server {
  listen 443 ssl;
  server_name _;

  root '/var/www/html';
  index index.php index.html;

  location ~ /\. { deny all; }
  location = /favicon.ico { access_log off; log_not_found off; }
  location = /robots.txt { access_log off; log_not_found off; }

  ssl_certificate '/etc/ssl/certs/iRedMail.crt';
  ssl_certificate_key '/etc/ssl/private/iRedMail.key';

  # ------------------------------------------------------------------------------------------------------------------ #
  # IREDADMIN
  # ------------------------------------------------------------------------------------------------------------------ #

  location ~ ^/iredadmin/static/(.*) { alias /opt/www/iredadmin/static/$1; }

  location ~ ^/iredadmin(.*) {
    rewrite ^/iredadmin(/.*)$ $1 break;

    include uwsgi_params;
    uwsgi_pass 127.0.0.1:7791;
    uwsgi_param UWSGI_CHDIR /opt/www/iredadmin;
    uwsgi_param UWSGI_SCRIPT iredadmin;
    uwsgi_param SCRIPT_NAME /iredadmin;

    # Access control.
    # allow 127.0.0.1;
    # allow 192.168.1.10;
    # allow 192.168.1.0/24;
    # deny all;
  }

  location = /iredadmin { rewrite ^ /iredadmin/; }
  location ~ ^/newsletter/ { rewrite /newsletter/(.*) /iredadmin/newsletter/$1 last; }

  # ------------------------------------------------------------------------------------------------------------------ #
  # ROUNDCUBEMAIL
  # ------------------------------------------------------------------------------------------------------------------ #

  location ~ ^/mail/(bin|config|installer|logs|SQL|temp|vendor)($|/.*) { deny all; }
  location ~ ^/mail/(CHANGELOG|composer.json|INSTALL|jsdeps.json|LICENSE|README|UPGRADING)($|.*) { deny all; }
  location ~ ^/mail/plugins/.*/config.inc.php.* { deny all; }
  location ~ ^/mail/plugins/enigma/home($|/.*) { deny all; }
  location = /mail { return 301 /mail/; }

  location ~ ^/mail/(.*\.php)$ {
    include fastcgi_params;
    fastcgi_index index.php;
    fastcgi_pass unix:/run/php/iredmail.sock;
    fastcgi_param HTTP_PROXY '';
    fastcgi_param SCRIPT_FILENAME /opt/www/roundcubemail/$1;
  }

  location ~ ^/mail/(.*) {
    alias /opt/www/roundcubemail/$1;
    index index.php;
  }

  location ~ \.php$ {
    include fastcgi_params;
    fastcgi_index index.php;
    fastcgi_pass unix:/run/php/iredmail.sock;
    fastcgi_param HTTP_PROXY '';
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  # ------------------------------------------------------------------------------------------------------------------ #
  # STUB STATUS
  # ------------------------------------------------------------------------------------------------------------------ #

  location = /stub_status {
    stub_status on;
    access_log off;
    allow 127.0.0.1;
    deny all;
  }

  location = /status {
    include fastcgi_params;
    fastcgi_pass unix:/run/php/iredmail.sock;
    fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    access_log off;
    allow 127.0.0.1;
    deny all;
  }
}