infrastructure/roles/kanboard/templates/nginx.d.conf.j2

upstream kanboard {
    server unix:///run/php-fpm/kanboard.socket;
}

server {
    listen       80;
    listen       [::]:80;
    server_name  {{ kanboard_domain }};

    access_log   /var/log/nginx/{{ kanboard_domain }}/access.log json_reduced;
    error_log    /var/log/nginx/{{ kanboard_domain }}/error.log;

    include snippets/letsencrypt.conf;

    location / {
        access_log off;
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;
    server_name  {{ kanboard_domain }};

    access_log   /var/log/nginx/{{ kanboard_domain }}/access.log json_reduced;
    error_log    /var/log/nginx/{{ kanboard_domain }}/error.log;

    ssl_certificate      /etc/letsencrypt/live/{{ kanboard_domain }}/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ kanboard_domain }}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{ kanboard_domain }}/chain.pem;

    root {{ kanboard_dir }};

    index index.php;

    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }

    location ~ \.php$ {
        access_log   /var/log/nginx/{{ kanboard_domain }}/access.log json_main;
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_pass kanboard;
    }

    # Deny access to the directory data
    location ~* /data {
        deny all;
        return 404;
    }

    # Deny access to .htaccess
    location ~ /\.ht {
        deny all;
        return 404;
    }
}