infrastructure/roles/maintenance/templates/nginx-maintenance.conf.j2

{% for domain in service_alternate_domains | default([]) %}
server {
    include snippets/listen-80.conf;

    server_name  {{ domain }};

    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;
    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log.json json_reduced;
    error_log    {{ maintenance_logs_dir }}/{{ service_domain }}-error.log;

    include snippets/letsencrypt.conf;

    location / {
        access_log off;
        return 302 https://$server_name$request_uri;
    }
}

server {
    include      snippets/listen-443.conf;
    server_name  {{ domain }};

    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;
    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log.json json_reduced;
    error_log    {{ maintenance_logs_dir }}/{{ service_domain }}-error.log;

    ssl_certificate      /etc/letsencrypt/live/{{ service_domain }}/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ service_domain }}/privkey.pem;

    location / {
        access_log off;
        return 302 https://{{ service_domain }};
    }
}

{% endfor %}
{% for domain in service_legacy_domains | default([]) %}
server {
    include snippets/listen-80.conf;

    server_name  {{ domain }};

    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;
    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log.json json_reduced;
    error_log    {{ maintenance_logs_dir }}/{{ service_domain }}-error.log;

    include snippets/letsencrypt.conf;

    location / {
        access_log off;
        return 302 https://$server_name$request_uri;
    }
}

server {
    include      snippets/listen-443.conf;
    server_name  {{ domain }};

    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;
    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log.json json_reduced;
    error_log    {{ maintenance_logs_dir }}/{{ service_domain }}-error.log;

    ssl_certificate      /etc/letsencrypt/live/{{ service_domain }}_legacy/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ service_domain }}_legacy/privkey.pem;

    location / {
        access_log off;
        return 302 https://{{ service_domain }};
    }
}

{% endfor %}
server {
    include snippets/listen-80.conf;

    server_name  {{ service_domain }};

    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;
    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log.json json_reduced;
    error_log    {{ maintenance_logs_dir }}/{{ service_domain }}-error.log;

    include snippets/letsencrypt.conf;

    location / {
        access_log off;
        return 302 https://$server_name$request_uri;
    }
}

server {
    include      snippets/listen-443.conf;
    server_name  {{ service_domain }};

    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log reduced;
    access_log   {{ maintenance_logs_dir }}/{{ service_domain }}-access.log.json json_reduced;
    error_log    {{ maintenance_logs_dir }}/{{ service_domain }}-error.log;

    ssl_certificate      /etc/letsencrypt/live/{{ service_domain }}/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ service_domain }}/privkey.pem;

    error_page 503 /503.html;

    location / {
        return 503;
    }

    location = /503.html {
        root {{ maintenance_http_dir }}/{{ service_domain }};
    }
}