gistfile1.txt

# ============================
# Generic Nginx HTTPS redirect + stub_status
# ============================

# HTTP server block
server {
    listen 80 default_server;
    server_name _;

    # Allow /basic_status on HTTP for monitoring
    location /basic_status {
        stub_status;
        allow 127.0.0.1;   # Only Zabbix agent on localhost
        deny all;
    }

    # Redirect all other HTTP traffic to HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS server block
server {
    listen 443 ssl http2 default_server;
    server_name _;   # Matches any hostname

    # SSL certs — use wildcard or per‑domain certs
    ssl_certificate     /etc/nginx/ssl/wildcard.crt;
    ssl_certificate_key /etc/nginx/ssl/wildcard.key;

    # Recommended SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    # Default site content
    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
}