diff --git a/roles/php_website/templates/nginx_site.j2 b/roles/php_website/templates/nginx_site.j2
new file mode 100644
index 0000000000000000000000000000000000000000..543f5ce09396f483d3989083368e1cb4c57df88c
--- /dev/null
+++ b/roles/php_website/templates/nginx_site.j2
@@ -0,0 +1,45 @@
+server {
+    listen 80;
+
+    root {{ home }}/htdocs/;
+
+    index index.php;
+
+    server_name {{ fqdn }};
+
+    # Site rewrites.
+    {% for rewrite in rewrites -%}
+    rewrite {{ rewrite }};
+    {% endfor %}
+
+    # Interpret PHP files via FastCGI.
+    location ~ \.php($|/) {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php5-fpm/{{ fqdn }}.sock;
+    }
+
+    # Deny access to all hidden files (this will prevent access to
+    # .htaccess too).
+    location ~ /\. {
+        deny all;
+    }
+
+    {% for regex in deny_files_regex -%}
+    # Deny access to user-specified files.
+    location ~ {{ regex }} {
+        deny all;
+    }
+    {% endfor %}
+
+    {% if php_rewrite_url -%}
+    # Serve the remaining files directly or rewrite request for PHP processing
+    # (clean URLs).
+    location ~ /(.*) {
+        set $suburi $1;
+	try_files $uri $uri/ {{ php_rewrite_url }};
+    }
+    {% endif %}
+
+    access_log /var/log/nginx/{{ fqdn }}-access.log;
+    error_log /var/log/nginx/{{ fqdn }}-error.log;
+}