server {
  listen       80;
  listen       [::]:80;
  server_name
      server-example
      example.net
      www.example.net
  ;

root   /srv/users/serverpilot/apps/example/public;

access_log  /srv/users/serverpilot/log/example/example_nginx.access.log main;
error_log  /srv/users/serverpilot/log/example/example_nginx.error.log;

proxy_set_header    Host              $host;
proxy_set_header    X-Real-IP         $remote_addr;
proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;

include /etc/nginx-sp/vhosts.d/example.d/*.nonssl_conf;
include /etc/nginx-sp/vhosts.d/example.d/*.conf;
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name  example.net www.example.net;


ssl on;

# certificates
ssl_certificate         /etc/nginx-sp/certs/example.net/example.net.chained.crt;
ssl_certificate_key     /etc/nginx-sp/certs/example.net/example.net.key;

    #SSL Optimization
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:20m;
ssl_session_tickets off;

    # modern configuration
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # verify chain of trust of OCSP response
    ssl_trusted_certificate /etc/nginx-sp/certs/example.net/example.net.chained.crt;
    #root directory and logfiles
    root /srv/users/serverpilot/apps/example/public;

    access_log /srv/users/serverpilot/log/example/example_nginx.access.log main;
    error_log /srv/users/serverpilot/log/example/example_nginx.error.log;

    #proxyset
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-SSL on;
    proxy_set_header X-Forwarded-Proto $scheme;

    #includes
    include /etc/nginx-sp/vhosts.d/example.d/*.nonssl_conf;
    include /etc/nginx-sp/vhosts.d/example.d/*.conf;
}

url                          statuscodes
url with http + www          301  → 200 (1 redirect)
url with http                301  → 200 (1 redirect)
url with https + www         301  → 200 (1 redirect)
url with https               200        (0 redirect)

location /path/ {
  return 301 https://www.example.com/path/;
}

server {
  listen 443 ssl http2; # http2 only if you built that module in
  server_name www.example.com;

  ssl_certificate /path/to/file;
  ssl_certificate_key /path/to/file;

  # Insert other SSL configuration

  return 301 https://example.com$request_uri;
}

server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://example.com$request_uri;
}