Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

You have .htaccess in your app/ and app/webroot dirs, but nothing in your root directory.

You should have the file: /home/user/public_html/site.com/public/.htaccess

RewriteRule    ^$    app/webroot/    [L]
RewriteRule    (.*) app/webroot/$1    [L]

OR

Change your docroot to

DocumentRoot /home/user/public_html/site.com/public/app/

Both of these answers are assuming public/index.php isn't running some sort of advanced routing on the URI. Having nested .htaccess files doing rewrites is messy though.