# HTTP → HTTPS www
server {
    listen 80;
    server_name workoutfacile.com www.workoutfacile.com;
    return 301 https://www.workoutfacile.com$request_uri;
}

# HTTPS non-www → www
server {
    listen 443 ssl;
    server_name workoutfacile.com;
    ssl_certificate /etc/letsencrypt/live/workoutfacile.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/workoutfacile.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    return 301 https://www.workoutfacile.com$request_uri;
}

# HTTPS www → site
server {
    listen 443 ssl;
    server_name www.workoutfacile.com;
    root /var/www/workoutfacile.com;
    index index.php index.html;
    client_max_body_size 128M;

    ssl_certificate /etc/letsencrypt/live/workoutfacile.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/workoutfacile.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    include snippets/perf.conf;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_read_timeout 300;
    }

    location ~ /\.ht {
        deny all;
    }
}