nginx.conf

# This is an example of custom Nginx virtual host with support
# for WP-Rocket (which makes WordPress insantely fast).
# There is no need to handle SSL termination because in a containerized
# stack, it should be handled by a separate load balancer/reverse proxy
server {
  server_name codeable.io;

  listen 80;
  listen [::]:80;

  access_log /dev/stdout;
  error_log /dev/stdout info;

  root /var/www/wordpress;
  index index.php;

  error_page 500 502 503 504 /50x.html;
  location = /50x.html {
    root /var/lib/nginx/html;
  }

  # No need to expose this file (and siblings) publicly
  location /wp-content/nginx {
    deny all;
    return 404;
  }

  # Prettier sitemap URLs
  rewrite ^/sitemap_index\.xml$ /index.php?sitemap=1 last;
  rewrite ^/([^/]+?)-sitemap([0-9]+)?\.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;

  #############################################################################
  # WP-Rocket configuration

  set $rocket_debug 0;
  set $rocket_wpcontent_directory "$document_root/wp-content";
  set $rocket_wpcontent_url "/wp-content";

  set $rocket_bypass 1;
  set $rocket_encryption "";
  set $rocket_file "";
  set $rocket_is_bypassed "No";
  set $rocket_reason "";
  set $rocket_https_prefix "";
  set $rocket_hsts 0;
  set $rocket_hsts_value_default "max-age=31536000; includeSubDomains";

  #############################################################################
  # Gzip

  gzip on;
  gzip_buffers 16 8k;
  gzip_comp_level 9;
  gzip_http_version 1.0;
  gzip_min_length 0;
  gzip_types text/plain text/css image/x-icon image/svg+xml image/png image/jpg image/jpeg text/js text/php application/javascript application/x-javascript;
  gzip_vary on;
  gzip_proxied expired no-cache no-store private auth;
  gzip_disable "MSIE [1-6]\.";

  #############################################################################
  # Is GZIP accepted by client ?
  if ($http_accept_encoding ~ gzip) {
    set $rocket_encryption _gzip;
  }

  # Is SSL request ?
  if ($http_x_forwarded_proto  = "https") {
    set $rocket_https_prefix "-https";
    set $rocket_hsts 1;
  }

  # If HSTS value is not set, use default value
  if ($rocket_hsts_value = "") {
    set $rocket_hsts_value "$rocket_hsts_value_default";
  }

  # If HSTS is disabled, unset HSTS set for Rocket-Nginx configuration
  if ($rocket_hsts = "0") {
    set $rocket_hsts_value "";
  }

  # File/URL to return IF we must bypass WordPress
  set $rocket_end "/cache/wp-rocket/$http_host/$request_uri/index$rocket_https_prefix.html$rocket_encryption";
  set $rocket_url "$rocket_wpcontent_url$rocket_end";
  set $rocket_file "$rocket_wpcontent_directory$rocket_end";
  set $rocket_mobile_detection "$rocket_wpcontent_directory/cache/wp-rocket/$http_host/$request_uri/.mobile-active";

  # Do not bypass if it's a POST request
  if ($request_method = POST) {
    set $rocket_bypass 0;
    set $rocket_reason "POST request";
  }

  # Do not bypass if arguments are found (e.g. ?page=2)
  if ($args != "") {
    set $rocket_bypass 0;
    set $rocket_reason "Arguments found";
  }

  # Do not bypass if the site is in maintenance mode
  if (-f "$document_root/.maintenance") {
    set $rocket_bypass 0;
    set $rocket_reason "Maintenance mode";
  }

  # Do not bypass if one of those cookie if found
  # wordpress_logged_in_[hash] : When a user is logged in, this cookie is created (we'd rather let WP-Rocket handle that)
  # wp-postpass_[hash] : When a protected pass requires a password, this cookie is created.
  if ($http_cookie ~* "(wordpress_logged_in_|wp\-postpass_|woocommerce_items_in_cart|woocommerce_cart_hash|wptouch_switch_toogle|comment_author_|comment_author_email_)") {
    set $rocket_bypass 0;
    set $rocket_reason "Cookie";
  }

  if (-f "$rocket_mobile_detection") {
    set $rocket_bypass 0;
    set $rocket_reason "Specific mobile cache activated";
  }

  # Do not bypass if the cached file does not exist
  if (!-f "$rocket_file") {
    set $rocket_bypass 0;
    set $rocket_reason "File not cached";
  }

  # If the bypass token is still on, let's bypass WordPress with the cached URL
  if ($rocket_bypass = 1) {
    set $rocket_is_bypassed "Yes";
    set $rocket_reason "$rocket_url";
  }

  # Clear variables if debug is not needed
  if ($rocket_debug = 0) {
    # set $rocket_is_bypassed "";
    set $rocket_reason "";
    set $rocket_file "";
  }

  # If the bypass token is still on, rewrite according to the file linked to the request
  if ($rocket_bypass = 1) {
    rewrite .* "$rocket_url" last;
  }

  # Add header to HTML cached files
  location ~ /wp-content/cache/wp-rocket/.*html$ {
    add_header Vary "Accept-Encoding, Cookie";
    add_header X-Rocket-Nginx-Bypass $rocket_is_bypassed;
    add_header X-Rocket-Nginx-Reason $rocket_reason;
    add_header X-Rocket-Nginx-File $rocket_file;
    add_header Strict-Transport-Security "$rocket_hsts_value";
    expires 1h;
  }

  # Do not gzip cached files that are already gzipped
  location ~ /wp-content/cache/wp-rocket/.*_gzip$ {
    gzip off;
    types {}
    default_type text/html;
    add_header Content-Encoding gzip;
    add_header Vary "Accept-Encoding, Cookie";
    add_header X-Rocket-Nginx-Bypass $rocket_is_bypassed;
    add_header X-Rocket-Nginx-Reason $rocket_reason;
    add_header X-Rocket-Nginx-File $rocket_file;
    add_header Strict-Transport-Security "$rocket_hsts_value";
    expires 1h;
  }

  location / {
    try_files $uri $uri/ /index.php?$args;
    add_header X-Rocket-Nginx-Bypass $rocket_is_bypassed;
    add_header X-Rocket-Nginx-Reason $rocket_reason;
    add_header X-Rocket-Nginx-File $rocket_file;
  }

  location ~ \.php$ {
    include fastcgi.conf;
    fastcgi_pass unix:/var/run/fpm.sock;
    fastcgi_index index.php;

    # An example of passing custom PHP params
    # fastcgi_param PHP_VALUE "auto_prepend_file=/var/www/wordpress/wp-content/wordfence-waf.php";
  }

  #############################################################################
  # Asset caching

  location ~* \.(?:rss|atom)$ {
    expires 1h;
    add_header Cache-Control "public";
  }

  location ~* \.(eot|ttf|woff|woff2)$ {
    expires 1M;
    add_header Access-Control-Allow-Origin *;
  }

  location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
    expires 1M;
    access_log off;
    add_header Cache-Control "public";
  }

  location ~* \.(?:css|js)$ {
    expires 1y;
    access_log off;
    add_header Cache-Control "public";
  }

}