listen 443 ssl http2;
listen [::]:443 ssl http2;

ssl_session_cache    shared:SSL:10m;
ssl_session_timeout  5m;

ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers  HIGH+ECDHE:!aNULL:!MD5:!RC4;
ssl_prefer_server_ciphers  on;

ssl_stapling               on;
ssl_stapling_verify        on;
ssl_trusted_certificate    %DATA_DIR%/acme/%FIRST_DOMAIN%/fullchain.cer;
ssl_certificate            %DATA_DIR%/acme/%FIRST_DOMAIN%/fullchain.cer;
ssl_certificate_key        %DATA_DIR%/domain.key;

location ^~ /.well-known/acme-challenge/ {
    alias %CHALLENGE_DIR%/.well-known/acme-challenge/;
    try_files $uri =404;
}

## Uncomment this if you want enable HSTS, and force redirect http to https.
#location / {
#    add_header Strict-Transport-Security "max-age=63072000; preload";
#    add_header X-Frame-Options "DENY";
#    if ( $scheme = http ) {
#        rewrite ^(.*)$ https://$host$1 permanent;
#    }
#    try_files $uri $uri/ =404;
#}