a1-domain.com--CDN

server {
  include       fastcgi_params;
  fastcgi_param MAIN_SITE_NAME domain.com;
  set $main_site_name "domain.com";
  fastcgi_param HTTPS on;
  listen        *:443 ssl http2;
  server_name   domain.com;
  root          /data/disk/o1/static/grav-site-domain-com;
  ssl                        on;
  ssl_stapling               on;
  ssl_stapling_verify        on;
  resolver 8.8.8.8 8.8.4.4 valid=300s;
  resolver_timeout           5s;
  ssl_dhparam                /etc/ssl/private/nginx-wild-ssl.dhp;
  ssl_certificate_key        /data/disk/o1/config/server_master/ssl.d/domain.com/openssl.key;
  ssl_certificate            /data/disk/o1/config/server_master/ssl.d/domain.com/openssl_chain.crt;
  ssl_trusted_certificate    /data/disk/o1/tools/le/certs/domain.com/chain.pem;

  ###
  ### Allow access to letsencrypt.org ACME challenges directory.
  ###
  location ^~ /.well-known/acme-challenge {
    alias /data/disk/o1/tools/le/.acme-challenges;
    try_files $uri 404;
  }

  location ^~ /admin {
    allow 11.22.33.44;
    allow 11.22.33.55;
    allow 11.22.33.66;
    deny  all;
    try_files $uri $uri/ /index.php?_url=$uri;
  }

  include  /data/disk/o1/config/includes/gravcms_vhost_common.conf;
}


# alias redirection virtual host
server {
  listen        *:443 ssl http2;
  server_name  www.domain.com;
  ssl                        on;
  ssl_stapling               on;
  ssl_stapling_verify        on;
  resolver 8.8.8.8 8.8.4.4 valid=300s;
  resolver_timeout           5s;
  ssl_dhparam                /etc/ssl/private/nginx-wild-ssl.dhp;
  ssl_certificate_key        /data/disk/o1/config/server_master/ssl.d/domain.com/openssl.key;
  ssl_certificate            /data/disk/o1/config/server_master/ssl.d/domain.com/openssl_chain.crt;

  ###
  ### Allow access to letsencrypt.org ACME challenges directory.
  ###
  location ^~ /.well-known/acme-challenge {
    alias /data/disk/o1/tools/le/.acme-challenges;
    try_files $uri 404;
  }

  return 301 $scheme://domain.com$request_uri;
}


# alias redirection virtual host
server {
  listen        *:80;
  server_name  www.domain.com;
  access_log   off;

  ###
  ### Allow access to letsencrypt.org ACME challenges directory.
  ###
  location ^~ /.well-known/acme-challenge {
    alias /data/disk/o1/tools/le/.acme-challenges;
    try_files $uri 404;
  }

  return 301 $scheme://domain.com$request_uri;
}


# alias redirection virtual host
server {
  include       fastcgi_params;
  fastcgi_param MAIN_SITE_NAME domain.com;
  set $main_site_name "domain.com";
  listen        *:80;
  server_name   domain.com;
  root          /data/disk/o1/static/grav-site-domain-com;

  ###
  ### Allow access to letsencrypt.org ACME challenges directory.
  ###
  location ^~ /.well-known/acme-challenge {
    alias /data/disk/o1/tools/le/.acme-challenges;
    try_files $uri 404;
  }

  return 301 https://domain.com$request_uri;
}