First commit

roles/nginx/templates/default.j2

@@ -0,0 +1,25 @@
+server {
+	listen *:80;
+	listen [::]:80;
+	server_name localhost;
+	location /nginx_status {
+		stub_status on;
+		access_log   off;
+		allow 127.0.0.1;
+		deny all;
+	}
+}
+
+server {
+	listen *:80 default_server;
+	listen [::]:80 default_server;
+	
+	location /.well-known/acme-challenge {
+		root /srv/http/common/letsencrypt/;
+	}
+	
+	location / {
+		return 301 https://$host$request_uri;
+	}
+}
+

roles/nginx/templates/fastcgi_params.j2

@@ -0,0 +1,31 @@
+##########
+# THIS FILE IS MANAGED BY ANSIBLE
+# ANY MODIFICATION IS LIKELY TO BE ERASED
+##########
+fastcgi_param	QUERY_STRING		$query_string;
+fastcgi_param	REQUEST_METHOD		$request_method;
+fastcgi_param	CONTENT_TYPE		$content_type;
+fastcgi_param	CONTENT_LENGTH		$content_length;
+
+fastcgi_param	SCRIPT_NAME			$fastcgi_script_name;
+fastcgi_param	REQUEST_URI			$request_uri;
+fastcgi_param	DOCUMENT_URI		$document_uri;
+fastcgi_param	DOCUMENT_ROOT		$document_root;
+fastcgi_param	SERVER_PROTOCOL		$server_protocol;
+
+fastcgi_param	GATEWAY_INTERFACE	CGI/1.1;
+fastcgi_param	SERVER_SOFTWARE		nginx/$nginx_version;
+
+fastcgi_param	REMOTE_ADDR			$remote_addr;
+fastcgi_param	REMOTE_PORT			$remote_port;
+fastcgi_param	SERVER_ADDR			$server_addr;
+fastcgi_param	SERVER_PORT			$server_port;
+fastcgi_param	SERVER_NAME			$server_name;
+
+fastcgi_param	HTTPS				$https;
+
+# PHP only
+fastcgi_param	SCRIPT_FILENAME		$request_filename;
+fastcgi_param	REDIRECT_STATUS		200;
+fastcgi_param	PATH_INFO			$fastcgi_path_info;
+fastcgi_param	PATH_TRANSLATED		$document_root$fastcgi_path_info;

roles/nginx/templates/header.conf.j2

@@ -0,0 +1,8 @@
+	listen *:443 ssl http2;
+	listen [::]:443 ssl http2;
+	
+	ssl_certificate /etc/x509/{{ item }}/fullchain.cer;
+	ssl_certificate_key /etc/x509/{{ item }}/{{ item }}.key;
+	server_name {{ item }};
+	access_log /var/log/nginx/{{ item }}.access.log combined_port;
+	error_log /var/log/nginx/{{ item }}.error.log;

roles/nginx/templates/nginx.conf.j2

@@ -0,0 +1,67 @@
+##########
+# THIS FILE IS MANAGED BY ANSIBLE
+# ANY MODIFICATION IS LIKELY TO BE ERASED
+##########
+user www-data;
+worker_processes 4;
+pid /var/run/nginx.pid;
+
+events {
+	worker_connections 768;
+	# multi_accept on;
+}
+
+http {
+	##
+	# Basic Settings
+	##
+	
+	sendfile on;
+	tcp_nopush on;
+	tcp_nodelay on;
+	keepalive_timeout 65;
+	types_hash_max_size 2048;
+	server_tokens off;
+	
+	# server_names_hash_bucket_size 64;
+	# server_name_in_redirect off;
+	
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+	
+	##
+	# Logging Settings
+	##
+	log_format combined_port
+		'$remote_addr:$remote_port - $remote_user [$time_local] '
+		'"$request" $status $body_bytes_sent '
+		'"$http_referer" "$http_user_agent"';
+	access_log /var/log/nginx/access.log combined_port;
+	error_log /var/log/nginx/error.log;
+	
+	##
+	# Gzip Settings
+	##
+	
+	gzip on;
+	gzip_disable "msie6";
+	
+	# gzip_vary on;
+	# gzip_proxied any;
+	# gzip_comp_level 6;
+	# gzip_buffers 16 8k;
+	# gzip_http_version 1.1;
+	gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
+	
+	include nginx.ssl.conf;
+	
+	##
+	# Virtual Host Configs
+	##
+	
+	client_max_body_size 1G;
+	
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}
+

roles/nginx/templates/nginx.ssl.conf.j2

@@ -0,0 +1,26 @@
+##########
+# THIS FILE IS MANAGED BY ANSIBLE
+# ANY MODIFICATION IS LIKELY TO BE ERASED
+##########
+	ssl_session_timeout 1d;
+	ssl_session_cache shared:SSL:50m;
+	ssl_session_tickets off;
+
+	# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+	ssl_dhparam /etc/nginx/dhparam.pem;
+
+	# intermediate configuration. tweak to your needs.
+	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+	ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
+	ssl_prefer_server_ciphers on;
+
+	# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
+	add_header Strict-Transport-Security max-age=15768000;
+
+	# OCSP Stapling ---
+	# fetch OCSP records from URL in ssl_certificate and cache them
+	ssl_stapling on;
+	ssl_stapling_verify on;
+
+	## verify chain of trust of OCSP response using Root CA and Intermediate certs
+	ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

roles/nginx/templates/proxy_params.j2

@@ -0,0 +1,9 @@
+##########
+# THIS FILE IS HANDLED BY ANSIBLE
+# ANY MODIFICATION IS LIKELY TO BE ERASED
+##########
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_hide_header Strict-Transport-Security;

roles/nginx/templates/vhosts/analyse.nintendojo.fr.conf.j2

@@ -0,0 +1,33 @@
+server {
+{% include './templates/header.conf.j2' %}
+	
+	root /srv/http/analyse.nintendojo.fr/;
+	index index.html index.htm index.php;
+	
+	location ~ ^/(status|ping|apc_info.php)$ {
+		access_log off;
+		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+		include fastcgi_params;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+	}
+	
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	location ~ \.htaccess$ {
+		deny all;
+	}
+	
+	location ~ ^/tmp {
+		deny all;
+	}
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}
+

roles/nginx/templates/vhosts/blog.libertus.eu.conf.j2

@@ -0,0 +1,40 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/blog.libertus.eu/;
+	index index.html index.htm index.php;
+	
+	## Optimisation des images
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	## blocage équivalent HTTPS
+	location ~ (\.htaccess|\.inc)$ {
+		deny all;
+	}
+	
+	location ~ ^/(inc|plugins|db|cache)/ {
+		deny all;
+	}
+	
+	## Inter PHP en path_info
+	location ~ ^/(index).php(/.*)+ {
+		fastcgi_split_path_info ^(.+\.php)(/.*)$;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+	
+	## Inter PHP brute
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+	
+	## redirection des zolies URLs vers index.php
+	location / {
+		try_files $uri $uri/ /index.php$uri?$args;
+	}
+}
+

roles/nginx/templates/vhosts/bt.mateu.be.conf.j2

@@ -0,0 +1,8 @@
+server {
+{% include './templates/header.conf.j2' %}
+	
+	location / {
+		proxy_pass http://127.0.0.1:9091;
+	}
+}
+

roles/nginx/templates/vhosts/btf.mateu.be.conf.j2

@@ -0,0 +1,12 @@
+server {
+{% include './templates/header.conf.j2' %}
+	location / {
+		root /var/lib/transmission-daemon/downloads/;
+		autoindex on;
+		allow 2a01:cb0c:8516:7f00::/64;
+		allow 83.167.52.81;
+		allow 2001:1b48:2:103::/64;
+		allow 2001:bc8:26c1:101::/64;
+		deny all;
+	}
+}

roles/nginx/templates/vhosts/coince.mateu.be.conf.j2

@@ -0,0 +1,22 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/coince.mateu.be/;
+	index index.htm index.html index.php;
+
+	allow 2001:bc8:26c1:101:0:0:0:0/64;
+	allow 2001:bc8:26c1:105:0:0:0:0/64;
+	allow 2001:1b48:2:103::6d:2;
+	allow 83.167.52.81;
+	deny all;
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+	
+	location /var {
+		deny all;
+	}
+}
+

roles/nginx/templates/vhosts/fav.libertus.eu.conf.j2

@@ -0,0 +1,22 @@
+## Shaarli
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/fav.libertus.eu/;
+	index index.html index.htm index.php;
+	
+	location ^/(cache|data)/ {
+		deny all;
+	}
+	
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+                expires 2w;
+                log_not_found off;
+        }
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}
+

roles/nginx/templates/vhosts/forum.nintendojo.fr.conf.j2

@@ -0,0 +1,38 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/forum.nintendojo.fr/;
+	index index.html index.htm index.php;
+	
+	client_max_body_size 10M;
+	
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	location ~ \.htaccess$ {
+		deny all;
+	}
+	
+	location ~ ^/(files|store|cache|images/avatars/upload)/ {
+		deny all;
+	}
+	
+	location ~ ^/(config|common)\.php$ {
+		deny all;
+	}
+
+	location ~ /(app).php(/.*)+ {
+		fastcgi_split_path_info ^(.+\.php)(/.*)$;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		fastcgi_read_timeout 60;
+		include fastcgi_params;
+	}
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}
+

roles/nginx/templates/vhosts/m.nintendojo.fr.conf.j2

@@ -0,0 +1,61 @@
+map $http_upgrade $connection_upgrade {
+	default upgrade;
+	''      close;
+}
+
+server {
+{% include './templates/header.conf.j2' %}
+	keepalive_timeout    70;
+	sendfile             on;
+	client_max_body_size 0;
+	large_client_header_buffers 4 32k;
+
+	# Referrer-Policy, même si Chrome ne comprendra pas
+	add_header Referrer-Policy "same-origin";
+
+	location / {
+		try_files $uri @proxy;
+	}
+
+	location @proxy {
+		proxy_pass http://localhost:3000;
+		
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+		
+		proxy_set_header Proxy "";
+		proxy_pass_header Server;
+		
+		proxy_buffering off;
+		proxy_redirect off;
+		
+		proxy_http_version 1.1;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		
+		tcp_nodelay on;
+	}
+
+	location /api/v1/streaming {
+		proxy_pass http://localhost:4000;
+		
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+		
+		proxy_set_header Proxy "";
+		
+		proxy_buffering off;
+		proxy_redirect off;
+		
+		proxy_http_version 1.1;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		
+		tcp_nodelay on;
+	}
+}
+

roles/nginx/templates/vhosts/mail.libertus.eu.conf.j2

@@ -0,0 +1,40 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/mail.libertus.eu/;
+	index index.html index.htm index.php;
+
+	client_max_body_size 512M;
+	
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	## Dossiers et fichiers interdits d'accès
+	location ~ (README|INSTALL|LICENSE|SQL|bin|CHANGELOG|\.htaccess|\.inc)$ {
+		deny all;
+	}
+	location ~ ^/(config|logs|temp) {
+		deny all;
+	}
+	location ~ ^/program/js {
+		#autorise le dossier program/js
+	}
+	location ~ ^/program/.*\.gif$ {
+		#autorise les gifs du dossier program
+	}
+	location ~ ^/program {
+		deny all;
+	}
+	
+	location = /favicon.ico {
+		rewrite ^(.*)$ skins/default/images/favicon.ico;
+	}
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}
+

roles/nginx/templates/vhosts/o.libertus.eu.conf.j2

@@ -0,0 +1,82 @@
+server {
+{% include './templates/header.conf.j2' %}
+	
+	add_header X-Content-Type-Options nosniff;
+	add_header X-XSS-Protection "1; mode=block";
+	add_header X-Robots-Tag none;
+	add_header X-Download-Options noopen;
+	add_header X-Permitted-Cross-Domain-Policies none;
+	
+	fastcgi_hide_header X-Powered-By;
+	
+	root /srv/http/o.libertus.eu/;
+
+	location = /robots.txt {
+		allow all;
+		log_not_found off;
+		access_log off;
+	}
+	
+	location = /.well-known/carddav {
+		return 301 $scheme://$host/remote.php/dav;
+	}
+	
+	location /.well-known/caldav {
+		return 301 $scheme://$host/remote.php/dav;
+	}
+	
+	client_max_body_size 1000M;
+	fastcgi_buffers 64 4k;
+	
+	# Avoid E-Tag error on text file
+	gzip on;
+	gzip_vary on;
+	gzip_comp_level 4;
+	gzip_min_length 256;
+	gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+	gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+	location / {
+		rewrite ^ /index.php$request_uri;
+	}
+	
+	location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+		deny all;
+	}
+
+	location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+		deny all;
+	}
+	
+	location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
+		fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+		fastcgi_param modHeadersAvailable true;
+		fastcgi_param front_controller_active true;
+		fastcgi_intercept_errors on;
+		fastcgi_request_buffering off;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm-oc.sock;
+		include fastcgi_params;
+	}
+
+	location ~ ^/(?:updater|ocs-provider)(?:$|/) {
+		try_files $uri/ =404;
+		index index.php;
+	}
+	
+	location ~* \.(?:css|js|woff|svg|gif)$ {
+		try_files $uri /index.php$request_uri;
+		add_header Cache-Control "public, max-age=15778463";
+		add_header X-Content-Type-Options nosniff;
+		add_header X-XSS-Protection "1; mode=block";
+		add_header X-Robots-Tag none;
+		add_header X-Download-Options noopen;
+		add_header X-Permitted-Cross-Domain-Policies none;
+		access_log off;
+	}
+	
+	location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {
+		try_files $uri /index.php$request_uri;
+		access_log off;
+	}
+}
+

roles/nginx/templates/vhosts/r.mateu.be.conf.j2

@@ -0,0 +1,25 @@
+server {
+	listen *:443 ssl http2;
+	listen [::]:443 ssl http2;
+
+	server_name r.mateu.be perso.nintendojo.fr perso.libertus.eu;
+	access_log /var/log/nginx/r.mateu.be.access.log combined_port;
+	error_log /var/log/nginx/r.mateu.be.error.log;
+	ssl_certificate /etc/x509/r.mateu.be/fullchain.cer;
+	ssl_certificate_key /etc/x509/r.mateu.be/r.mateu.be.key;
+
+	root /srv/http/r.mateu.be/;
+
+	location / {
+		autoindex on;
+	}
+
+	location ~ ^/~mortal/(.*)$ {
+		return 301 https://r.mateu.be/$1;
+	}
+
+	location ~ ^/~clement\.veret/(.*)$ {
+		return 301 https://r.mateu.be/$1;
+	}
+}
+

roles/nginx/templates/vhosts/rss.libertus.eu.conf.j2

@@ -0,0 +1,20 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/rss.libertus.eu/;
+	index index.html index.htm index.php;
+	
+	location ~ \.(js|css|png|jpg|jpeg|gif|svg|svgz)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	location ~ /\.git {
+		deny all;
+	}
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}

roles/nginx/templates/vhosts/sonarr.mateu.be.conf.j2

@@ -0,0 +1,8 @@
+server {
+{% include './templates/header.conf.j2' %}
+	
+	location / {
+		proxy_pass http://localhost:8989;
+	}
+}
+

roles/nginx/templates/vhosts/www.intendo.fr.conf.j2

@@ -0,0 +1,14 @@
+server {
+	listen *:443 ssl http2;
+	listen [::]:443 ssl http2;
+	ssl_certificate /etc/x509/intendo.fr/fullchain.cer;
+	ssl_certificate_key /etc/x509/intendo.fr/intendo.fr.key;
+	server_name intendo.fr www.intendo.fr;
+	access_log /var/log/intendo.fr.access.log combined_port;
+	error_log /var/log/intendo.fr.error.log;
+	
+	location / {
+		return 302 https://www.nintendojo.fr$request_uri;
+	}
+}
+

roles/nginx/templates/vhosts/www.nintendojo.fr.conf.j2

@@ -0,0 +1,83 @@
+## WP NintendojoFR
+server {
+	listen *:443 ssl http2;
+	listen [::]:443 ssl http2;
+	server_name nintendojo.fr www.nintendojo.fr;
+	access_log /var/log/nginx/nintendojo.fr.access.log combined_port;
+	error_log /var/log/nginx/nintendojo.fr.error.log;
+	ssl_certificate /etc/x509/www.nintendojo.fr/fullchain.cer;
+	ssl_certificate_key /etc/x509/www.nintendojo.fr/www.nintendojo.fr.key;
+
+	root /srv/http/www.nintendojo.fr/;
+	index index.html index.htm index.php;
+
+	client_max_body_size 2G;
+
+	# couper les fichiers cachés
+	location ~* /(?:uploads|files)/.*\.php$ {
+		deny all;
+	}
+
+	# couper les fichiers textes du captcha
+	location ~* /wp-content/uploads/wpcf7_captcha/.*\.txt$ {
+		deny all;
+	}
+
+	# Images de la v6
+	location ~ ^/images/(.*)$ {
+		expires 2w;
+		alias /srv/http/archives.nintendojo.fr/v6/images/$1;
+	}
+
+	# Images de la v6.7
+	location ~ ^/public/(.*)$ {
+		expires 2w;
+		alias /srv/http/archives.nintendojo.fr/$1;
+	}
+
+	# Zolie tweet
+	location /tweet {
+		rewrite ^/tweet/([0-9]+)$ /index.php/tweet/?id=$1 last;
+		rewrite ^/tweet/embed/([0-9]+)$ /index.php/tweetembed/?id=$1 last;
+		return 403;
+	}
+
+	# Zolie wallpapers
+	location /wallpapers {
+		rewrite ^/wallpapers$ /index.php/wallpapers last;
+		rewrite ^/wallpapers/([0-9]+) /index.php/wallpapers/?id=$1 last;
+		location ~ ^/wallpapers/files(.*)(/.*\.jpg)$ {
+			expires 1w;
+			alias /srv/http/www.nintendojo.fr/wp-content/plugins/dojomurpapier/files$2;
+		}
+	}
+
+	# Optimisation des images
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+		expires 1w;
+		log_not_found off;
+	}
+
+	# Interprétation PHP
+	location ~ ^/(index).php(/.*)+ {
+		fastcgi_split_path_info ^(.+\.php)(/.*)$;
+		fastcgi_cache wpdojo;
+		fastcgi_cache_key $request_method$host$request_uri;
+		fastcgi_cache_valid any 15m;
+		fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		fastcgi_read_timeout 60;
+		include fastcgi_params;
+	}
+
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		fastcgi_read_timeout 60;
+		include fastcgi_params;
+	}
+
+	location / {
+		try_files $uri $uri/ /index.php$uri?$args;
+	}
+}