server {
    listen 443 ssl;
    server_name wiki.mydomain.com;
    root /var/www/html/dokuwiki;
    index index.html index.php doku.php;

    access_log /var/log/nginx/dokuwiki.access.log;
    error_log /var/log/nginx/dokuwiki.error.log;

    ssl on;
    ssl_certificate /etc/letsencrypt/live/wiki.mydomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/wiki.mydomain.com/privkey.pem;
    ssl_session_timeout 5m;
    ssl_ciphers 'AES128+EECDH:AES128+EDH:!aNULL';
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    location / {
        try_files $uri $uri/ @dokuwiki;
    }

    location @dokuwiki {
        rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
        rewrite ^/_detail/(.*) /lib/exe/detail.php?media=$1 last;
        rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
        rewrite ^/(.*) /doku.php?id=$1 last;
    }

    location ~ /(data|conf|bin|inc)/ {
        deny all;
    }

    location ~* \.(css|js|gif|jpe?g|png)$ {
        expires 1M;
        add_header Pragma public;
        add_header Cache-Control "public, must-revalidate, proxy-revalidate";
    }

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_intercept_errors off;
        fastcgi_buffer_size 16k;
        fastcgi_buffers 4 16k;
    }

    location ~ /\.ht {
        deny all;
    }
}

server {
    listen 80;
    server_name wiki.mydomain.com;
    add_header Strict-Transport-Security max-age=2592000;
    rewrite ^ https://wiki.mydomain.com$request_uri? permanent;
}