server {
  listen 80;
  listen [::]:80;
  listen 443 quic;
  listen 443 ssl;
  listen [::]:443 quic;
  listen [::]:443 ssl;
  ssl_certificate_key {{ssl_certificate_key}};
  ssl_certificate {{ssl_certificate}};
  server_name {{server_name}};
  client_max_body_size 5048M;
  root /home/clp/htdocs/app/files/public;

  access_log /home/clp/logs/nginx/access.log;
  error_log /home/clp/logs/nginx/error.log;

  location ~ /.well-known {
    auth_basic off;
    allow all;
  }

  if ($scheme != "https") {
    rewrite ^ https://$host$uri permanent;
  }

  location / {
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_pass https://127.0.0.1:8443/;
    proxy_max_temp_file_size 0;
    proxy_connect_timeout 7200;
    proxy_send_timeout 7200;
    proxy_read_timeout 7200;
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
    proxy_temp_file_write_size 256k;
  }

  add_header Alt-Svc 'h3=":443"; ma=86400' always;
}
