nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    keepalive_timeout  65;

    # Database backups (with logos) can be tens of MB. The nginx default of 1M
    # would reject a restore upload with 413 before PHP ever sees it.
    client_max_body_size 256M;

    server {
        listen       [::]:80 ipv6only=off;
        server_name  localhost;

        location / {
            root   /var/www/html;
            index  index.php;
        }

        # Deny rules must precede the generic \.php$ handler below. nginx evaluates
        # regex locations in order and uses the first match, so these have to come
        # first — otherwise \.php$ matches and executes PHP under .tmp/, logos/, etc.
        location ~ \.db$ {
            deny all;
            return 403;
        }

        location ~* images/uploads/logos/.*\.php$ {
            deny all;
            return 403;
        }

        # Block all direct access to the temp working directory. Nothing there is
        # ever meant to be served (backups, restore staging, etc.). The prefix
        # match outranks the \.php$ regex below, so extracted PHP is unreachable.
        location ^~ /.tmp/ {
            deny all;
            return 403;
        }

        location ~* ^/includes/.*\.php$ {
            deny all;
            return 403;
        }

        location ~ \.php$ {
            root           /var/www/html;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include        fastcgi_params;
        }
    }

    include /etc/nginx/conf.d/*.conf;
}