server {
    listen 80;
    server_name www.domain.com domain.com;
    access_log /var/log/nginx/domain.com.log;
    error_log /var/log/nginx/domain.com_error.log;
    rewrite ^(.*) https://domain.com$1 permanent;
    server_tokens off;
}

server {
    listen 443 ssl;
    ssl on;
    ssl_certificate /etc/ssl/domain.com/fullchain.pem;
    ssl_certificate_key /etc/ssl/domain.com/private.key;
    ssl_dhparam /etc/ssl/domain.com/dhparam.pem;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;
    ssl_session_cache shared:SSL:10m;
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; ";
    ssl_prefer_server_ciphers on;
    server_name domain.com;
    root /var/www/domain.com;
    access_log /var/log/nginx/domain.com.log;
    error_log /var/log/nginx/domain.com_error.log;
    index index.php index.html index.htm index.nginx-debian.html;
    rewrite_log on;
    server_tokens off;
    location / {
        try_files $uri $uri/ =404;
        }
        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
        }
        location ~ /\.ht {
                deny all;
        }
}