# HTML site 443
# Domain = example.com
# Cert = /etc/letsencrypt/live/example.com
# LogTag: tag=example_com (only allows alphanumeric characters and underscore)

server {

listen 443;
listen [::]:443;
listen 443 quic;
listen [::]:443 quic;

server_name             example.com;
ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

include /etc/nginx/bots.d/blockbots.conf;

location ~* /wp- {
    deny all;
}

if ($da_block) { return 444;}

access_log syslog:server=unix:/dev/log,facility=local1,tag=example_com,severity=info,nohostname main;

root    /www/html/example.com/public;

include /www/nconf/common;

#more_set_headers  'X-Robots-Tag: $robots';
more_set_headers  'X-Robots-Tag: noindex, nofollow, nosnippet, noarchive';

location / {

index       index.html;

add_header Content-Security-Policy  "default-src 'self' https: data: 'unsafe-inline';     frame-src 'self' blob:; frame-ancestors 'self'; form-action 'self';     script-src 'self' blob: 'unsafe-inline' 'unsafe-eval';"     always;

include /www/nconf/headers;

}

location ~ ^/(css|fonts|js|images)/  {
      add_header Cache-Control $cache_control;
      add_header Referrer-Policy           "strict-origin-when-cross-origin" always;
      allow all;
      log_not_found off;
      access_log off;
}

}

# Remove if subdomain

server {
      listen 443;
      listen [::]:443;
      listen 443 quic;
      listen [::]:443 quic;
      server_name www.example.com;
      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
      ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
      ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
      ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
      return 308 https://example.com$request_uri;

}

server {
      listen 80;
      listen [::]:80;
      server_name example.com www.example.com;
      return 301 https://example.com$request_uri;
}