domain

server {
        listen 80 default_server;
        listen [::]:80 ipv6only=on default_server;

        server_name domain.com www.domain.com;

        access_log /var/log/site/access80.log;
        error_log  /var/log/site/error80.log;

        root /var/www/html;

        location ^~ /.well-known/acme-challenge/ {
                allow all;
        }

        location / {
                return 301 https://$host$request_uri;
        }
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2 ipv6only=on;

        server_name domain.com www.domain.com;

        ssl_certificate     /etc/letsencrypt/live/site/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/site/privkey.pem;

        ssl_session_timeout 1d;
        ssl_session_cache shared:MozSSL:10m;
        ssl_session_tickets off;

        ssl_protocols TLSv1.3;
        ssl_prefer_server_ciphers off;

        add_header Strict-Transport-Security "max-age=63072000" always;

        ssl_stapling on;
        ssl_stapling_verify on;

        access_log /var/log/site/access443.log;
        error_log  /var/log/site/error443.log;

        root /var/www/html;

        location / {
                index index.html;
        }

        error_page 400 401 402 403 404 500 502 503 504 error.html;
        location = error.html {
                internal;
        }

        add_header Content-Security-Policy "default-src 'self' 'nonce-$request_id'; img-src 'self' www.googletagmanager.com;";
        sub_filter_once off;
        sub_filter_types *;
        sub_filter '**NONCE**' $request_id;

        gzip on;
        etag on;
}