server {
    if ($host = cloud.domain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name cloud.domain.com;
}
server {
    listen       443 ssl http2;

server_name  cloud.domain.com;

    error_log   /var/log/nginx/cloud.domain.com.error.log error;
    access_log   /var/log/nginx/cloud.domain.com.access.log main;

    location ^~ /.well-known {
        # The rules in this block are an adaptation of the rules
        # in `.htaccess` that concern `/.well-known`.

        location = /.well-known/carddav { return 301 /remote.php/dav/; }
        location = /.well-known/caldav  { return 301 /remote.php/dav/; }

        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }

        # Let Nextcloud's API for `/.well-known` URIs handle all other
        # requests by passing them to the front-end controller.
        return 301 /index.php$request_uri;
    }

    location / {
        proxy_redirect          off;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Forwarded-Proto $scheme;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        Strict-Transport-Security       15552000;
        proxy_pass_request_headers      on;
        proxy_connect_timeout   600;
        proxy_send_timeout      600;
        proxy_read_timeout      600;
        proxy_buffering         off;
        proxy_pass http://10.60.5.96:80/;
    }

    location /office {
        proxy_redirect          off;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Forwarded-Proto $scheme;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass_request_headers      on;
        proxy_connect_timeout   90;
        proxy_send_timeout      120;
        proxy_read_timeout      120;
        proxy_pass https://10.60.5.95:443/;
        proxy_ssl_verify              off;
    }

    include default.d/custom_ssl_cert_domain.com.conf;

}