nginx.conf

# Flarum vhost — serves the Flarum public dir over php-fpm, and proxies the
# realtime websocket path (/app) to the flarum/realtime server on :6001.
# Generic server_name: put your own reverse proxy / TLS in front, or expose
# port 80 directly. X-Forwarded-Proto is honoured so HTTPS is detected when a
# TLS-terminating proxy sits in front.

map $http_x_forwarded_proto $flarum_https { default ""; https "on"; }

# WebSocket upgrade helper for the realtime proxy below.
map $http_upgrade $connection_upgrade { default upgrade; "" close; }

server {
    listen      80 default_server;
    server_name _;
    root  /var/www/html/public;
    index index.php;

    client_max_body_size 64M;
    charset utf-8;

    gzip on; gzip_vary on; gzip_comp_level 5; gzip_min_length 256; gzip_proxied any;
    gzip_types text/plain text/css text/javascript application/javascript application/json application/xml image/svg+xml font/woff font/woff2;

    location / { try_files $uri $uri/ /index.php?$query_string; }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    # flarum/realtime websocket server (supervisor program on :6001). The JS
    # client connects to wss://<host>/app — proxy that to the local ws server so
    # a single exposed port 80 (behind your TLS proxy) is all that's needed.
    location /app {
        proxy_pass http://127.0.0.1:6001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 600s;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT   $realpath_root;
        fastcgi_param HTTPS           $flarum_https if_not_empty;
        fastcgi_read_timeout 900;
    }

    location ~* \.(?:css|js|gif|jpe?g|png|webp|svg|woff2?|ttf|eot|ico|map)$ {
        access_log off; log_not_found off; expires 30d; add_header Cache-Control "public";
    }

    location ~ /\.(?!well-known).* { deny all; }
}