server {
	listen 443 ssl spdy;
	listen [::]:443 ssl spdy;
	server_name cd0.us www.cd0.us *.cd0.us;

	root /kek/no/ty;
	index index.html index.htm index.php;

	ssl on;
	ssl_certificate /etc/ssl/cd0.us/cd0.us.crt;
	ssl_certificate_key /etc/ssl/cd0.us/cd0.us.key;

        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/ssl/cd0.us/full_chain.pem;
        resolver 8.8.8.8 8.8.4.4 valid=300s;
        resolver_timeout 5s;

        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
        add_header X-Frame-Options "DENY";
        add_header X-Content-Type-Options nosniff;

	if ($bad_client) { return 403; }
	if ($bad_referer) { return 444; }

	location = /favicon.ico {
		log_not_found off;
		access_log off;
	}

	location = /robots.txt {
		allow all;
		log_not_found off;
		access_log off;
	}
}