server {
    listen 80;
    server_name _;
    root /var/www/html/web;
    index index.php;

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { allow all; access_log off; log_not_found off; }

    location ~ /\.          { deny all; }
    location ~* ^/sites/.*/files/.*\.php$ { deny all; }
    location ~* ^/sites/.*/private/       { deny all; }

    location / {
        try_files $uri /index.php?$query_string;
    }

    location ~ '\.php$|^/update\.php' {
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTP_PROXY "";
        fastcgi_intercept_errors on;
        fastcgi_read_timeout 300;
    }

    # True static assets (always on disk, never PHP-generated)
    location ~* \.(png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|pdf)$ {
        try_files $uri =404;
        expires max;
        access_log off;
    }

    # CSS/JS may be aggregated on first request via PHP; fall through to index.php if missing
    location ~* \.(css|js)$ {
        try_files $uri /index.php?$query_string;
        ${NGINX_CSS_CACHE}
        access_log off;
    }
}