`sites-available/forza.agentabrams.com`

55 lines
# forza.agentabrams.com — FORZA law firm website mockups
# Static site · deployed from /root/git/Forza.git via post-receive hook

server {
    server_name forza.agentabrams.com;

    root /var/www/forza.agentabrams.com;
    index index.html;

    access_log /var/log/nginx/forza.agentabrams.com.access.log;
    error_log /var/log/nginx/forza.agentabrams.com.error.log;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Gzip
    gzip on;
    gzip_types text/plain text/css text/javascript application/javascript application/json image/svg+xml;
    gzip_min_length 1024;

    # Serve static files; fall back to directory index then 404
    location / {
        try_files $uri $uri/ $uri/index.html =404;
    }

    # Cache static assets aggressively
    location ~* \.(css|js|png|jpg|jpeg|gif|svg|woff|woff2|ico)$ {
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/forza.agentabrams.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/forza.agentabrams.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}


server {
    if ($host = forza.agentabrams.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name forza.agentabrams.com;
    return 404; # managed by Certbot


}