server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name php.example.com;

    root /var/www/php.example.com/public;
    index index.php index.html;
    autoindex off;

    include /etc/nginx/snippets/tls-example.conf;
    include /etc/nginx/snippets/security-headers.conf;
    include /etc/nginx/snippets/hsts.conf;
    include /etc/nginx/snippets/deny-sensitive-files.conf;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTP_PROXY "";
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_connect_timeout 5s;
        fastcgi_send_timeout 60s;
        fastcgi_read_timeout 60s;
        fastcgi_hide_header X-Powered-By;
    }

    location ~* ^/(?:uploads|files)/.*\.php$ {
        deny all;
    }
}
