nginx.conf

user www-data;
worker_processes 10;
pid /var/run/nginx.pid;
error_log /mnt/logs/error.log warn;

events {
    worker_connections 1024;
}

http {
    index index.html index.php;
    default_type text/plain;
    sendfile on;
    tcp_nopush on;
    log_format main '$remote_addr - $remote_user [$time_local] $status '
                    '"$request" $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /mnt/logs/access.log main;

    server {
        listen      80;
        listen [::]:80;

        location / {
            return 301 https://$host$request_uri;
        }

        location /.well-known/acme-challenge/ {
            root /mnt/certbot/www;
        }
    }

    server {
        listen      443 ssl;
        listen [::]:443 ssl;
        root        /mnt/www;
        include     /mnt/certbot/conf/options-ssl-nginx.conf;
        ssl_dhparam /mnt/certbot/conf/ssl-dhparams.pem;

        ########################################################################

        # TODO: replace with your domain
        server_name one.domain;

        # TODO: replace with your domain
        ssl_certificate     /mnt/certbot/conf/live/one.domain/fullchain.pem;
        ssl_certificate_key /mnt/certbot/conf/live/one.domain/privkey.pem;

        ########################################################################

        location ~ \.php$ {
            include fastcgi_params;
            fastcgi_pass  php:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param QUERY_STRING    $query_string;
        }
    }
}