default.conf

server {
    listen   80; ## listen for ipv4; this line is default and implied
    listen   [::]:80 default ipv6only=on; ## listen for ipv6

    root /usr/share/nginx/html;

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to index.php for IPS.
        try_files $uri $uri/ @ips;
    }

    # Prevent execution of PHP scripts in writable upload directories.
    location ~ ^/uploads/.*\.(?:php\d*|phtml)$ {
        deny all;
    }

    location ~ ^/datastore/.*\.(?:php\d*|phtml)$ {
        deny all;
    }

    # Deny Dotfiles.
    location ~ /\. {
        deny all;
    }

    location ~* ^.+\.(?:js|css|jpeg|jpg|gif|png|ico|map)$ {
        try_files $uri @ips404;
    }

    # Execute the requested PHP script if it exists, otherwise pass off to IPS.
    location ~ \.php$ {
        try_files $uri @ips;

        # Mitigate https://httpoxy.org/ vulnerabilities
        fastcgi_param HTTP_PROXY "";

        include fastcgi_params;
        fastcgi_pass unix:/run/php/php7.3-fpm.sock;
    }

    location @ips {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php7.3-fpm.sock;

        fastcgi_param SCRIPT_FILENAME   $document_root/index.php;
        fastcgi_param SCRIPT_NAME       /index.php;
    }

    location @ips404 {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php7.3-fpm.sock;

        fastcgi_param SCRIPT_FILENAME   $document_root/404error.php;
        fastcgi_param SCRIPT_NAME       /404error.php;
    }
}