nginx.conf

user nginx;

worker_processes  1;

events {
  worker_connections  1024;
}


http {
  include       mime.types;
  default_type  application/octet-stream;

  sendfile        on;

  keepalive_timeout  65;
  map $http_upgrade $connection_upgrade {
      default upgrade;
        ''      close;
  }
  server {
    listen 80;
    listen [::]:80;
    server_name {{ fully_qualified_domain }};

    location ^~ /.well-known {
      allow all;
      root /var/www;
      default_type "text/plain";
      try_files $uri =404;
    }

    location / {
      return 301 https://{{ fully_qualified_domain }}$request_uri;
    }
  }

  server {
    listen       443 ssl http2;
    listen [::]:443 ssl http2;
    server_name  {{ fully_qualified_domain }};

    ssl                  on;
    ssl_certificate      /etc/letsencrypt/live/{{ fully_qualified_domain }}/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ fully_qualified_domain }}/privkey.pem;

    ssl_session_timeout  5m;

    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers   on;
    ssl_dhparam /etc/nginx/dhparam.pem;

#        ssl_verify_client optional;

    root   /var/www;

    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload";

    location / {
      index  index.html index.htm;
    }

    include nextcloud.conf;

    location /piwik {
      root {{data_mount}}/webapps;
      index index.php;
    }

    location ~* ^/piwik/(?:index|piwik)\.php$ {
      root {{data_mount}}/webapps;
      include           fastcgi.conf;
      fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
    }

    location ~ ^/piwik/.*\.php$ {
      return 404;
    }


  }

  include wallabag.conf;
}