Production-Grade Nginx Reverse-Proxy Configuration

Enterprise core configuration layout optimized for Joomla 6 routing and security hardening standards.

# ========================================================================= 
# CITADEL ENTERPRISE INFRASTRUCTURE — MAIN NGINX VIRTUAL HOST BLUEPRINT 
# FILE PATH: /etc/nginx/sites-available/yourdomain.com.conf 
# ========================================================================= 
 
server { 
listen 80; 
listen [::]:80; 
server_name yourdomain.com ://yourdomain.com; 
return 301 https://$host$request_uri; 
} 
 
server { 
listen 443 ssl http2; 
listen [::]:443 ssl http2; 
server_name yourdomain.com ://yourdomain.com; 
 
root /var/www/yourdomain; 
index index.php index.html index.htm; 
 
# SSL CRYPTOGRAPHY CONFIGURATION (ANONYMIZED PATHS) 
ssl_certificate /etc/nginx/ssl/yourdomain.com.crt; 
ssl_certificate_key /etc/nginx/ssl/yourdomain.com.key; 
ssl_protocols TLSv1.2 TLSv1.3; 
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; 
ssl_prefer_server_ciphers on; 
ssl_session_cache shared:SSL:10m; 
ssl_session_timeout 1d; 
 
# SECURITY HEADERS (OWASP STANDARDS) 
add_header X-Frame-Options "SAMEORIGIN" always; 
add_header X-XSS-Protection "1; mode=block" always; 
add_header X-Content-Type-Options "nosniff" always; 
add_header Referrer-Policy "no-referrer-when-downgrade" always; 
 
# SYSTEM LOGS PATHING 
access_log /var/log/nginx/yourdomain.com_access.log; 
error_log /var/log/nginx/yourdomain.com_error.log warn; 
 
# NATIVE JOOMLA 6 SEF URL COMPATIBLE ROUTING MATRIX 
location / { 
try_files $uri $uri/ /index.php?$args; 
} 
 
# PERSISTENT ASSETS CACHING POLICIES (EXPIRES IN 1 MONTH) 
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ { 
expires 1M; 
access_log off; 
add_header Cache-Control "public, no-transform"; 
} 
 
# LOW-LATENCY PHP-FPM PROCESS INTERFACE UNIFY MAP 
location ~ \.php$ { 
include snippets/fastcgi-php.conf; 
fastcgi_pass unix:/run/php/php8.3-fpm.sock; 
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; 
include fastcgi_params; 
 
# Buffer Tuning for Enterprise CMS Context 
fastcgi_buffer_size 128k; 
fastcgi_buffers 4 256k; 
fastcgi_busy_buffers_size 256k; 
} 
 
# PROTECTING HIDDEN CONFIG BLUEPRINTS AND DOTFILES 
location ~ /\. { 
deny all; 
access_log off; 
log_not_found off; 
} 
}