Certbot + redirects

letsencrypt.conf

# /etc/nginx/snippets/letsencrypt.conf

location ^~ /.well-known/acme-challenge/ {
  default_type "text/plain";
  root /srv/www/letsencrypt;
}

# Hide /acme-challenge subdirectory and return 404 on all requests.
location = /.well-known/acme-challenge/ {
  return 404;
}

tld_redirects.conf

# /etc/nginx/conf.d/tld_redirects.conf

server {
  listen 443 ssl http2;
  server_name example.com;

  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
  include snippets/letsencrypt.conf;

  location @redirect {
    return 301 https://www.example.com$request_uri;
  }

  try_files $uri @redirect;
}

server {
  listen 80;
  server_name example.com;
  include snippets/letsencrypt.conf;

  location @redirect {
    return 301 https://www.example.com$request_uri;
  }

  try_files $uri @redirect;
}