matthewtran.com/website/server.conf

# adapted from /etc/nginx/nginx.conf
worker_processes auto;
error_log /dev/stderr;

events {
    worker_connections 1024;
}

http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    gzip on;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_certificate     /data/live/matthewtran.com/fullchain.pem;
    ssl_certificate_key /data/live/matthewtran.com/privkey.pem;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    access_log /dev/stdout;

    # SSL redirect
    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        return 301 https://$host$request_uri;
    }

    # default
    server {
        listen 443 ssl default_server;
        listen [::]:443 ssl default_server;
        server_name _;
        return 404;
    }

    # website
    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name matthewtran.com www.matthewtran.com;

        root /var/www/html;
        index index.html;
        location / {
            try_files $uri $uri/ =404;
        }
    }

    # gitea
    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name git.matthewtran.com;

        location / {
            client_max_body_size 512M;
            proxy_pass http://127.0.0.1:3000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
        }
    }
}