SSL is generated by certbot with `sudo certbot nginx -d domain.com -d www.domain.com`

nginx-craft-cms-ssl-config

server {
  root /var/www/hopefield/prod/web;
  index index.php index.html index.htm index.nginx-debian.html;
  server_name domain.com www.domain.com;

  location / {
    try_files $uri $uri/ @rewrites;
  }

  location @rewrites {
    rewrite ^(/en_gb|de|fr|es)?/(.*)$ $1/index.php?p=$2&$args? last;
  }

  location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
  }

  location ~ /\.ht {
    deny all;
  }

  listen 443 ssl; # managed by Certbot
  ssl_certificate /etc/letsencrypt/live/www.domain.com/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/www.domain.com/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
  if ($host = domain.com) {
      return 301 https://www.$host$request_uri;
  } # managed by Certbot

  if ($host = www.domain.com) {
      return 301 https://$host$request_uri;
  } # managed by Certbot

  listen 80;
  server_name domain.com www.domain.com;
    return 404; # managed by Certbot
}