diff --git a/nginx/etc/nginx/available.d/maho.conf b/nginx/etc/nginx/available.d/maho.conf
new file mode 100644
index 0000000..d33cd3b
--- /dev/null
+++ b/nginx/etc/nginx/available.d/maho.conf
@@ -0,0 +1,53 @@
+location / {
+    try_files $uri $uri/ /index.php$is_args$args;
+}
+
+# Maho API Platform routing (mirrors public/.htaccess):
+#   /api/rest/v2/*                  -> rest.php (REST API, Symfony API Platform)
+#   /api/rest/*                     -> api.php?type=rest (legacy Magento 1 REST)
+#   /api/{soap,v2_soap,xmlrpc,jsonrpc} -> index.php (legacy protocol dispatchers)
+#   /api/* (graphql, docs, ...)     -> rest.php
+# Order matters: /api/rest/v2 must come before the bare /api/rest rule.
+location /api {
+    rewrite ^/api/rest/v2 /rest.php last;
+    rewrite ^/api/rest /api.php?type=rest&$args last;
+    rewrite ^/api/(soap|v2_soap|xmlrpc|jsonrpc) /index.php last;
+    rewrite ^/api /rest.php last;
+}
+
+# Prevent clients from accessing hidden files (starting with a dot); /.well-known/ is allowed
+location ~* /\.(?!well-known) { return 404; }
+
+# Prevent clients from accessing backup/config/source files
+location ~* (?:\.(?:bak|conf|dist|fla|in[ci]|log|psd|sh|sql|sw[op])|~)$ { return 404; }
+
+location ~* \.(ico|jpg|jpeg|png|gif|svg|webp|js|css|eot|ttf|otf|woff|woff2|mp4|ogg|ogv|webm|htc)$ {
+    expires 30d;
+    add_header Cache-Control "public";
+}
+
+location ~ \.php$ {
+    try_files $uri =404;
+    expires off;
+
+    fastcgi_pass $fastcgi_backend;
+
+    fastcgi_buffers 16 16k;
+    fastcgi_buffer_size 32k;
+    fastcgi_read_timeout 600s;
+
+    include fastcgi_params;
+
+    fastcgi_param HTTPS on;
+
+    # Prevents these headers being used to exploit Zend_Controller_Request_Http
+    fastcgi_param HTTP_X_REWRITE_URL "";
+    fastcgi_param HTTP_X_ORIGINAL_URL "";
+
+    # fastcgi_param MAGE_RUN_CODE $MAGE_RUN_CODE;
+    # fastcgi_param MAGE_RUN_TYPE $MAGE_RUN_TYPE;
+
+    fastcgi_param SCRIPT_FILENAME  $realpath_root$fastcgi_script_name;
+    fastcgi_param DOCUMENT_ROOT    $realpath_root;
+    fastcgi_param SERVER_PORT      $http_x_forwarded_port;
+}