrypt/live/891rpm.com/fullchain.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/891rpm.com-0001/fullchain.pem;

    # and redirect to the non-www host (declared below)
    return 301 https://891rpm.com$request_uri;
}

server {
    # listen [::]:443 ssl http2 accept_filter=dataready;  # for FreeBSD
    # listen 443 ssl http2 accept_filter=dataready;  # for FreeBSD
    #listen [::]:443 ssl http2 deferred;  # for Linux
    #listen 443 ssl http2 deferred;  # for Linux
    listen [::]:443 ssl http2;
    listen 443 ssl http2;

    # The host name to respond to
    server_name 891rpm.com;


    # Path for static files
    root /var/www/891rpm.com/public;
    index index.php index.html;

    # Do not allow access to files giving away your WordPress version
    location ~ /(\.|wp-config.php|readme.html|licence.txt) {
        return 404;
    }

    # Add trailing slash to */wp-admin requests.
    rewrite /wp-admin$ $scheme://$host$uri/ permanent;

    location = /favicon.ico$ {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }


    # Deny access to hidden files
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    location ~* /(?:uploads|files)/.*\.php$ {
        deny all;
    }

    location / {
        #try_files $uri $uri/ =404;
        try_files $uri $uri/ /index.php?$args;
    }

    # get friendly url links working
    if (!-e $request_filename)
    {
        rewrite ^(.+)$ /index.php?q=$1 last;
    }


    # SSL
    #ssl_certificate /etc/letsencrypt/live/891rpm.com/fullchain.pem;
    #ssl_certificate_key /etc/letsencrypt/live/891rpm.com/privkey.pem;
    ssl_certificate /etc/letsencrypt/live/891rpm.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/891rpm.com-0001/privkey.pem;

    # OCSP stapling
    #ssl_trusted_certificate /etc/letsencrypt/live/891rpm.com/fullchain.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/891rpm.com-0001/fullchain.pem;



    location ~ /.*\.php$ {
        try_files $uri =404;

        fastcgi_pass php_www_891rpm_com;

        fastcgi_param PATH_INFO $fastcgi_script_name;

        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include        /etc/nginx/fastcgi_params;
        fastcgi_ignore_client_abort off;
        fastcgi_connect_timeout 60;
        fastcgi_send_timeout 180;
        fastcgi_read_timeout 180;
        fastcgi_buffer_size 128k;
        fastcgi_buffers 4 256k;
        fastcgi_busy_buffers_size 256k;
        fastcgi_temp_file_write_size 256k;

        client_max_body_size 1g;
        client_body_buffer_size 128k;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires max;
        access_log off;
        log_not_found off;
        add_header Pragma public;
        add_header Cache-Control "max-age=31536000, public";
    }

    location ~ /\.ht {
        deny all;
    }

    #Specify a charset
    charset utf-8;

    # Deliver 404 instead of 403 "Forbidden"
    error_page 403 = 404;

    # Custom 404 page
    error_page 404 /404.html;
    location = /404.html {
        root /var/www/891rpm.com/errors;
        internal;
    }

    # Custom 50x pages
    #error_page 500 502 503 504 = /50x.html;
    #location = /50x.html {
    #    root /var/www/891rpm.com/errors;
    #    internal;
    #}

    error_page 500 = /500.html;
    location = /500.html {
        root /var/www/891rpm.com/errors;
        internal;
    }
    error_page 502 = /502.html;
    location = /502.html {
        root /var/www/891rpm.com/errors;
        internal;
    }
    error_page 503 = /503.html;
    location = /503.html {
        root /var/www/891rpm.com/errors;
        internal;
    }
    error_page 504 = /504.html;
    location = /504.html {
        root /var/www/891rpm.com/errors;
        internal;
    }

    error_log /var/log/nginx/891rpm.com_error.log;
    access_log /var/log/nginx/891rpm.com_access.log;

    include gzip.conf;
    include h5bp/advanced.conf;

}