Nginx conf for let's encrypt

# Redirects www
server {
    server_name www.domain.tld;
    return 301 $scheme://domain.tld$request_uri;
}

# Serve HTTP
server {
    listen 80;
    server_name domain.tld;
    
    # Let's encrypt challenge
    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /home/http/letsencrypt-auto;
    }

    # Forbidds let's encrypt folder listing
    location = /.well-known/acme-challenge/ {
        return 404;
    }

    location / {
        return 301 https://$server_name$request_uri;
    }
}

# Serve HTTPS
server {
    listen 443 ssl;
    server_name domain.tld;
    access_log /var/log/nginx/domain.tld.access.log;
    ssl on;
    ssl_certificate /etc/letsencrypt/live/domain.tld/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.tld/privkey.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/domain.tld/fullchain.pem;
    ssl_session_timeout 5m;
    ssl_prefer_server_ciphers on;

    location / {
        root /srv/http/static.domain.tld;
    }
}