server {
    listen *:443 ssl;
    server_name admin.{{ mikbill.nginx.domain }}
		IPSERVER;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers   on;
    ssl_certificate         {{ OS.nginx.dirs.ssl }}/{{ OS.nginx.files.ssl_cert }};
    ssl_certificate_key     {{ OS.nginx.dirs.ssl }}/{{ OS.nginx.files.ssl_key }};

    access_log {{ OS.nginx.dirs.logs }}/admin_access.log;
    error_log {{ OS.nginx.dirs.logs }}/admin_error.log;
    root {{ OS.mikbill.dirs.www }}/admin;

    charset utf-8;
    index index.html;
	location / {
        try_files $uri $uri/ /index.php?$args;
    }
	
    location = /index.php {
        include {{ OS.nginx.dirs.conf }}/fastcgi_params;
        fastcgi_pass  unix:{{ OS.fpm.files.socket }};
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME {{ OS.mikbill.dirs.www }}/admin/$fastcgi_script_name;
    }

    location = /robots.txt {
        add_header  Content-Type  text/plain;
        return 200 "User-agent: *\nDisallow: /\n";
    }
    
    # flash config
    location = /res/config.xml {
        allow all;
    }

    # flash locale
    location ~ ^/res/locales/.*\.xml {
        allow all;
    }

    # map background
    location = /res/images/background/([0-9])\.(jpg|jpeg) {
        default_type image/jpeg;
        allow all;
    }

    # map background
    location = /res/images/background/([0-9]).png {
        default_type image/png;
        allow all;
    }

    location ~ ^/(.*)\.(php|php5)$ {
        deny all;
    }

    location ~* ^/(.*)/.*\.(xml|sh|php|php5|phtml|log|sql|key|crt|txt)$ {
        deny all;
    }
}
