nginx.conf

user             www-data;
worker_processes 1;

error_log /var/log/nginx/error.log warn;
pid       /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    upstream php-handler {
        server app-server:9000;
    }

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log        /var/log/nginx/access.log  main;
    sendfile          on;
    keepalive_timeout 65;

    # Set the "immutable" cache control options only for assets with a cache busting "v" argument
    map $arg_v $asset_immutable {
        "" "";
        default "immutable";
    }

    # Ensure requests properly pass to onlyoffice
    map $http_host $this_host {
        "" $host;
        default $http_host;
    }

    map $http_x_forwarded_proto $the_scheme {
        default $http_x_forwarded_proto;
        "" $scheme;
    }

    map $http_x_forwarded_host $the_host {
        default $http_x_forwarded_host;
        "" $this_host;
    }

    server {
        listen 80;
        # Allows for being behind a reverse proxy and allowing the Nextcloud app to connect
        server_tokens off;

        # Add headers to serve security related headers
        # Comment out those handled by proxy
        # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
        # add_header X-Content-Type-Options nosniff;
        # add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag "noindex, nofollow" always;
        add_header X-Download-Options noopen always;
        add_header X-Permitted-Cross-Domain-Policies none always;

        # Remove X-Powered-By information leak
        fastcgi_hide_header X-Powered-By;

        root                    /var/www/html;
        client_max_body_size    10G; # 0=unlimited - set max upload size
        fastcgi_buffers         64 4K;
        client_body_buffer_size 512k;

        gzip off;

        # Add .mjs as a file extension for javascript
        # Either include it in the default mime.types list
        # or you can include that list explicitly and add the file extension
        # only for Nextcloud like below:
        include mime.types;
        types {
            text/javascript js mjs;
        }

        # Specify how to handle directories -- specifying `/index.php$request_uri`
        # here as the fallback means that Nginx always exhibits the desired behaviour
        # when a client requests a path that corresponds to a directory that exists
        # on the server. In particular, if that directory contains an index.php file,
        # that file is correctly served; if it doesn't, then the request is passed to
        # the front-end controller. This consistent behaviour means that we don't need
        # to specify custom rules for certain paths (e.g. images and other assets,
        # `/updater`, `/ocs-provider`), and thus
        # `try_files $uri $uri/ /index.php$request_uri`
        # always provides the desired behaviour.
        index index.php index.html /index.php$request_uri;

        # Rule borrowed from ".htaccess" to handle Microsoft DAV clients
        location = / {
        if ( $http_user_agent ~ ^DavClnt ) {
                return 302 /remote.php/webdav/$is_args$args;
            }
        }

        location ^~ /.well-known {
            location = /.well-known/carddav         { return 301 /remote.php/dav/; }
            location = /.well-known/caldav          { return 301 /remote.php/dav/; }
            location = /.well-known/webfinger       { return 301 /index.php/.well-known/webfinger/; }
            location = /.well-known/nodeinfo        { return 301 /index.php/.well-known/nodeinfo/; }

            # No required; behind proxy
            # location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
            # location /.well-known/pki-validation    { try_files $uri $uri/ =404; }

            # Let Nextcloud's API for "/.well-known" URIs handle all other
            # requests by passing them to the front-end controller.
            return 301 /index.php$request_uri;
        }

        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }

        # Rules borrowed from ".htaccess" to hide certain paths from clients
        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

        ## onlyoffice integration
        location ~* ^/ds-vpath/ {
            rewrite        /ds-vpath/(.*) /$1  break;
            proxy_pass     http://onlyoffice-document-server;
            proxy_redirect off;

            client_max_body_size 10G;

            proxy_http_version 1.1;

            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Host $the_host/ds-vpath;
            proxy_set_header X-Forwarded-Proto $the_scheme;
        }

        # Ensure this block, which passes PHP files to the PHP process, is above the blocks
        # which handle static assets (as seen below). If this block is not declared first,
        # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
        # to the URI, resulting in a HTTP 500 error response.
        location ~ \.php(?:$|/) {
            # Required for legacy support; not required for > 27
            # rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;

            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
            set $path_info $fastcgi_path_info;

            try_files $fastcgi_script_name =404;

            include fastcgi_params;

            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $path_info;
            fastcgi_param HTTPS off;
            fastcgi_param modHeadersAvailable true;     # Avoid sending the security headers twice
            fastcgi_param front_controller_active true; # For obfuscating index.php (aka pretty URL)
            fastcgi_pass php-handler;
            fastcgi_intercept_errors on;
            fastcgi_request_buffering off;
            fastcgi_max_temp_file_size 0;
        }

        # Serve static files
        location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
            try_files $uri /index.php$request_uri;
            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
            access_log off;     # Optional: Don't log access to assets

            location ~ \.wasm$ {
                default_type application/wasm;
            }
        }

        location ~ \.woff2?$ {
            try_files $uri /index.php$request_uri;
            expires 7d;         # Cache-Control policy borrowed from ".htaccess"
            access_log off;     # Optional: Don't log access to assets
        }

        # Rule borrowed from ".htaccess"
        location /remote {
            return 301 /remote.php$request_uri;
        }

        # Pass index.php internally (aka pretty URL)
        location / {
            try_files $uri $uri/ /index.php$request_uri;
        }
    }
}