nginx.conf

server {
    listen 80;
    listen [::]:80;

    server_name example.com;

    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name example.com;
    root /home/cdn/www;
    charset utf-8;
    server_tokens off;

    client_max_body_size 20M;

    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=63072000" always;

    ssl_certificate "/etc/letsencrypt/live/example.com/fullchain.pem";
    ssl_certificate_key "/etc/letsencrypt/live/example.com/privkey.pem";
    ssl_dhparam "/etc/ssl/certs/dhparam.pem";
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    ssl_stapling on;
    ssl_stapling_verify on;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    location / {
        index index.php;
    }

    # $allowedExtension - index.php:132
    location ~* \.(png|jpg|jpeg|gif|webp|webm|mp4|svg)$ {
        charset utf-8;

        try_files $uri /index.php?$args;

        add_header My-Cache-Ray "KR1";
        add_header My-Cache-Status "HIT";
        add_header cache-control "public, max-age=31560000";
        expires max;
        etag off;

        gzip on;
        gzip_types image/svg+xml;
    }

    location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|yml|lock)$ {
        deny all;
    }

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        log_not_found off;
        access_log off;
    }

    location ~ [^/]\.php(/|$) {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.0-fpm.sock;
        fastcgi_buffers 64 16k;
        add_header my-ray "KR1";
        add_header cache-control "public, max-age=31560000";
        expires max;
    }
}