server {
	listen 80;
	listen [::]:80;
	server_name meweb.arasaka.software v4.meweb.arasaka.software v6.meweb.arasaka.software;
	access_log off;

	location ^~ /.well-known/acme-challenge/ {
		root /var/www/acme;
		default_type "text/plain";
		allow all;
	}

	location / {
		return 301 https://$host$request_uri;
	}
}

server {
	listen 443 ssl;
	listen 8444 ssl proxy_protocol;
	listen [::]:443 ssl;
	server_name meweb.arasaka.software v4.meweb.arasaka.software v6.meweb.arasaka.software;

	ssl_certificate     /root/.acme.sh/meweb.arasaka.software_ecc/fullchain.cer;
	ssl_certificate_key /root/.acme.sh/meweb.arasaka.software_ecc/meweb.arasaka.software.key;

	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
	add_header Referrer-Policy "no-referrer" always;
	add_header X-Content-Type-Options "nosniff" always;
	add_header X-Frame-Options "DENY" always;

	access_log off;
	error_log  /var/log/nginx/meweb.arasaka.software.error.log;

	client_max_body_size 128k;

	location ^~ /.well-known/acme-challenge/ {
		root /var/www/acme;
		default_type "text/plain";
		allow all;
	}

	location / {
		proxy_pass         http://127.0.0.1:5480;
		proxy_http_version 1.1;
		proxy_set_header   Host $host;
		proxy_set_header   X-Forwarded-For $remote_addr;
		proxy_set_header   X-Forwarded-Proto https;
		proxy_set_header   Connection "";
	}
}