server {

listen 80;
listen [::]:80;
listen 443 quic;
listen 443 ssl;
listen [::]:443 ssl;
listen [::]:443 quic;

server_name             finance.mitrofanov.ru;
ssl_certificate         /etc/letsencrypt/live/finance.mitrofanov.ru/fullchain.pem;
ssl_certificate_key     /etc/letsencrypt/live/finance.mitrofanov.ru/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/finance.mitrofanov.ru/chain.pem;


# Redirect to the correct place, if needed
      set $https_redirect 0;
      if ($server_port = 80) { set $https_redirect 1; }
      if ($host ~ '^www\.') { set $https_redirect 1; }
      if ($https_redirect = 1) {
      return 301 https://SERVERNAME$request_uri;
      }

access_log syslog:server=unix:/dev/log,tag=finance,nohostname main;

location ~* /wp- {
    deny all;
}

include /www/nconf/bot_out;
include /www/nconf/errors_beautify;
error_page 404 /error.html;

root    /www/html/finance.mitrofanov.ru/public;

include /www/nconf/common;

location / {

index       index.html;

add_header Content-Security-Policy  "default-src 'self' https: data: 'unsafe-inline'; frame-src 'self' blob: yandex.ru; frame-ancestors 'self' yandex.ru; form-action 'self'; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval' yandex.ru *.yandex.ru *.yandex.net yastatic.net ajax.googleapis.com *.googletagmanager.com rawgit.com;"     always;

include /www/nconf/headers;

}

location ~ ^/assets/(css|fonts|js|images)/  {
      add_header Cache-Control $cache_control;
      add_header Referrer-Policy           "strict-origin-when-cross-origin" always;
      allow all;
      log_not_found off;
      access_log off;
}

location ~ \.php$ {
      return 444;
}

}