# Maintenance site 443
# Domain = example.com
# Cert = /etc/letsencrypt/live/example.com
# LogTag: tag=example_com (only allows alphanumeric characters and underscore)

server {

listen 443;
listen [::]:443;
listen 443 quic;
listen [::]:443 quic;

server_name             example.com;
ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

include /etc/nginx/bots.d/blockbots.conf;

# IF NO WORDPRESS
#location ~* /wp- {
#    deny all;
#}

if ($da_block) { return 444;}

access_log syslog:server=unix:/dev/log,facility=local1,tag=example_com,severity=info,nohostname main;

root    /www/html/maintenance/public;

index    index.html;

location @empty {
empty_gif;
access_log off;
}
location = /favicon.ico {
add_header Cache-Control private;
expires max;
try_files /favicon.ico @empty;
access_log off;
log_not_found off;
}

location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}

location / {

add_header Content-Security-Policy  "default-src 'self';" always;
add_header Retry-After 86400 always;

include /www/nconf/headers;

return 503;

}

}

# Remove if subdomain

server {
      listen 443;
      listen [::]:443;
      listen 443 quic;
      listen [::]:443 quic;
      server_name www.example.com;
      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
      ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
      ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
      ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
      return 308 https://example.com$request_uri;

}

server {
      listen 80;
      listen [::]:80;
      server_name example.com www.example.com;
      return 301 https://example.com$request_uri;
}