wordpress-site.conf.j2

# {{ ansible_managed }}

{% block server_before %}{% endblock %}

server {
  {% block server_id -%}
  listen {{ ssl_enabled | ternary('[::]:443 ssl http2', '[::]:80') }};
  listen {{ ssl_enabled | ternary('443 ssl http2', '80') }};
  server_name {{ site_hosts_canonical | union(multisite_subdomains_wildcards) | join(' ') }};
  {% endblock %}

  {% block logs -%}
  access_log   {{ www_root }}/{{ item.key }}/logs/access.log main;
  error_log    {{ www_root }}/{{ item.key }}/logs/error.log;
  {% endblock %}

  {% block server_basic -%}
  root  {{ www_root }}/{{ item.key }}/{{ item.value.current_path | default('current') }}/web;
  index index.php index.htm index.html;
  add_header Fastcgi-Cache $upstream_cache_status;

  # Specify a charset
  charset utf-8;

  # Set the max body size equal to PHP's max POST size.
  client_max_body_size {{ php_post_max_size | default('25m') | lower }};

  {% if env == 'development' -%}
  # https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#virtualbox
  sendfile off;

  {% endif -%}
  {% endblock -%}

  {% block cache_conditions -%}
  {% if item.value.cache is defined and item.value.cache.enabled | default(false) -%}
  # Fastcgi cache conditions
  set $skip_cache 0;
  if ($query_string != "") {
    set $skip_cache 1;
  }
  if ($request_uri ~* "{{ item.value.cache.skip_cache_uri | default(nginx_skip_cache_uri) }}") {
    set $skip_cache 1;
  }
  if ($http_cookie ~* "{{ item.value.cache.skip_cache_cookie | default(nginx_skip_cache_cookie) }}") {
    set $skip_cache 1;
  }

  {% endif -%}
  {% endblock -%}

  {% block multisite_rewrites -%}
  {% if item.value.multisite.enabled | default(false) -%}
  # Multisite rewrites
  {% if item.value.multisite.subdomains | default(false) -%}
  rewrite ^/(wp-.*.php)$ /wp/$1 last;
  rewrite ^/(wp-(content|admin|includes).*) /wp/$1 last;

  {% else -%}
  if (!-e $request_filename) {
    rewrite /wp-admin$ $scheme://$host$uri/ permanent;
    rewrite ^(/[^/]+)?(/wp-.*) /wp$2 last;
    rewrite ^(/[^/]+)?(/.*\.php) /wp$2 last;
  }

  {% endif -%}
  {% endif -%}
  {% endblock -%}

  {% block https -%}
  {% if ssl_enabled -%}
  # SSL configuration
  include h5bp/directive-only/ssl.conf;
  {% if ssl_stapling_enabled -%}
  include h5bp/directive-only/ssl-stapling.conf;
  {% endif -%}

  ssl_dhparam /etc/nginx/ssl/dhparams.pem;
  ssl_buffer_size 1400; # 1400 bytes to fit in one MTU

  add_header Strict-Transport-Security "max-age={{ [hsts_max_age, hsts_include_subdomains, hsts_preload] | reject('none') | join('; ') }}";

  {% if item.value.ssl.provider | default('manual') == 'manual' and item.value.ssl.cert is defined and item.value.ssl.key is defined -%}
  ssl_certificate         {{ nginx_path }}/ssl/{{ item.value.ssl.cert | basename }};
  ssl_certificate_key     {{ nginx_path }}/ssl/{{ item.value.ssl.key | basename }};

  {% elif item.value.ssl.provider | default('manual') == 'letsencrypt' -%}
  ssl_certificate         {{ nginx_path }}/ssl/letsencrypt/{{ item.key }}-{{ letsencrypt_cert_ids[item.key] }}-bundled.cert;
  ssl_certificate_key     {{ nginx_path }}/ssl/letsencrypt/{{ item.key }}.key;

  {% elif item.value.ssl.provider | default('manual') == 'self-signed' -%}
  ssl_certificate         {{ nginx_path }}/ssl/{{ item.key }}.cert;
  ssl_trusted_certificate {{ nginx_path }}/ssl/{{ item.key }}.cert;
  ssl_certificate_key     {{ nginx_path }}/ssl/{{ item.key }}.key;

  {% endif -%}
  {% endif -%}
  {% endblock -%}

  {% block acme_challenge -%}
  include acme-challenge-location.conf;

  {% endblock -%}

  {% block includes_d -%}
  include includes.d/{{ item.key }}/*.conf;

  {% endblock -%}

  {% block location_uploads_php -%}
  # Prevent PHP scripts from being executed inside the uploads folder.
  location ~* /app/uploads/.*\.php$ {
    deny all;
  }
  {% endblock %}

  {% block location_primary -%}
  location / {
    try_files $uri $uri/ /index.php?$args;
  }
  {% endblock %}

  {% block h5bp -%}
  {% if h5bp_cache_file_descriptors_enabled -%}
  include h5bp/directive-only/cache-file-descriptors.conf;
  {% endif -%}

  {% if h5bp_extra_security_enabled -%}
  include h5bp/directive-only/extra-security.conf;
  {% endif -%}

  {% if h5bp_no_transform_enabled -%}
  include h5bp/directive-only/no-transform.conf;
  {% endif -%}

  {% if h5bp_x_ua_compatible_enabled -%}
  include h5bp/directive-only/x-ua-compatible.conf;
  {% endif -%}

  {% if h5bp_cache_busting_enabled -%}
  include h5bp/location/cache-busting.conf;
  {% endif -%}

  {% if h5bp_cross_domain_fonts_enabled -%}
  include h5bp/location/cross-domain-fonts.conf;
  {% endif -%}

  {% if h5bp_expires_enabled -%}
  include h5bp/location/expires.conf;
  {% endif -%}

  {% if h5bp_protect_system_files_enabled -%}
  include h5bp/location/protect-system-files.conf;
  {% endif -%}

  {% endblock %}

  {% block location_php -%}
  location ~ \.php$ {
    {% block location_php_basic -%}
    try_files $uri /index.php;

    {% endblock -%}

    {% block cache_config -%}
    {% if item.value.cache is defined and item.value.cache.enabled | default(false) -%}
    # Fastcgi cache settings
    fastcgi_cache wordpress;
    fastcgi_cache_valid {{ item.value.cache.duration | default(nginx_cache_duration) }};
    fastcgi_cache_bypass $skip_cache;
    fastcgi_no_cache $skip_cache;

    {% endif -%}
    {% endblock -%}

    {% block fastcgi_basic -%}
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
    fastcgi_param DOCUMENT_ROOT $realpath_root;
    fastcgi_pass unix:/var/run/php-fpm-wordpress.sock;
    {%- endblock %}

  }
  {%- endblock %}

}

{% block redirects_https %}
{% if ssl_enabled %}
# Redirect to https
server {
  listen [::]:80;
  listen 80;
  server_name {{ site_hosts | union(multisite_subdomains_wildcards) | join(' ') }};

  {{ self.acme_challenge() -}}

  location / {
    return 301 https://$host$request_uri;
  }
}

{% endif %}
{% endblock -%}

{%- block redirects_domains %}
{% if site_hosts_redirects | default([]) | count %}
# Redirect some domains
{% endif %}
{% for host in item.value.site_hosts if host.redirects | default([]) %}
server {
  listen {{ ssl_enabled | ternary('[::]:443 ssl http2', '[::]:80') }};
  listen {{ ssl_enabled | ternary('443 ssl http2', '80') }};
  server_name {{ host.redirects | join(' ') }};

  {{ self.https() -}}

  {{ self.acme_challenge() -}}

  return 301 $scheme://{{ host.canonical }}$request_uri;
}
{% endfor %}
{% endblock %}