nginx.conf

server {
    listen 80;

    server_name www.ereshte.ir ereshte.ir;

    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;

    server_name www.ereshte.ir ereshte.ir;

    server_tokens off;
    set $docroot /home/ereshte;

    client_body_in_file_only clean;
    client_body_buffer_size 32K;
    client_max_body_size 5M;

    sendfile on;
    send_timeout 300s;

    access_log /home/ereshte/log/nginx-access.log;
    error_log /home/ereshte/log/nginx-error.log error;

    ssl on;
    ssl_certificate /etc/letsencrypt/live/ereshte.ir/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ereshte.ir/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256
    -SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";

    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    resolver 8.8.4.4 8.8.8.8 valid=300s;
    resolver_timeout 10s;

    add_header Strict-Transport-Security max-age=63072000;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;

    location / {
        include uwsgi_params;
        uwsgi_pass unix:/tmp/shopping.sock;
    }

    location /static {
        alias $docroot/website/application/static/;
        access_log off;

        expires 30d;

        tcp_nodelay off;

        open_file_cache max=3000 inactive=120s;
        open_file_cache_valid 45s;
        open_file_cache_min_uses 2;
        open_file_cache_errors off;

        gzip on;
        gzip_disable "msie6";
        gzip_vary on;
        gzip_proxied any;
        gzip_comp_level 6;
        gzip_buffers 16 8k;
        gzip_http_version 1.1;
        gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript image/png image/gif image/jpeg;
    }

    location /media {
        alias $docroot/website/application/media/;
        access_log off;
        log_not_found off;

        # expires 48h;

        # add_header Cache-Control public;

        fastcgi_hide_header Set-Cookie;

        # CORS config
        set $cors "true";

        # Determine the HTTP request method used
        if ($request_method = 'OPTIONS') {
            set $cors "${cors}options";
        }
        if ($request_method = 'GET') {
            set $cors "${cors}get";
        }
        if ($request_method = 'POST') {
            set $cors "${cors}post";
        }
        if ($cors = "true") {
            # Catch all incase there's a request method we're not dealing with properly
            add_header 'Access-Control-Allow-Origin' '*';
        }

        if ($cors = "trueget") {
            add_header 'Access-Control-Allow-Origin' '*';
            add_header 'Access-Control-Allow-Credentials' 'true';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
            add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
        }

        if ($cors = "trueoptions") {
            add_header 'Access-Control-Allow-Origin' '*';

            # Om nom nom cookies
            add_header 'Access-Control-Allow-Credentials' 'true';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

            # Custom headers and headers various browsers *should* be OK with but aren't
            add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

            # Tell client that this pre-flight info is valid for 20 days
            add_header 'Access-Control-Max-Age' 1728000;
            add_header 'Content-Type' 'text/plain charset=UTF-8';
            add_header 'Content-Length' 0;
            return 204;
        }

        if ($cors = "truepost") {
            add_header 'Access-Control-Allow-Origin' '*';
            add_header 'Access-Control-Allow-Credentials' 'true';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
            add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
        }

    }

    location /media/pdf {
            internal; # only allowed for internal redirects
            alias $docroot/website/application/media/pdf;
    }

    location /robots.txt {
            alias $docroot/website/robots.txt;
    }

    location /116042.txt {
        return 200 '';
        add_header Content-Type text/plain;
    }

    location ~ /\. { deny all; }

    location ~ ~$ { deny all; }
}