# Nginx Vhost Template

Use this template when adding a new site to the FreeBSD host.

## Standard HTTPS vhost with www redirect

```nginx
# redirect HTTP to HTTPS (both www and non-www)
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

# redirect HTTPS www to non-www
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name www.example.com;

    ssl_certificate     /usr/local/etc/nginx/ssl/example/fullchain.cer;
    ssl_certificate_key /usr/local/etc/nginx/ssl/example/example.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    return 301 https://example.com$request_uri;
}

# HTTPS — main site
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com;
    root /usr/local/www/example;
    index index.html;

    ssl_certificate     /usr/local/etc/nginx/ssl/example/fullchain.cer;
    ssl_certificate_key /usr/local/etc/nginx/ssl/example/example.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        try_files $uri $uri/ =404;
    }
}
```

## Checklist

1. Create webroot: `mkdir -p /usr/local/www/example`
2. Create SSL dir: `mkdir -p /usr/local/etc/nginx/ssl/example`
3. Obtain certificate (acme.sh or certbot)
4. Save config to `/usr/local/etc/nginx/vhosts/example.conf`
5. Test: `sudo nginx -t`
6. Reload: `sudo service nginx reload`
