# /etc/nginx/vhosts.d/monoexp.com.conf
#
# monoexp.com is canonical; www.monoexp.com redirects to it.
# Port 80 (ACME challenges and the HTTP->HTTPS redirect) is already handled
# by the `.monoexp.com` block in 00-default.conf, which matches the apex too.
#
# Certificate: one cert named "monoexp-home" covering both names. The
# issue-cert wrapper only accepts subdomains, so issue it directly as bajdev:
#   sudo certbot certonly --webroot -w /srv/www/acme --cert-name monoexp-home \
#     -d monoexp.com -d www.monoexp.com --deploy-hook 'systemctl reload nginx'

# www -> apex
server {
    listen 443 ssl; listen [::]:443 ssl;
    server_name www.monoexp.com;
    ssl_certificate     /etc/letsencrypt/live/monoexp-home/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/monoexp-home/privkey.pem;
    include snippets/tls-common.conf;
    return 301 https://monoexp.com$request_uri;
}

# apex: the home page
server {
    listen 443 ssl; listen [::]:443 ssl;
    server_name monoexp.com;
    ssl_certificate     /etc/letsencrypt/live/monoexp-home/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/monoexp-home/privkey.pem;
    include snippets/tls-common.conf;

    root /srv/www/vhosts/monoexp.com;
    index index.html;

    location / { try_files $uri $uri/ =404; }

    # Short cache for the stylesheet and icon; HTML keeps nginx's defaults.
    location ~* \.(css|svg)$ { expires 1h; }
}