Сам решил, вопрос закрыт, если кому интересно:
nginx.conf
server {
server_name site.ru www.site.ru;
charset off;
index index.php index.html;
disable_symlinks if_not_owner from=$root_path;
include /etc/nginx/vhosts-includes/*.conf;
include /etc/nginx/vhosts-resources/site.ru/*.conf;
include /etc/nginx/users-resources/www-root/*.conf;
access_log /var/www/httpd-logs/site.ru.access.log;
error_log /var/www/httpd-logs/site.ru.error.log notice;
ssi on;
#set $root_path /var/www/www-root/data/www/site.ru/advanced/backend/web;
set $root_path /var/www/site.ru/advanced/backend/web;
root $root_path;
gzip on;
gzip_comp_level 5;
gzip_disable "msie6";
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;
# Backend - основной домен
location / {
root /var/www/site.ru/advanced/backend/web;
index index.php;
try_files $uri $uri/ /index.php?$args;
location ~ \.php$ {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $request_filename;
fastcgi_pass unix:/var/www/php-fpm/1.sock;
}
}
# Frontend - /public
location ^~ /public {
alias /var/www/site.ru/advanced/frontend/web;
index index.php;
if (!-e $request_filename) {
rewrite ^/public/(.*)$ /public/index.php?$args last;
}
location ~ \.php$ {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $request_filename;
fastcgi_pass unix:/var/www/php-fpm/1.sock;
}
}
listen x.x.x.x:443 ssl;
ssl_certificate "/var/www/httpd-cert/www-root/site.ru_le2.crt";
ssl_certificate_key "/var/www/httpd-cert/www-root/site.ru_le2.key";
ssl_ciphers EECDH:+AES256:-3DES:RSA+AES:!NULL:!RC4;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
add_header Strict-Transport-Security "max-age=31536000;";
ssl_dhparam /etc/ssl/certs/dhparam4096.pem;
}
ну и из конфигов yii нафиг убрал homeUrl и @baseurl (не знаю повлияло ли на решение)