matomo.template

user www-data;

events {
    worker_connections 768;
}

http {
    upstream backend {
        server $SERVER_NAME:9000;
    }

    resolver 127.0.0.11 ipv6=off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    gzip on;
    gzip_disable "msie6";
    client_max_body_size 50M;

    server {
        listen 80;

        add_header Referrer-Policy origin;
        root /var/www/html;
        index index.php;
        try_files $uri $uri/ =404;

        location ~ ^/(index|matomo|piwik|js/index|plugins/HeatmapSessionRecording/configs).php {
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            try_files $fastcgi_script_name =404;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param HTTP_PROXY "";
            fastcgi_pass backend;
        }

        location ~* ^.+\.php$ {
            deny all;
            return 403;
        }

        location ~ /(config|tmp|core|lang) {
            deny all;
            return 403;
        }
        location ~ /\.ht {
            deny all;
            return 403;
        }

        location ~ js/container_.*_preview\.js$ {
            expires off;
            add_header Cache-Control 'private, no-cache, no-store';
        }

        location ~ \.(gif|ico|jpg|png|svg|js|css|htm|html|mp3|mp4|wav|ogg|avi|ttf|eot|woff|woff2|json)$ {
            allow all;
            expires 1h;
            add_header Pragma public;
            add_header Cache-Control "public";
        }

        location ~ /(libs|vendor|plugins|misc/user) {
            deny all;
            return 403;
        }

        location ~/(.*\.md|LEGALNOTICE|LICENSE) {
            default_type text/plain;
        }
    }
}