Nginx

Add these rules to your site's server { } block, next to your existing PHP (php-fpm) location. They assume RKHM is installed at the domain root, not in a sub-folder.

location / {
  try_files $uri $uri/ /index.php?_st=nginx&_lc=root&q=$request_uri;
}
location /admin/ {
  try_files $uri $uri/ /admin/index.php?_st=nginx&_lc=admin&q=$request_uri;
}
location /api/ {
  try_files $uri $uri/ /api/index.php?_st=nginx&_lc=api&q=$request_uri;
}
location /api/be/ {
  try_files $uri $uri/ /api/admin.php?_st=nginx&_lc=aapi&q=$request_uri;
}
location /api/app/ {
  deny all;
}
location /BOF/app/core/ {
  deny all;
}
location /files/protected {
  rewrite ^/files/protected/(.*)$ /protector.php?path=$1 last;
}
location ^~ /files/hls_keys/ {
  location ~ "^/files/hls_keys/(?<hls_key_name>[a-f0-9]{32})\.key$" { rewrite ^ /hls_key.php?name=$hls_key_name last; }
  deny all;
}
location = /serviceworker.js {
  add_header Cache-Control "no-cache, max-age=0, must-revalidate";
  add_header Service-Worker-Allowed "/";
}

The last two blocks keep protected files and HLS keys private. nginx doesn’t read .htaccess files, so without them both folders are open to anyone. If you switch protected-file delivery to nginx secure_link, replace the /files/protected block with the one shown in Setting → Files → Upload Setting → Protected files. See File Protection. If you added the /files/hls_keys/ block before, check that it uses $hls_key_name. The older version with $1 never passed the key's name on, so HLS items could not play.

The /serviceworker.js block sends the same two headers as the .htaccess file shipped for Apache, so browsers always check for a new service worker after you update RKHM, and offline playback keeps working.

These rewrite rules apply to current releases. If you are upgrading an older installation, update the application before switching its web server. See our Updating guide.