znc-site.conf

# nginx https config
server {
  server_name znc.ie.mk;

  root /var/www/html;
  index index.html index.htm index.nginx-debian.html;

  add_header Strict-Transport-Security max-age=15768000;
  #add_header X-XSS-Protection "1; mode=block";
  add_header X-Permitted-Cross-Domain-Policies none;
  add_header Referrer-Policy strict-origin;

  location / {
    proxy_pass http://127.0.0.1:7000/;
    proxy_http_version 1.1;
    proxy_set_header Connection "upgrade";
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header X-Forwarded-For $remote_addr;

    # by default nginx times out connections in one minute
    proxy_read_timeout 1d;
  }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/znc.ie.mk/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/znc.ie.mk/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
  server_name znc.ie.mk;
  listen 80;
  listen [::]:80;

    if ($host = znc.ie.mk) {
        return 301 https://$host$request_uri;
    } # managed by Certbot
    return 404; # managed by Certbot
}

znc-stream.conf

# nginx stream config
upstream znc {
    server 127.0.0.1:7000;
}

server {
    listen      1661 ssl;
    listen      [::]:1661 ssl;
    ssl_certificate /etc/letsencrypt/live/znc.ie.mk/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/znc.ie.mk/privkey.pem; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    proxy_pass znc;
}

znc.conf

// part of /var/lib/private/znc/configs/znc.conf

TrustedProxy = ::1
TrustedProxy = 127.0.0.1

<Listener listener0>
        AllowIRC = true
        AllowWeb = true
        Host = 127.0.0.1
        IPv4 = true
        IPv6 = false
        Port = 7000
        SSL = false
        URIPrefix = /
</Listener>

znc.service

# /etc/systemd/system/znc.service
[Unit]
Description=ZNC, an advanced IRC bouncer
After=network.target

[Service]
User=znc
DynamicUser=yes
StateDirectory=znc
ExecStart=/usr/bin/znc -f --datadir /var/lib/znc

[Install]
WantedBy=multi-user.target